amdm.ru Open in urlscan Pro
2606:4700:3030::6815:3084 Public Scan

ec2-18-158-83-38.eu-central-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

54db499a7d62acfe42c8c7725c330385946b096fc035b72ade41f38b138caab9

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://amdm.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:47 GMT
AN-X-Request-Uuid: 4fb3561f-757f-4659-8860-35979ae1ed60
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://amdm.ru
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 178.162.209.131; 178.162.209.131; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 358
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
565 B 192ms
109ms XHR
application/json 2602:803:c003:200::31
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17352&site_id=350652&zone_id=1866314&size_id=57&rp_schain=1.0,1!notsy.io,b3ec3c43-a63e-492c-b56d-91b0b6105b48,1,,,&rf=https%3A%2F%2Famdm.ru%2F&tk_flint=pbjs_lite_v4.43.4&x_source.tid=0c03a955-bbcd-4422-8ece-708d0f627df7&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.396422742995548
Requested by: Host: cdn-b.notsy.io
URL: https://cdn-b.notsy.io/amd/a/ym.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::31 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 077dd6b713ba04ace1d0498aefbae77d59d9321304f381d5bdb1f2bc79af662a

Request headers

Referer: https://amdm.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:47 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://amdm.ru
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 241
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
786 B 185ms
102ms XHR
application/json 2602:803:c003:200::31
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17352&site_id=350652&zone_id=1866324&size_id=15&rp_schain=1.0,1!notsy.io,b3ec3c43-a63e-492c-b56d-91b0b6105b48,1,,,&rf=https%3A%2F%2Famdm.ru%2F&tk_flint=pbjs_lite_v4.43.4&x_source.tid=34c1ac7c-2bac-4bef-9238-9b404140c48c&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.015868640212536977
Requested by: Host: cdn-b.notsy.io
URL: https://cdn-b.notsy.io/amd/a/ym.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::31 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: a2480e9a285ec827fe3154a9616a9e7300ccd60aad06e194b36aa9f6682cb18f

Request headers

Referer: https://amdm.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:47 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://amdm.ru
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 241
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
565 B 185ms
103ms XHR
application/json 2602:803:c003:200::31
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17352&site_id=350652&zone_id=1866316&size_id=9&alt_size_ids=10&rp_schain=1.0,1!notsy.io,b3ec3c43-a63e-492c-b56d-91b0b6105b48,1,,,&rf=https%3A%2F%2Famdm.ru%2F&tk_flint=pbjs_lite_v4.43.4&x_source.tid=2dcc9f2c-94b8-4f86-9312-8cf457b6803c&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.16798916946098275
Requested by: Host: cdn-b.notsy.io
URL: https://cdn-b.notsy.io/amd/a/ym.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::31 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 195ea7afe1275b64850c1a2fe66f00ab64bbb9d0156d65d1a1615da0cc874e7b

Request headers

Referer: https://amdm.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:47 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://amdm.ru
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 241
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 14 KB
7 KB 180ms
152ms XHR
application/json 104.18.25.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=662517&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22135db527d64e216%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Famdm.ru%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A3%2C%22ren%22%3Afalse%2C%22version%22%3A%224.43.4%22%2C%22userIds%22%3A%5B%5D%2C%22msd%22%3A1%2C%22msi%22%3A1%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22notsy.io%22%2C%22sid%22%3A%22b3ec3c43-a63e-492c-b56d-91b0b6105b48%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2214146c8b560fd95%22%2C%22ext%22%3A%7B%22siteID%22%3A%22662517%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2215f4cdff7a28ee2%22%2C%22ext%22%3A%7B%22siteID%22%3A%22662518%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2216da0eb0755f686%22%2C%22ext%22%3A%7B%22siteID%22%3A%22662520%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2216da0eb0755f686%22%2C%22ext%22%3A%7B%22siteID%22%3A%22662520%22%2C%22sid%22%3A%22160x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A160%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by: Host: cdn-b.notsy.io
URL: https://cdn-b.notsy.io/amd/a/ym.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 896743ce15e1121f6a90d27257866c91d227ce93c2eda36635ac2521f79629db

Request headers

Referer: https://amdm.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:47 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8FYiZk2z1VNZEqoEAi2n%2Bpqlmj1wSquGK6gV4UcVBx9e77%2FuJLEJodeQkdHvy1FJRLuR17McKdhoRGZbK1L%2F0aThm1vfs%2BUz5rc%2BQfUq8sIPXaSFJHVVf7IS3GmHD61MjKMIQJgB"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://amdm.ru
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 79fb4ab568dc3a61-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: 0

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
549 B 37ms
10ms XHR
application/json 18.158.83.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=4.43.4&referrer=https%3A%2F%2Famdm.ru%2F&tmax=1000

Requested by

Host: cdn-b.notsy.io
URL: https://cdn-b.notsy.io/amd/a/ym.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.158.83.38 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://amdm.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:47 GMT
accept-ch: sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink,user-agent,sec-ch-ect
x-auction-status: 17, 17, 17
content-type: application/json; charset=utf-8
access-control-allow-origin: https://amdm.ru
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
209 B 173ms
15ms XHR
text/plain 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=33&wv=4.43.4&cb=20220269113

Requested by

Host: cdn-b.notsy.io
URL: https://cdn-b.notsy.io/amd/a/ym.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://amdm.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 26 Feb 2023 20:04:47 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://amdm.ru
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 381 B
599 B 72ms
22ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=amdm.ru&callback=_gfp_s_&client=ca-pub-8325944981718568

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202302160101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8325944981718568&plah=amdm.ru&bust=31072532

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

596222760a2ff4c301604a4430376a622287643b71f93dbcea2367f7b76b3add

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://amdm.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 247
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
531 B 76ms
22ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=amdm.ru

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://amdm.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 58ms
22ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=amdm.ru

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://amdm.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7A99 603 B
245 B 171ms
170ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8325944981718568&output=html&adk=293675617&adf=814277786&lmt=1677441887&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Famdm.ru%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1677441887312&bpp=3&bdt=298&idt=264&shv=r20230222&mjsv=m202302160101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5874329206163&frm=20&pv=2&ga_vid=606710058.1677441887&ga_sid=1677441888&ga_hid=1045764727&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44777877%2C31072349%2C31072532%2C31071662&oid=2&pvsid=2452287072134293&tmod=1268985087&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=288

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://amdm.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Feb 2023 20:04:47 GMT
expires: Sun, 26 Feb 2023 20:04:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 28ms
26ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=amdm.ru

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022201.js?cb=31072625

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://amdm.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 22ms
22ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=amdm.ru

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022201.js?cb=31072625

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://amdm.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 37 KB
15 KB 771ms
770ms XHR
text/plain 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2452287072134293&correlator=3780405740482087&eid=31072020%2C31072625%2C44761478%2C31071662&output=ldjh&gdfp_req=1&vrg=2023022201&ptt=17&impl=fifs&iu_parts=22148577499%2CAMD_ATF_970%2CAMD_MID_300c%2CAMD_ATFR_300&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=320x50%7C970x250%2C300x250%2C320x50%7C300x600%7C160x600&fluid=height%2C0%2Cheight&ifi=2&adks=2118771456%2C1284549035%2C1197895001&sfv=1-0-40&fsbs=1%2C1%2C1&prev_scp=r_imp%3D0%26r_cnt%3D0%26page_id%3Dmain_page_desktop%26variation%3DA%26traffic_source%3Ddirect%26hb_format_ix%3Dbanner%26hb_source_ix%3Dclient%26hb_size_ix%3D970x250%26hb_pb_ix%3D0.04%26hb_adid_ix%3D25fd12dd204af03%26hb_bidder_ix%3Dix%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D970x250%26hb_pb%3D0.04%26hb_adid%3D25fd12dd204af03%26hb_bidder%3Dix%7Cr_imp%3D0%26r_cnt%3D0%26page_id%3Dmain_page_desktop%26variation%3DA%26traffic_source%3Ddirect%7Cr_imp%3D0%26r_cnt%3D0%26page_id%3Dmain_page_desktop%26variation%3DA%26traffic_source%3Ddirect%26hb_format_ix%3Dbanner%26hb_source_ix%3Dclient%26hb_size_ix%3D300x600%26hb_pb_ix%3D0.04%26hb_adid_ix%3D2629700e037e334%26hb_bidder_ix%3Dix%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D300x600%26hb_pb%3D0.04%26hb_adid%3D2629700e037e334%26hb_bidder%3Dix&sc=1&cookie=ID%3Df624f689f4d631c1-221217772fdd009f%3AT%3D1677441887%3ART%3D1677441887%3AS%3DALNI_MYpb0XmCwbn85I9wLQ0ygJk7bRlvQ&gpic=UID%3D00000bbc50ba00b1%3AT%3D1677441887%3ART%3D1677441887%3AS%3DALNI_MYaMA8x_bGfH6g9SEUZl8-7KXqZ6A&abxe=1&dt=1677441887776&lmt=1677441887&dlt=1677441887014&idt=426&adxs=315%2C1230%2C1230&adys=255%2C2328%2C2328&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C1%7C2&ucis=1%7C2%7C3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Famdm.ru%2F&frm=20&vis=1&psz=1600x250%7C0x0%7C300x684&msz=1600x250%7C300x0%7C300x0&fws=0%2C0%2C0&ohw=0%2C0%2C0&ga_vid=606710058.1677441887&ga_sid=1677441888&ga_hid=1045764727&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022201.js?cb=31072625

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2098822511b16a50e6ff3f5a13891dc1d209f719d1bc1492d0b19551e0c771d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://amdm.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14225
x-xss-protection: 0
google-lineitem-id: -1,-1,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://amdm.ru
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 66F9 6 KB
3 KB 79ms
27ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022201.js?cb=31072625

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://amdm.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 26 Feb 2023 20:04:47 GMT
expires: Mon, 26 Feb 2024 20:04:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 67ms
67ms XHR
application/json 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230222&st=env

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04ca8fac38538e9270f40768f9800c62ffc053b096baeabf171c9c866aa7325a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://amdm.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11094
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 61ms
22ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://amdm.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 26 Feb 2023 20:04:48 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 6533 13 KB
5 KB 16ms
14ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://amdm.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3548
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 26 Feb 2023 19:05:40 GMT
expires: Mon, 26 Feb 2024 19:05:40 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame E9DD 783 B
1 KB 59ms
22ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

cb9d1c0df9f84ab1b1de259e794356ebc3db0aadc6fd1cddfbedf45efd749c4a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-wsRYf_bBR_nzSxKbs5oz3Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://amdm.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-wsRYf_bBR_nzSxKbs5oz3Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 26 Feb 2023 20:04:48 GMT
expires: Sun, 26 Feb 2023 20:04:48 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 ENhUjQ5Efr1LKcBlRSMtCxEMsPeXm4hb-JW7itjXrRA.js Show response
pagead2.googlesyndication.com/bg/ Frame 6533 36 KB
14 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/ENhUjQ5Efr1LKcBlRSMtCxEMsPeXm4hb-JW7itjXrRA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

10d8548d0e447ebd4b29c06545232d0b110cb0f7979b885bf895bb8ad8d7ad10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 10:37:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 120431
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14306
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 25 Feb 2024 10:37:37 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame E9DD 0
0 115ms
114ms Image
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230222&jk=2452287072134293&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 6533 0
10 B 13ms
13ms Image
text/plain 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?lEbgaA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:48 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 container.html Show response
e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6BD2 6 KB
3 KB 17ms
15ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022201.js?cb=31072625

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://amdm.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 26 Feb 2023 20:04:47 GMT
expires: Mon, 26 Feb 2024 20:04:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C0F9 6 KB
3 KB 15ms
14ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022201.js?cb=31072625

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://amdm.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 26 Feb 2023 20:04:47 GMT
expires: Mon, 26 Feb 2024 20:04:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 89 KB
29 KB 111ms
29ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: cdn-b.notsy.io
URL: https://cdn-b.notsy.io/amd/a/ym.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://amdm.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 24 Feb 2023 07:57:32 GMT
server: nginx
etag: W/"63f86dec-16386"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 27 Feb 2023 20:04:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D70C 624 B
242 B 56ms
53ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COed9gIQ_eHmjwIYiNqa4QEwAQ&v=APEucNW6ce8kzCkvjRgHEo-tfgOLm0CutNPPQTlR9tvjD7ntO0iYLh0Tj-d75Ktrj7hcUT-0uOvJV0pWzzsTwKqj5mIV7ZD4u66UfMaPddyT-fKyYq3VQ3kIgCmUXOSlKTWdFDj5pMnpUZljS52XSltSdC5O3dc2m5Ho3VSQdx5VGtTpZgWjWUY

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Feb 2023 20:04:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 6BD2 78 KB
27 KB 153ms
153ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

16b432ac8f43a6b2d8aa358f41ee60e2ef5923b2645bf2c37f3a06f8334b1557

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27790
x-xss-protection: 0
server: cafe
etag: 3677590245327912432
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 26 Feb 2023 20:04:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6BD2 42 B
63 B 116ms
114ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AjaPTtccncFRjagAd8bVmmqIGP5Btn92ZGGLm9_pUG7jvsrnfu6gHfU0SD3Uil0pBTWPsQJzRoaEq9Q-JCbhsPlSdAKCZbTQkbzRQxnUTHwHusDXk

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6BD2 0
20 B 116ms
115ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=15410687026121624398&x=1&ct=76

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/ Frame 6BD2 3 KB
1 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/window_focus_fy2021.js

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 19:05:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3548
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 12 Mar 2023 19:05:40 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/ Frame 6BD2 20 KB
8 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5e713a207017a40f54387d0e25bbb3cbbe1b3d10338cdd4a7342cc1486b19140

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 18:59:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3945
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8274
x-xss-protection: 0
server: cafe
etag: 9471482037410804447
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 12 Mar 2023 18:59:03 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 6BD2 0
0 24ms
22ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQxARrMhM9vX90cQl80DANY-12f38ucEN1p_OKURdhBY28HPrrwxqfHlo5_YA5FrPY95DsoZmDgOUwgl5sMNCFZVFP8OQ
Requested by: Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6BD2 158 KB
49 KB 33ms
31ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82d63ecef7851ffd217020b3817b0206328488879b0c782f9b67d43bd1479a2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49360
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1677104061356577"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 26 Feb 2023 20:04:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C9DF 624 B
242 B 57ms
54ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKo89UCEOuOtqEDGOaKnOEBMAE&v=APEucNW97g1eAA64C0KtnSvLMhxaivfo8F3y524xpzldihHb5BantPK6WEdyirEZ69xJf_hxJex-kUJJ3nSHpYU1pNbITe_oBWCD6apSkhHV49V0H0xpooENjxUQtfs0Sli1IE3I97pXmpz0bOmtIkStOHnlJs2W58qJbcNT7jA08EJBrJqrB9I

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Feb 2023 20:04:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame C0F9 78 KB
27 KB 182ms
182ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

16b432ac8f43a6b2d8aa358f41ee60e2ef5923b2645bf2c37f3a06f8334b1557

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27790
x-xss-protection: 0
server: cafe
etag: 3677590245327912432
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 26 Feb 2023 20:04:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C0F9 42 B
63 B 118ms
116ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AVmJztqZnLzPaZHE-_Vf0P-X4hyTyIjGygBQwNpUHzKTwIMX7tZ9GSFhHsVKF5we-pyK5tmjYjDPQFHvVZHavJv9IWZfDRqIKj5QxqRkwIziCdxZY

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C0F9 0
20 B 141ms
140ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=10488911842324676314&x=1&ct=76

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/ Frame C0F9 3 KB
1 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/window_focus_fy2021.js

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 19:05:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3548
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 12 Mar 2023 19:05:40 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/ Frame C0F9 20 KB
8 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230222/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5e713a207017a40f54387d0e25bbb3cbbe1b3d10338cdd4a7342cc1486b19140

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 18:59:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3945
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8274
x-xss-protection: 0
server: cafe
etag: 9471482037410804447
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 12 Mar 2023 18:59:03 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame C0F9 0
0 23ms
22ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ2RPWedgE6DcRSAoWnotnnca-zjy9kFXxZrcNdmgOAIXkMMvcVl7-XWean7wZS2UqMKpIDySXdvIOS4o1OzJH2J076Fg
Requested by: Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C0F9 158 KB
48 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82d63ecef7851ffd217020b3817b0206328488879b0c782f9b67d43bd1479a2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49360
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1677104061356577"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 26 Feb 2023 20:04:48 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 123ms
123ms Image
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230222&jk=2452287072134293&bg=!KimlKX3NAAZYlHKzeJQ7ADkAdvg8WovSuGOGXfHMqfcO-ysEDrWm-3RK6k6x9g4BuYVr9fHjggnzei3LLfA_f8_5jSbwdpGo6rECAAAAT1IAAAADaAEHCgCMccFrj0ZFZqddA8jYtlgxeT2IsTgoYgvvrtOdMHWPX6txperB5U_tv2kdj9Il1fQMV4IfjuCEm50k9x_JPyeDmne4DTeQNkCSrUcp5QcGme3v5_S9vhwFF4EoyXyLWT_-faWSbLJqA01wyrX4Y_1oWpxkqdSeAC3NKxVvISfv4k1QjhHryw2d0UJerMqZApwp-yJVPLAoSWn5OnNI7BzQxNzFRUTx5q6r-1k_Izqpawr5skpwED7be03l3lE5aDoBh5k7o3bsJUvSZVS_EGkt8jsGcnDW0kO0Y4VcyOsfyQJugNi6Vmt9yZT1o2Kp3lOvJ8XrK10vlHK_877NV80M32ZjewZIvqq7zgc8Z3prYJZR0JkR6DfTf72MQIvSLE0XF3zw_m6ZPnBYUCuI-cc2rgiAioaTqHGmHProwTSg2SnebUUoFxRUuFBEQr8CYwyH7HcwbLs_ZNUUVRwd4Y0G2BxaUcO19jY54VYZv-x6lspzGCwQyLfnRWO9jJkk4o99dd2sk6YZqP_nnNUbz_AawpffoKz5ikQyiYDYfw4-7S-smBTybOl1uRDsCcNLh5Ou3RXMhN3aqDKc6lh06YxHJqV23AKsFupQj-s-pcDqzs707ObSVkMY_ID4qlhvG_VE7-So3qYyJsIAQmlAkJVd_3vu9dsN04S4EMTG0CBlBMQ-DULhLoMP6mC4YntQhsk5G-iCmCH37xQI_C3zF1h7AuqVUi4g-CEi7vvvw078F2mi1bfaTCIAXyw1fYNQTuqJ1jWGThgaqUaYJBt9hnDPGcVQqa8IdSQnQi04rJ3d5tQECUQxTS_mr51yFEJfv8SO-gCruKZWmn63EJwoVK-h_1NUJk4DIk6G_iAnHlqYbCk_wVyhS8S4xdNzL0wRw8k4LlwlNgi-cVtO62_Mi_tOWImHVTtNi5gxGvlJLOjmyWakqLxszy80CU87GurQbAtfjW8BKR2OGDyC_vvkBVS54a2y9r_GC_mYPtClw8OYVrxN1wTMKicPSgKCz6u3x_v6QFP-SkYpHWub22f_txQnNC9rcvqL8l2vdqcBujR-asz7H_JJCP3d_uJkHQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://amdm.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D70C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBAWwMUKMMXo1Cm0_G21Gc4&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBAWwMUKMMXo1Cm0_G21Gc4&google_cver=1&C=1

43 B
632 B

7ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBAWwMUKMMXo1Cm0_G21Gc4&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COed9gIQ_eHmjwIYiNqa4QEwAQ&v=APEucNW6ce8kzCkvjRgHEo-tfgOLm0CutNPPQTlR9tvjD7ntO0iYLh0Tj-d75Ktrj7hcUT-0uOvJV0pWzzsTwKqj5mIV7ZD4u66UfMaPddyT-fKyYq3VQ3kIgCmUXOSlKTWdFDj5pMnpUZljS52XSltSdC5O3dc2m5Ho3VSQdx5VGtTpZgWjWUY
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEBAWwMUKMMXo1Cm0_G21Gc4&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D70C
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y-u7YDgrtmXBNyQLxbcLFgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBAWwMUKMMXo1Cm0_G21Gc4&google_cver=1

43 B
766 B

10ms
9ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBAWwMUKMMXo1Cm0_G21Gc4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COed9gIQ_eHmjwIYiNqa4QEwAQ&v=APEucNW6ce8kzCkvjRgHEo-tfgOLm0CutNPPQTlR9tvjD7ntO0iYLh0Tj-d75Ktrj7hcUT-0uOvJV0pWzzsTwKqj5mIV7ZD4u66UfMaPddyT-fKyYq3VQ3kIgCmUXOSlKTWdFDj5pMnpUZljS52XSltSdC5O3dc2m5Ho3VSQdx5VGtTpZgWjWUY
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBAWwMUKMMXo1Cm0_G21Gc4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame D70C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESELNdCfZbhnZ7pJl8WMc-Yj4&google_cver=1

43 B
1 KB

31ms
31ms

Image
image/gif

185.89.210.141
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESELNdCfZbhnZ7pJl8WMc-Yj4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COed9gIQ_eHmjwIYiNqa4QEwAQ&v=APEucNW6ce8kzCkvjRgHEo-tfgOLm0CutNPPQTlR9tvjD7ntO0iYLh0Tj-d75Ktrj7hcUT-0uOvJV0pWzzsTwKqj5mIV7ZD4u66UfMaPddyT-fKyYq3VQ3kIgCmUXOSlKTWdFDj5pMnpUZljS52XSltSdC5O3dc2m5Ho3VSQdx5VGtTpZgWjWUY

Protocol

HTTP/1.1

Server

185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:48 GMT
AN-X-Request-Uuid: b102becb-90aa-467b-8317-e7bd8d6e0acc
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 178.162.209.131; 178.162.209.131; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESELNdCfZbhnZ7pJl8WMc-Yj4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame D70C
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU2MjEwNzE2MzQyNDc2MDE3MQ%3D%3D

170 B
243 B

41ms
22ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU2MjEwNzE2MzQyNDc2MDE3MQ%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sun, 26 Feb 2023 20:04:48 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 178.162.209.131; 178.162.209.131; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 5021f155-c8ad-48e2-bd03-d8eb2dd486ea
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU2MjEwNzE2MzQyNDc2MDE3MQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C9DF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBAWwMUKMMXo1Cm0_G21Gc4&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBAWwMUKMMXo1Cm0_G21Gc4&google_cver=1&C=1

43 B
632 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBAWwMUKMMXo1Cm0_G21Gc4&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKo89UCEOuOtqEDGOaKnOEBMAE&v=APEucNW97g1eAA64C0KtnSvLMhxaivfo8F3y524xpzldihHb5BantPK6WEdyirEZ69xJf_hxJex-kUJJ3nSHpYU1pNbITe_oBWCD6apSkhHV49V0H0xpooENjxUQtfs0Sli1IE3I97pXmpz0bOmtIkStOHnlJs2W58qJbcNT7jA08EJBrJqrB9I
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEBAWwMUKMMXo1Cm0_G21Gc4&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C9DF
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y-u7YMXb509ODR3MvK0U-gAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBAWwMUKMMXo1Cm0_G21Gc4&google_cver=1

43 B
632 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBAWwMUKMMXo1Cm0_G21Gc4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKo89UCEOuOtqEDGOaKnOEBMAE&v=APEucNW97g1eAA64C0KtnSvLMhxaivfo8F3y524xpzldihHb5BantPK6WEdyirEZ69xJf_hxJex-kUJJ3nSHpYU1pNbITe_oBWCD6apSkhHV49V0H0xpooENjxUQtfs0Sli1IE3I97pXmpz0bOmtIkStOHnlJs2W58qJbcNT7jA08EJBrJqrB9I
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBAWwMUKMMXo1Cm0_G21Gc4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame C9DF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESELNdCfZbhnZ7pJl8WMc-Yj4&google_cver=1

43 B
1 KB

15ms
15ms

Image
image/gif

185.89.210.141
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESELNdCfZbhnZ7pJl8WMc-Yj4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKo89UCEOuOtqEDGOaKnOEBMAE&v=APEucNW97g1eAA64C0KtnSvLMhxaivfo8F3y524xpzldihHb5BantPK6WEdyirEZ69xJf_hxJex-kUJJ3nSHpYU1pNbITe_oBWCD6apSkhHV49V0H0xpooENjxUQtfs0Sli1IE3I97pXmpz0bOmtIkStOHnlJs2W58qJbcNT7jA08EJBrJqrB9I

Protocol

HTTP/1.1

Server

185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:48 GMT
AN-X-Request-Uuid: 29d25990-f677-485d-8cac-f51159d9b455
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 178.162.209.131; 178.162.209.131; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESELNdCfZbhnZ7pJl8WMc-Yj4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame C9DF
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQwMDk2NjE0OTA1NjU1NzcwMw%3D%3D

170 B
232 B

32ms
23ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQwMDk2NjE0OTA1NjU1NzcwMw%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sun, 26 Feb 2023 20:04:48 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 178.162.209.131; 178.162.209.131; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 4526ea1d-edef-4540-b9d4-eb76b253b4ab
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQwMDk2NjE0OTA1NjU1NzcwMw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame BF89 15 KB
6 KB 243ms
14ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=amdm.ru

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

97d67f8c2575e19d30ae28a32bad7610849e0e56c81ca66e51178124a5c5eed2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://amdm.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 26 Feb 2023 20:04:48 GMT
server: Kestrel
server-processing-duration-in-ticks: 332163
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 89 KB
29 KB 71ms
30ms XHR
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://amdm.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 24 Feb 2023 07:57:32 GMT
server: nginx
etag: W/"63f86dec-16386"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 27 Feb 2023 20:04:48 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6BD2 0
20 B 120ms
119ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5359009987461&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6BD2 0
20 B 139ms
139ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5359009987461&version=m202301230201&ct=76&x=1&cor=15410687026121624000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6BD2 81 KB
34 KB 92ms
92ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BMpKGZvhPpkh0BMofACPvuGFEm5fo6y8bhHEA56IGKUVKTzHr-dDGnrMfG-1_PRhpX7DC3706DXOqhuF8bFaAKZ3XRHg&cry=1&dbm_d=AKAmf-CC6pwhfsflg3cG2Cn0a0kCfcA4bQxEtIMO7H3Pir3NrcbeeFXJgf7ND5XXjImChLHYbGNx85BvfKb-a7aYVA4j70SKVzzvCSMu1Czu7ic_vs_Hu8rmq5XxQq923tMQyt3QvOBxX72BfesvFPrfG0N5JNwPxYbKweGxa2sCu8qH_7fKqf-CUwNjjX_ZyzweU7LDGJN9acJnX8zBf0FVJ6bH7wB4c36h2i5C7i-kPaflYFyq24Q8B72B7wGionH49-a3EdlTKVVAUALKZ0vPBTYXIQJPO_cD8BoVhuOJ6WBplHSFAdw-gmF11qFjlg6uJucXBypJ67Fhq75lFEnJXzShp-LDKQi2qaE7r6cYBl2q1Cjs8FdcpFqBaB4A4ExlEe-zIEVusE8DMNJjtJXli3goC7qpJg9bZdLVDg9RnLVjZ-gCn5N5BNKJuOni_8x76z99DM_6KC6ARdxo9MpdqGnPfjqbIx9SzQVwL0KG9-x-DsfswvYrxGQFBGlkI0YtkJwI4xBcJZlIKQHV7p5L_AiFKtK9Iks2HbjttHK1Y20_4FQhNqPqTlQalYEK4eccKbSNCwVt4MsKlkxyWXMkpZBpRUO1fEBku3c497G7QgsxgMwJ5_LINxPK4VYvA5XugZHwZ7THoRYhaWeJa5BsZQlG41hShqMvU6gO9NIOAPFDI2jYtHw17y_ZxFZ--cYBmvTRu4hsU1QJXJNRJsQvBtra6CvVDpn68IRst4e4REV1WeMBINaXY4TqTQagOkES6_iNcm_1v37Tk0Uf0A5xRFwT8wnNisMGtTzENFVwKijuLie6BMo7f2wqESab0PclfeoyanYOzjllidvj285svOKFLBNsz0B6NIo819xxXe_7bAmXc30ksNQKX0WY5Nvcvwv-Ny95tLHTdhx4FMfk1gfz98UqjC_CyUoVutOcTcuoBOQJBHZB956OBA5FSlBtz2dxuQINXxJ-KXeHmvLq_s2ZMeKQugqs5KeNld_mD4EMTXt65bkcxjgMjU5fSUpdT55dFxzjDZrQ_TnJcNuosiVJ9_8HhOxni60o-PHKly7OCW2KsuZgX9ub9ogbAJec3EO7sKEFCGH6t4x8ciecNXNSkFb4h1ehhJ7eENdqVFRvUMV3EI9kysAHzrMHBkffK-4biLuyzRiWq2uxiHPlc7Z1jdwRRUkUxJFjg_sUnw5ykREI1ZkPDCkq7li-VTRa6LOIlUtiWJgPGmk3sbI3mBWmgMpshDFLTilv6fo9IHxPoe5Dv_i4G-gjJZKbZ-QUtRXf0obvVSTae9zuqFTeq2JwaCUV5ZEP2EINX-xeXlFtb6zARgjkde6JUMed6TB7JrpWcG233EZylGI8epwEtLC1K_IozwEN5SQSTxn6JoyARiHMRN6Hhr1pZ8PXIkoZ_HJD88jynSxVya_8ie-HSoR_bTpZGlVhvCNucSZZgHi0uMzyCuzgtaBMgpSptnJaIP0COeIV3X8kKNzG3R92AE7PPLRpl9ICNfcs38LnyUVpLi4Fgw0Az0fE-kKs8NcwzVhIEr0LQ6syyY_vTr69KK5SVC0NySyErlrw8nC1oFv1WvttjtmdoGWzGdh5KLMw7k32awlWcowfbJBwn6GFRbxTpQ9Snnrj0k9nu2el8tBuGlwI1w5_Scu-cw1Mwo7lb_tQMvD7J5012h1TQ5gHvRfZbazJ24IbRFOlQ3A8JZNnuoxYBuVwQL1v79gsPMWsd0giquJyzQ3HCcDCvr2LZidq7RZV7_xufRt5l7h8Miw8P7Nf65biWfjZ9sspbDpim5Pht4G0ExKw6WC1lJxXi3oPHjEivJcXS9E0-UDVMKYtwJ0z-oPYuaWWve0y-3LF-2nrpSQ-_2iT4uvUAUD_xVrR4h7E1KbyEagiceTICvQ3KReLHvdJMCoXlgdfuWHSCuruFPdBMHis-7Z8llsWNCejizZDazQiGIMBOgcx7N22IfiyZxxKJDbIfVO2Z8B-you8OGwqM8fNwpxtVo-SiwA6G5q52hDEdo65j9DCsJk0GHqF8jIq3Wfs1-G3G6mNmzT05GvEhoh35y2xa6v1Vm8jxQlYwQQgFUqEvX2BfXZ9AyL40YPz4wmUnMSDfIgpIBwsy9Z3JVvW-yy95oBZxO7NjJI83d_-vD0sScvLW0GIcnujMPNrxWfCr466UrIr0RSYtyW5L535LOW9v85JTlkplO4j1_4t_v9Si3iKwfJX0QqCJ8VNhwCTPHaqJ8c7Y2UxiIjtzYtvy_nJAlAIdWE3BgevbuOJew970hlHGuOURyaFV5BfhIN0vxqEG66rhR2G2GgEdNAG0cpSaX9ifqNNp3AvAtGi5-BGD1ecM9IZMhQ6AjL46Sb2FwVoHTmx-_uDlcvjV5Brp1-nsfYNCCJpN0YZF7f2NLArosg-YJLN_xSSyB7oEuUK4ftUDhIMbvzlcbFkxTjiHws_mhyLVD65mw73FkDJzLLYE8wbhpfb5X7pWQ_YA5ke_K4GobO1HeII4WcLJG3rkOcjDvESrTo3iRs9pDtdFDpV9N0At3vTnO6_YIMjSrbn4xFfEN1lPnrm0mcXnxYwVzPWP8PX_n8ZFLCIhJxxUjrCg3ZSwZOmCH5syF2MZBoN-Zyby2gLaiGtLJwUmsBCcSxPj9bRjF9svqUlj2l_M0euAA4LuP9lg0-C8mUjjdYFJIjVyGDju_-PYoBNe6ytsRIN98J1rSaJccdj5OC8zpfU_n7NSMDZnLerYymGd7crZdrwPeNfj1AAdnHrIlN7GmKPIGqF4vYW7vkCypk2tXp9OUlJYZHci9RxRAyLnFvrPivNbaIej5wC1REE48MIqSoXee2UukNUS28W_RZcg8SShOg41JP_pVrBhq8VkNIjNtF1WZb__-CidsqtYIfrC7roH68khMfGohrGjyo7J4JwoePR4wo5oCHaeKM2m7Z6vqm8oHMbMtSDZjHKdv3WugQDvKUG_2yYDX_9aLsqZRXa2usTI_NLuNRjbkoKcWHisKDUPMHA3Pufg1cGypY0e9tKKaoD67uf_OfmpoRoRkx6zRMbFVzX0MgR8No7Jb8uZICurshSQBUls9XLPpZqvVIVUW-LMXaVNOSjkCKETCGj30bOzEoSmyWrXZ6XRiqlCUz1g2qVn53oUVpVwc37stK8Q2_RqU7YPBaNTBsSj7auGt5_Le_GIMxZgwUwcrTy8UtqL9VdzTHSZb4Ltp3T0OccZH0dIkGGIr6F4s7VCxIn8C9U7WG5HDdHWfhPSzNlpd-pUymkiw09ms0qJS0SBoa38MRr9CAfBJqlzLepTgBQXNA0wuOtYER7qgxOgNdyxQfMLOv0fCL3CdW7OQ3_a8-0xk95RyzTPSHYkQ53c2N1Y_eAzsN42w_0_yGYbncDUAzIlKH2hPXrOCdTagTUre9RHb93KGeK-zslc8TLeXZGPjHc-Ae8sstjPnKuWhAyj5x9vOLJLr1Ys1e6R2Vx5jcBjTabmaxRDw0IllDpxXkBKAqRgapVPgqaCgflXwZjhzYJ1Oxto7xTrT9RTXmyvFXSfyLZ9FNRDBXQ_nMrPxCqEjBxffXX2st12xs2Sd6bctppylfA-3zwPofurSVuoRrRK03bcsBD02CC7dWx5r8YfuYvqwc1bMyg3muW8zUFGH6WEmEm4oSKdL-S2-hCgkqONql9qY-Shkf2i3VrISeTPrbHh4luFLegPMZX3G96VCpfLwLp6UUSTzOKMxwSYyakeNZM8tCmWhMesA&cid=CAQSPADUE5ymM6O87RCFZYULnlOlf__g2FKJYdsUVj460cBlh9pTlRybnhypfXV4LVsSzmDaN_9wT0ybYX2ThhgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Famdm.ru%2F&ds=l&xdt=1&iif=1&cor=15410687026121624000&adk=1964084972&idt=160&cac=0&dtd=10

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d92a80e710a753e63f6415b892eeddb5eae2c90482a973ca5364e4a4fa021db9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34971
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C0F9 0
20 B 115ms
115ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6265661936854&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C0F9 0
20 B 403ms
402ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6265661936854&version=m202301230201&ct=76&x=1&cor=10488911842324677000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C0F9 94 KB
37 KB 73ms
72ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CE89MzOFTPUXd6AI7jGUKi51HWEsP1rYzqbs_aeVSBgYRGKbTiE24fs1rrNdIiYDKSaQdS7YUAA1UxMZ27T9ZX3cxSVpwsgcsUUEnqvozD8tjUoCcm_C2rt9vVz-phBNbYmOYMgdkTJw72alxOK-itorfeJiT90jD_5zsgoPEJY24cRhk&dbm_d=AKAmf-B7fOo1TM424mZqGzSuyVRxTNPHiKZ51UHhI0fKw3T-yaax7IHova4ehHvBEq6IZFMHzUJsSzKD_SgKC_b0kFnZjJ_3W4g4gVRyPZ_wBPUADGaSunQHE6aqccG4hWsUtkX-fw0m-H5_jpiq8-PfQGtuEChiEX3HkquGoZkcwGibwmlNgzJmJ4o_DTnBn3oRl6hUW4SOVqAs7uvTyJ7g9ZrHBS1Q0E7XRu9T5MyEvwu-T_9qUXAXsesKVAVUxxZTLRnt3_9dhKi5TdFUxscLew9jv4vgO-fJDPkgQ2JHaTzyhwNneUqH3wLJ1abwhsSi0AkTjpwU3qWOFnE76hC1hg07Tj8wH1VlOzx4tjubo43Yq7t4AMpXWDn7SugXm4LvqMMlZOTrNDh9wU-gnJRXuXPRH4kWtKuYzBsOhohZcgJHfeQ7VEW1gJ3hHLxWSWImk14z2pMMR42OJI3vkdt98JGPY-Lvn1h1Ts9e4IbJBE0FyQlfee9edrLj4Fj8hZvtPd77_OW9mfH_Q65BC0NHwgdAY9ngGGEiE229ySOvUMJyRxiI17C89-rnRvJvYEhEW6RgPp3zs_dHPbvRStJFpxJ2x2o6S8cgMsNzTYc7dPzaMQpIHr1ivUsXLx7CHQ5vGrYasri3xiBD9fNowmMTcHFsPavNfw-FQJtWM2reKiqMJM8MfSnwcmIraAx5MUJ9RII1SagUVMhsq_4-sWuhPVZrH7owDncwSW6SRyZO9qQkEA5DuWk68OLUsxVslinc_DXpAkjdMznbnwrLh8egpsxxA7SrLo5sxDivi0aCoWmnyCiE_5RB82Nr_k4zrlU35C5erq3Xpkj0AnS3CdzvgB44iLaF6XcxPP3rGwTcYuwEnpnBHHq2pMuUOtbOEl8yaYg_sez9rKsGJrF4W2JFX2tpADI3gi6Bxwwn_NIFG9Hh3lo-AV5PDAAm29N4W_Pp0UKtMe5l0e4FNTEK79dGcBYoUws4EkbVUotiqRJv1auwToeiZ9kho4PKNjzGMJr_p-7VR3Ccv9ZEzXEhjkGtRsg5rOFSzQI1LrphGoMJy_cmCDZeIYnA50Bb0Xlij20yfuwwWgMT5c2lR-ztuRhuIDLiN0LDjETGkSceIrjjVJYePmMbqvWdcmmDZB7VT3vDqwE_6LqvQZoQVQ-ahVPnNFHCGf4Fvw_3EMKbfa-NR3ujHC_b1kFOJXQF3k_85yPYViZiL2rWcJ7tsO4B7LlO9xmnNMRLYFg9uKPWi8_-r_r9hL2AKwBt8GMvhcB6jqevCPVllzuTOo8gKCLH4NjSW4nVZtpGbEJvakZlTQkS-zeOfW2Ml38jJUgtv_Xd7rstbcWXcAio8BylnX7CZN9j7nXYmciIeKcLheiM7al_rCZJjWDqLTK8T81zC4WsopMWlViCCYxAnVcVoHvPk565CZsHumOMAN_6ngBUVbN4SJRXICQ1HuGounC_DP3Un8G4ekeiC6_SJ1lcyxZaKauJ59Rom_2jalJkD8AuPqN6LOTKYftYdk9uygyZoBGPGf1uHJA1XsERMUiLpWCPBhxw9ZrtSInfK4P2sEaoeEwMQqsyjYK2J8f7b_mxmxK0qlcERelHFNvEXhNHQQHRzC6cRWotog_BKnKQNWZSliEXe0LEUz57yCU_hNtlDDsn5WHvFbGzzx-CRwdwoUQ5P5ri6Eohc1yC-EdmTsovVy1zyqPMiW1Vl3O1lo6a4OhLKi97MtxIn6KLpRXwo4M2WL1hgl5SgFGFWPxm07YDFc-3idSgzFK0kvKnJDh7SovoacHtzcBnexWV0Wjh3xjcaj030bOK7nVYchssbpuSxUMJ2uvmOIlQyYMQKO6vXKISjihcsztjuz0ZP4aX66Io9NTAeW1w5SDCUBB8EvsFkOFayYhblxiiT0fTPRVClE85CBnV0-ZaXwBY2At-gildFVcWmgBEL7KKlwQh0EC4sDrkgJ6EAtTB94ZWcbIjTrgLV5plV3X0q7LLafb8LoRnT71soClllh92lQkcybWuWI4ofhAf1OcGJGrdpyYkKoHbMrBLuT8sapgb-DyR64YdFBOU87aKoDOAL7oFEs7Ork4asqKNmAXwcRy2IXXguqOz0DSvtnPt12QS3qLbytZNh2HJ9MPv5x0d7JxOrqO38SnHjtdKXwFtLxAnakSCCczWCfcDlgGLj6ktM-iTqusWn5EsHfcvRG9hiVeblusm3yVVZ_sgPHdh66YhztRPgy7TNsLAAxJIw7xGStoRsSLQ1RXrCvAqVb14qMMWwiT65y2JHYC4EDbf7LdeMaEVhzkm2SCOJbqVQqIYAXT-6jvSTXkP-vgacFT0FxJsWdnikWAJ8mORnBEqq1iZgy5oRZenldvBEz8_UpWQ3r2zfKSFrD4Ap-DdX9bSMryXgV2CnbA_EZD-xEm9yRUnUwAkZd-SgVQEMsXQjJZ-ITOQbtJm_utj3H0Sdqq6XwneCn5wx24v6Do-pPg3DetEaCy18e7eL_jXqsUsRHiwCNMymzmBM-KWeXYuV4BvaXb7ILfRmrNHxuf3S_Mb9BGB7vCwcPpx1I_Z4dYogQN7Vv-hlOziyCuDqxyAPK3dEJx6r9kWvNSopKLlf3OcGKBb8dXU6y4MnIgTvBN7DFsGSreM1PRxBsDAgO9LA7XK6Naw3Bht25EG7_rvrNp5p_wY3tpuCkD7tQ1R2u-qq2jRDZ8ho2KFqGjn8UTCmPTuOCwxy3TPtL60onJhYXypyBc57R93qur6Xilk_ywySxQvGEIrqXyVxoY0pfQzI9uNb7bHoxg7rq3kLB31HBWuAAf8QC_5xlIaD_IBe05djRYDlK74-F3csPH1H3S8LDSOQZ8H3bUysWENYhfEh2HwgwwogEUQmdwktEO9v11zjRl5K4Hs3S9TnMtWy8famYXf_L3ZYZcTpfMnpgy_nZiWTTWEYrAa4NWUrnT0Do8kNeuChPMC8GSHMxLnlExz0a38C5bkJiKVEfP5Hmrph1GakaIq76BPrkgVLMdOFP_Sh7jTX3BvaktFkgRxRqb1DGudKofvA4BzwjEnZW6vOSos6wlpfjt-bhngMs_UBUXzlT5wL_DfR_YeJLTjIwMJTLLTCLDMNAmTMZH4u17Cb1a3FGK9vWQIxmKTKgVvNd0sdiLVjKDaP8B-qZF2YpwbeodsEvjX5oz-cLxIj0yuKFDdcA637Xx0wLJuiFPLn6N56m8bLQkHskvU69gag0_kMSQTkqLrqfgdygXJqURwjzeY1y6dy0HcYzGs2v8pg0vpvyh0hFU6SpsBYKJQPjmaMPkps-tkj9vBCRhyOLcl52JVjSxqfkEFn9pE2__LBlcdcoJ-6u8WZnMPuJVg1Lu1CSmUWMjlkf3tmvmLLAt5XP_1AwVul7B7ilFxdsNlFWxMuc4RlnLf293PWnkw7PpdWpGRN1aXILU03L3LpG55Pg3CVJw&cid=CAQSPADUE5ymM6O87RCFZYULnlOlf__g2FKJYdsUVj460cBlh9pTlRybnhypfXV4LVsSzmDaN_9wT0ybYX2ThhgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Famdm.ru%2F&ds=l&xdt=1&iif=1&cor=10488911842324677000&adk=2228999115&idt=187&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

87cc0149bc185327803d2791d23111501c480090a0536d78c4c053daf731c070

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38359
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 6BD2 106 KB
37 KB 79ms
14ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: amdm.ru
URL: https://amdm.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
Origin: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 23:10:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75240
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 Feb 2023 23:10:48 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230222/r20110914/elements/html/ Frame 6BD2 8 KB
3 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230222/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BMpKGZvhPpkh0BMofACPvuGFEm5fo6y8bhHEA56IGKUVKTzHr-dDGnrMfG-1_PRhpX7DC3706DXOqhuF8bFaAKZ3XRHg&cry=1&dbm_d=AKAmf-CC6pwhfsflg3cG2Cn0a0kCfcA4bQxEtIMO7H3Pir3NrcbeeFXJgf7ND5XXjImChLHYbGNx85BvfKb-a7aYVA4j70SKVzzvCSMu1Czu7ic_vs_Hu8rmq5XxQq923tMQyt3QvOBxX72BfesvFPrfG0N5JNwPxYbKweGxa2sCu8qH_7fKqf-CUwNjjX_ZyzweU7LDGJN9acJnX8zBf0FVJ6bH7wB4c36h2i5C7i-kPaflYFyq24Q8B72B7wGionH49-a3EdlTKVVAUALKZ0vPBTYXIQJPO_cD8BoVhuOJ6WBplHSFAdw-gmF11qFjlg6uJucXBypJ67Fhq75lFEnJXzShp-LDKQi2qaE7r6cYBl2q1Cjs8FdcpFqBaB4A4ExlEe-zIEVusE8DMNJjtJXli3goC7qpJg9bZdLVDg9RnLVjZ-gCn5N5BNKJuOni_8x76z99DM_6KC6ARdxo9MpdqGnPfjqbIx9SzQVwL0KG9-x-DsfswvYrxGQFBGlkI0YtkJwI4xBcJZlIKQHV7p5L_AiFKtK9Iks2HbjttHK1Y20_4FQhNqPqTlQalYEK4eccKbSNCwVt4MsKlkxyWXMkpZBpRUO1fEBku3c497G7QgsxgMwJ5_LINxPK4VYvA5XugZHwZ7THoRYhaWeJa5BsZQlG41hShqMvU6gO9NIOAPFDI2jYtHw17y_ZxFZ--cYBmvTRu4hsU1QJXJNRJsQvBtra6CvVDpn68IRst4e4REV1WeMBINaXY4TqTQagOkES6_iNcm_1v37Tk0Uf0A5xRFwT8wnNisMGtTzENFVwKijuLie6BMo7f2wqESab0PclfeoyanYOzjllidvj285svOKFLBNsz0B6NIo819xxXe_7bAmXc30ksNQKX0WY5Nvcvwv-Ny95tLHTdhx4FMfk1gfz98UqjC_CyUoVutOcTcuoBOQJBHZB956OBA5FSlBtz2dxuQINXxJ-KXeHmvLq_s2ZMeKQugqs5KeNld_mD4EMTXt65bkcxjgMjU5fSUpdT55dFxzjDZrQ_TnJcNuosiVJ9_8HhOxni60o-PHKly7OCW2KsuZgX9ub9ogbAJec3EO7sKEFCGH6t4x8ciecNXNSkFb4h1ehhJ7eENdqVFRvUMV3EI9kysAHzrMHBkffK-4biLuyzRiWq2uxiHPlc7Z1jdwRRUkUxJFjg_sUnw5ykREI1ZkPDCkq7li-VTRa6LOIlUtiWJgPGmk3sbI3mBWmgMpshDFLTilv6fo9IHxPoe5Dv_i4G-gjJZKbZ-QUtRXf0obvVSTae9zuqFTeq2JwaCUV5ZEP2EINX-xeXlFtb6zARgjkde6JUMed6TB7JrpWcG233EZylGI8epwEtLC1K_IozwEN5SQSTxn6JoyARiHMRN6Hhr1pZ8PXIkoZ_HJD88jynSxVya_8ie-HSoR_bTpZGlVhvCNucSZZgHi0uMzyCuzgtaBMgpSptnJaIP0COeIV3X8kKNzG3R92AE7PPLRpl9ICNfcs38LnyUVpLi4Fgw0Az0fE-kKs8NcwzVhIEr0LQ6syyY_vTr69KK5SVC0NySyErlrw8nC1oFv1WvttjtmdoGWzGdh5KLMw7k32awlWcowfbJBwn6GFRbxTpQ9Snnrj0k9nu2el8tBuGlwI1w5_Scu-cw1Mwo7lb_tQMvD7J5012h1TQ5gHvRfZbazJ24IbRFOlQ3A8JZNnuoxYBuVwQL1v79gsPMWsd0giquJyzQ3HCcDCvr2LZidq7RZV7_xufRt5l7h8Miw8P7Nf65biWfjZ9sspbDpim5Pht4G0ExKw6WC1lJxXi3oPHjEivJcXS9E0-UDVMKYtwJ0z-oPYuaWWve0y-3LF-2nrpSQ-_2iT4uvUAUD_xVrR4h7E1KbyEagiceTICvQ3KReLHvdJMCoXlgdfuWHSCuruFPdBMHis-7Z8llsWNCejizZDazQiGIMBOgcx7N22IfiyZxxKJDbIfVO2Z8B-you8OGwqM8fNwpxtVo-SiwA6G5q52hDEdo65j9DCsJk0GHqF8jIq3Wfs1-G3G6mNmzT05GvEhoh35y2xa6v1Vm8jxQlYwQQgFUqEvX2BfXZ9AyL40YPz4wmUnMSDfIgpIBwsy9Z3JVvW-yy95oBZxO7NjJI83d_-vD0sScvLW0GIcnujMPNrxWfCr466UrIr0RSYtyW5L535LOW9v85JTlkplO4j1_4t_v9Si3iKwfJX0QqCJ8VNhwCTPHaqJ8c7Y2UxiIjtzYtvy_nJAlAIdWE3BgevbuOJew970hlHGuOURyaFV5BfhIN0vxqEG66rhR2G2GgEdNAG0cpSaX9ifqNNp3AvAtGi5-BGD1ecM9IZMhQ6AjL46Sb2FwVoHTmx-_uDlcvjV5Brp1-nsfYNCCJpN0YZF7f2NLArosg-YJLN_xSSyB7oEuUK4ftUDhIMbvzlcbFkxTjiHws_mhyLVD65mw73FkDJzLLYE8wbhpfb5X7pWQ_YA5ke_K4GobO1HeII4WcLJG3rkOcjDvESrTo3iRs9pDtdFDpV9N0At3vTnO6_YIMjSrbn4xFfEN1lPnrm0mcXnxYwVzPWP8PX_n8ZFLCIhJxxUjrCg3ZSwZOmCH5syF2MZBoN-Zyby2gLaiGtLJwUmsBCcSxPj9bRjF9svqUlj2l_M0euAA4LuP9lg0-C8mUjjdYFJIjVyGDju_-PYoBNe6ytsRIN98J1rSaJccdj5OC8zpfU_n7NSMDZnLerYymGd7crZdrwPeNfj1AAdnHrIlN7GmKPIGqF4vYW7vkCypk2tXp9OUlJYZHci9RxRAyLnFvrPivNbaIej5wC1REE48MIqSoXee2UukNUS28W_RZcg8SShOg41JP_pVrBhq8VkNIjNtF1WZb__-CidsqtYIfrC7roH68khMfGohrGjyo7J4JwoePR4wo5oCHaeKM2m7Z6vqm8oHMbMtSDZjHKdv3WugQDvKUG_2yYDX_9aLsqZRXa2usTI_NLuNRjbkoKcWHisKDUPMHA3Pufg1cGypY0e9tKKaoD67uf_OfmpoRoRkx6zRMbFVzX0MgR8No7Jb8uZICurshSQBUls9XLPpZqvVIVUW-LMXaVNOSjkCKETCGj30bOzEoSmyWrXZ6XRiqlCUz1g2qVn53oUVpVwc37stK8Q2_RqU7YPBaNTBsSj7auGt5_Le_GIMxZgwUwcrTy8UtqL9VdzTHSZb4Ltp3T0OccZH0dIkGGIr6F4s7VCxIn8C9U7WG5HDdHWfhPSzNlpd-pUymkiw09ms0qJS0SBoa38MRr9CAfBJqlzLepTgBQXNA0wuOtYER7qgxOgNdyxQfMLOv0fCL3CdW7OQ3_a8-0xk95RyzTPSHYkQ53c2N1Y_eAzsN42w_0_yGYbncDUAzIlKH2hPXrOCdTagTUre9RHb93KGeK-zslc8TLeXZGPjHc-Ae8sstjPnKuWhAyj5x9vOLJLr1Ys1e6R2Vx5jcBjTabmaxRDw0IllDpxXkBKAqRgapVPgqaCgflXwZjhzYJ1Oxto7xTrT9RTXmyvFXSfyLZ9FNRDBXQ_nMrPxCqEjBxffXX2st12xs2Sd6bctppylfA-3zwPofurSVuoRrRK03bcsBD02CC7dWx5r8YfuYvqwc1bMyg3muW8zUFGH6WEmEm4oSKdL-S2-hCgkqONql9qY-Shkf2i3VrISeTPrbHh4luFLegPMZX3G96VCpfLwLp6UUSTzOKMxwSYyakeNZM8tCmWhMesA&cid=CAQSPADUE5ymM6O87RCFZYULnlOlf__g2FKJYdsUVj460cBlh9pTlRybnhypfXV4LVsSzmDaN_9wT0ybYX2ThhgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Famdm.ru%2F&ds=l&xdt=1&iif=1&cor=15410687026121624000&adk=1964084972&idt=160&cac=0&dtd=10

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

855e15fcdc7a729b06238328936629eac46e2251d9d3d71a5d65510451f4e7c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 18:59:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3919
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3023
x-xss-protection: 0
server: cafe
etag: 4221495933888618527
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 12 Mar 2023 18:59:29 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230222/r20110914/ Frame 6BD2 28 KB
11 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230222/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8294f47c10ab9172680f9bba780fecd122dbec7acc578a6973704c97903a8915

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 18:59:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3919
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10818
x-xss-protection: 0
server: cafe
etag: 16521218800250601078
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 12 Mar 2023 18:59:29 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1272511/69505650/ Frame C0F9 243 KB
73 KB 150ms
33ms Script
application/javascript 54.171.12.184
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1272511/69505650/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1010256565&ias_pubId=pub-8643561401961308&ias_chanId=1&ias_placementId=19312087806&bidurl=https://amdm.ru/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0inovMR217O0FLfsXDZ5wOU
Requested by: Host: amdm.ru
URL: https://amdm.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.171.12.184 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-12-184.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 67914f7d8a250cc35caaa51128cd79f5fd61afe1b37a8ce3661720d3bc408165

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame C0F9 106 KB
37 KB 77ms
28ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: amdm.ru
URL: https://amdm.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
Origin: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 23:10:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75240
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 Feb 2023 23:10:48 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230222/r20110914/elements/html/ Frame C0F9 8 KB
3 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230222/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CE89MzOFTPUXd6AI7jGUKi51HWEsP1rYzqbs_aeVSBgYRGKbTiE24fs1rrNdIiYDKSaQdS7YUAA1UxMZ27T9ZX3cxSVpwsgcsUUEnqvozD8tjUoCcm_C2rt9vVz-phBNbYmOYMgdkTJw72alxOK-itorfeJiT90jD_5zsgoPEJY24cRhk&dbm_d=AKAmf-B7fOo1TM424mZqGzSuyVRxTNPHiKZ51UHhI0fKw3T-yaax7IHova4ehHvBEq6IZFMHzUJsSzKD_SgKC_b0kFnZjJ_3W4g4gVRyPZ_wBPUADGaSunQHE6aqccG4hWsUtkX-fw0m-H5_jpiq8-PfQGtuEChiEX3HkquGoZkcwGibwmlNgzJmJ4o_DTnBn3oRl6hUW4SOVqAs7uvTyJ7g9ZrHBS1Q0E7XRu9T5MyEvwu-T_9qUXAXsesKVAVUxxZTLRnt3_9dhKi5TdFUxscLew9jv4vgO-fJDPkgQ2JHaTzyhwNneUqH3wLJ1abwhsSi0AkTjpwU3qWOFnE76hC1hg07Tj8wH1VlOzx4tjubo43Yq7t4AMpXWDn7SugXm4LvqMMlZOTrNDh9wU-gnJRXuXPRH4kWtKuYzBsOhohZcgJHfeQ7VEW1gJ3hHLxWSWImk14z2pMMR42OJI3vkdt98JGPY-Lvn1h1Ts9e4IbJBE0FyQlfee9edrLj4Fj8hZvtPd77_OW9mfH_Q65BC0NHwgdAY9ngGGEiE229ySOvUMJyRxiI17C89-rnRvJvYEhEW6RgPp3zs_dHPbvRStJFpxJ2x2o6S8cgMsNzTYc7dPzaMQpIHr1ivUsXLx7CHQ5vGrYasri3xiBD9fNowmMTcHFsPavNfw-FQJtWM2reKiqMJM8MfSnwcmIraAx5MUJ9RII1SagUVMhsq_4-sWuhPVZrH7owDncwSW6SRyZO9qQkEA5DuWk68OLUsxVslinc_DXpAkjdMznbnwrLh8egpsxxA7SrLo5sxDivi0aCoWmnyCiE_5RB82Nr_k4zrlU35C5erq3Xpkj0AnS3CdzvgB44iLaF6XcxPP3rGwTcYuwEnpnBHHq2pMuUOtbOEl8yaYg_sez9rKsGJrF4W2JFX2tpADI3gi6Bxwwn_NIFG9Hh3lo-AV5PDAAm29N4W_Pp0UKtMe5l0e4FNTEK79dGcBYoUws4EkbVUotiqRJv1auwToeiZ9kho4PKNjzGMJr_p-7VR3Ccv9ZEzXEhjkGtRsg5rOFSzQI1LrphGoMJy_cmCDZeIYnA50Bb0Xlij20yfuwwWgMT5c2lR-ztuRhuIDLiN0LDjETGkSceIrjjVJYePmMbqvWdcmmDZB7VT3vDqwE_6LqvQZoQVQ-ahVPnNFHCGf4Fvw_3EMKbfa-NR3ujHC_b1kFOJXQF3k_85yPYViZiL2rWcJ7tsO4B7LlO9xmnNMRLYFg9uKPWi8_-r_r9hL2AKwBt8GMvhcB6jqevCPVllzuTOo8gKCLH4NjSW4nVZtpGbEJvakZlTQkS-zeOfW2Ml38jJUgtv_Xd7rstbcWXcAio8BylnX7CZN9j7nXYmciIeKcLheiM7al_rCZJjWDqLTK8T81zC4WsopMWlViCCYxAnVcVoHvPk565CZsHumOMAN_6ngBUVbN4SJRXICQ1HuGounC_DP3Un8G4ekeiC6_SJ1lcyxZaKauJ59Rom_2jalJkD8AuPqN6LOTKYftYdk9uygyZoBGPGf1uHJA1XsERMUiLpWCPBhxw9ZrtSInfK4P2sEaoeEwMQqsyjYK2J8f7b_mxmxK0qlcERelHFNvEXhNHQQHRzC6cRWotog_BKnKQNWZSliEXe0LEUz57yCU_hNtlDDsn5WHvFbGzzx-CRwdwoUQ5P5ri6Eohc1yC-EdmTsovVy1zyqPMiW1Vl3O1lo6a4OhLKi97MtxIn6KLpRXwo4M2WL1hgl5SgFGFWPxm07YDFc-3idSgzFK0kvKnJDh7SovoacHtzcBnexWV0Wjh3xjcaj030bOK7nVYchssbpuSxUMJ2uvmOIlQyYMQKO6vXKISjihcsztjuz0ZP4aX66Io9NTAeW1w5SDCUBB8EvsFkOFayYhblxiiT0fTPRVClE85CBnV0-ZaXwBY2At-gildFVcWmgBEL7KKlwQh0EC4sDrkgJ6EAtTB94ZWcbIjTrgLV5plV3X0q7LLafb8LoRnT71soClllh92lQkcybWuWI4ofhAf1OcGJGrdpyYkKoHbMrBLuT8sapgb-DyR64YdFBOU87aKoDOAL7oFEs7Ork4asqKNmAXwcRy2IXXguqOz0DSvtnPt12QS3qLbytZNh2HJ9MPv5x0d7JxOrqO38SnHjtdKXwFtLxAnakSCCczWCfcDlgGLj6ktM-iTqusWn5EsHfcvRG9hiVeblusm3yVVZ_sgPHdh66YhztRPgy7TNsLAAxJIw7xGStoRsSLQ1RXrCvAqVb14qMMWwiT65y2JHYC4EDbf7LdeMaEVhzkm2SCOJbqVQqIYAXT-6jvSTXkP-vgacFT0FxJsWdnikWAJ8mORnBEqq1iZgy5oRZenldvBEz8_UpWQ3r2zfKSFrD4Ap-DdX9bSMryXgV2CnbA_EZD-xEm9yRUnUwAkZd-SgVQEMsXQjJZ-ITOQbtJm_utj3H0Sdqq6XwneCn5wx24v6Do-pPg3DetEaCy18e7eL_jXqsUsRHiwCNMymzmBM-KWeXYuV4BvaXb7ILfRmrNHxuf3S_Mb9BGB7vCwcPpx1I_Z4dYogQN7Vv-hlOziyCuDqxyAPK3dEJx6r9kWvNSopKLlf3OcGKBb8dXU6y4MnIgTvBN7DFsGSreM1PRxBsDAgO9LA7XK6Naw3Bht25EG7_rvrNp5p_wY3tpuCkD7tQ1R2u-qq2jRDZ8ho2KFqGjn8UTCmPTuOCwxy3TPtL60onJhYXypyBc57R93qur6Xilk_ywySxQvGEIrqXyVxoY0pfQzI9uNb7bHoxg7rq3kLB31HBWuAAf8QC_5xlIaD_IBe05djRYDlK74-F3csPH1H3S8LDSOQZ8H3bUysWENYhfEh2HwgwwogEUQmdwktEO9v11zjRl5K4Hs3S9TnMtWy8famYXf_L3ZYZcTpfMnpgy_nZiWTTWEYrAa4NWUrnT0Do8kNeuChPMC8GSHMxLnlExz0a38C5bkJiKVEfP5Hmrph1GakaIq76BPrkgVLMdOFP_Sh7jTX3BvaktFkgRxRqb1DGudKofvA4BzwjEnZW6vOSos6wlpfjt-bhngMs_UBUXzlT5wL_DfR_YeJLTjIwMJTLLTCLDMNAmTMZH4u17Cb1a3FGK9vWQIxmKTKgVvNd0sdiLVjKDaP8B-qZF2YpwbeodsEvjX5oz-cLxIj0yuKFDdcA637Xx0wLJuiFPLn6N56m8bLQkHskvU69gag0_kMSQTkqLrqfgdygXJqURwjzeY1y6dy0HcYzGs2v8pg0vpvyh0hFU6SpsBYKJQPjmaMPkps-tkj9vBCRhyOLcl52JVjSxqfkEFn9pE2__LBlcdcoJ-6u8WZnMPuJVg1Lu1CSmUWMjlkf3tmvmLLAt5XP_1AwVul7B7ilFxdsNlFWxMuc4RlnLf293PWnkw7PpdWpGRN1aXILU03L3LpG55Pg3CVJw&cid=CAQSPADUE5ymM6O87RCFZYULnlOlf__g2FKJYdsUVj460cBlh9pTlRybnhypfXV4LVsSzmDaN_9wT0ybYX2ThhgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Famdm.ru%2F&ds=l&xdt=1&iif=1&cor=10488911842324677000&adk=2228999115&idt=187&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

855e15fcdc7a729b06238328936629eac46e2251d9d3d71a5d65510451f4e7c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 18:59:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3919
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3023
x-xss-protection: 0
server: cafe
etag: 4221495933888618527
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 12 Mar 2023 18:59:29 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230222/r20110914/ Frame C0F9 28 KB
11 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230222/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8294f47c10ab9172680f9bba780fecd122dbec7acc578a6973704c97903a8915

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 18:59:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3919
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10818
x-xss-protection: 0
server: cafe
etag: 16521218800250601078
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 12 Mar 2023 18:59:29 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6BD2 41 KB
15 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 17:13:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 96688
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 25 Feb 2024 17:13:20 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 91FA 1 KB
643 B 14ms
13ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 21757
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Feb 2023 14:02:11 GMT
etag: 48472445140208031
expires: Mon, 27 Feb 2023 14:02:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 6BD2 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eef4b22930d698c33d371cda972dfb68d9f34247f4a4cd03ffd1ddc213d00337

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C0F9 41 KB
15 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 17:13:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 96688
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 25 Feb 2024 17:13:20 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D9E0 1 KB
643 B 13ms
12ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 21757
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Feb 2023 14:02:11 GMT
etag: 48472445140208031
expires: Mon, 27 Feb 2023 14:02:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame C0F9 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 094929fc9c6ed07cd4f9ef8b37a2c68ec9c9f30641f9871283eac2fab6789aaa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

sid Show response
mug.criteo.com/ Frame BF89
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=amdm.ru&sn=ChromeSyncframe&so=0&topUrl=amdm.ru&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=bQL4snxOUk5MaUp4VXBZWE5VYTR2R2dNOUJHODZNVHZzeWZjNUNhSFIrMHBtVmxoTzl0Rkw1WXRmLzc0eFVkNjg1d3lzRzkxS3BkdVN5angwRThYSWNHV1c5OXRyOVpkRDRweHU3T1ptcWorbTdrSDAyUTJraXZ1SEdBN2...

435 B
656 B

237ms
25ms

Fetch
application/json

178.250.1.11
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=bQL4snxOUk5MaUp4VXBZWE5VYTR2R2dNOUJHODZNVHZzeWZjNUNhSFIrMHBtVmxoTzl0Rkw1WXRmLzc0eFVkNjg1d3lzRzkxS3BkdVN5angwRThYSWNHV1c5OXRyOVpkRDRweHU3T1ptcWorbTdrSDAyUTJraXZ1SEdBN2hLZ3M5M1FKNDJUWjY4bWxKemd5QTh1aUwzRnM0cXdLZ3dtMlR0L2JFRzU0TnhaUTZMTDMvYXpvVzZoS0xtT2xybHQvc1k4YzV5V2FaM0tjQmxnME9YNnh4NlUrR1A0c2orbDVnb2F2YytvbWErRW9URDl0YVBkMENCeE50Mm8wS2Rjb01uK0VQMjRONDBkUU0waGlxMmRSUzA2YzYzQT09fA&cppv=2

Protocol

Server

178.250.1.11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

b28e0b4ec3c54919cdf2562f834ea7b8f455602460dbfd4bd22f9557b7c02ce3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 7968882
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:48 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=bQL4snxOUk5MaUp4VXBZWE5VYTR2R2dNOUJHODZNVHZzeWZjNUNhSFIrMHBtVmxoTzl0Rkw1WXRmLzc0eFVkNjg1d3lzRzkxS3BkdVN5angwRThYSWNHV1c5OXRyOVpkRDRweHU3T1ptcWorbTdrSDAyUTJraXZ1SEdBN2hLZ3M5M1FKNDJUWjY4bWxKemd5QTh1aUwzRnM0cXdLZ3dtMlR0L2JFRzU0TnhaUTZMTDMvYXpvVzZoS0xtT2xybHQvc1k4YzV5V2FaM0tjQmxnME9YNnh4NlUrR1A0c2orbDVnb2F2YytvbWErRW9URDl0YVBkMENCeE50Mm8wS2Rjb01uK0VQMjRONDBkUU0waGlxMmRSUzA2YzYzQT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 369153
content-length: 0
expires: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 2C42 22 KB
8 KB 14ms
13ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 94408
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Feb 2023 17:51:21 GMT
expires: Sun, 25 Feb 2024 17:51:21 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 91FA
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEMJSENmoZ6uUv6lA2QiYo3E&google_cver=1&google_push=Aa02lx87i00kE-Kh9Qym7Pg9UGbsyz7UxaDR3bA149QM8Q9HewDmTsw1LMViASDqusDZ_8Fq7LysoNTCt5EBci-JjXHzMEM4Fy_7K7c
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=CCF84581A79D4CCFA8B0874E1CC9D5D0&google_push=Aa02lx87i00kE-Kh9Qym7Pg9UGbsyz7UxaDR3bA149QM8Q9HewDmTsw1LMViASDqusDZ_8Fq7LysoNTCt5EBci-...

170 B
188 B

34ms
30ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=CCF84581A79D4CCFA8B0874E1CC9D5D0&google_push=Aa02lx87i00kE-Kh9Qym7Pg9UGbsyz7UxaDR3bA149QM8Q9HewDmTsw1LMViASDqusDZ_8Fq7LysoNTCt5EBci-JjXHzMEM4Fy_7K7c

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 26 Feb 2023 20:04:49 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=CCF84581A79D4CCFA8B0874E1CC9D5D0&google_push=Aa02lx87i00kE-Kh9Qym7Pg9UGbsyz7UxaDR3bA149QM8Q9HewDmTsw1LMViASDqusDZ_8Fq7LysoNTCt5EBci-JjXHzMEM4Fy_7K7c
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sat, 25 Feb 2023 20:04:49 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 91FA
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEGbzn2qd4z1a1cEBlLlNp2g&google_cver=1&google_push=Aa02lx-SM1Irk5hx6c0hBZRdYyZpB461lIImYzS1omIBN32jasigy5tJCF2mmVPuwdMVClk1ViNSdjohFeNw8dfnByAlLm0...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx-SM1Irk5hx6c0hBZRdYyZpB461lIImYzS1omIBN32jasigy5tJCF2mmVPuwdMVClk1ViNSdjohFeNw8dfnByAlLm0dRk44SQ&google_hm=eS1fMlRHXzBaRTJwRTNJ...

170 B
188 B

33ms
31ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx-SM1Irk5hx6c0hBZRdYyZpB461lIImYzS1omIBN32jasigy5tJCF2mmVPuwdMVClk1ViNSdjohFeNw8dfnByAlLm0dRk44SQ&google_hm=eS1fMlRHXzBaRTJwRTNJc2RjQzg0WklOTWJGTU5kM2hVdX5B

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 26 Feb 2023 20:04:49 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx-SM1Irk5hx6c0hBZRdYyZpB461lIImYzS1omIBN32jasigy5tJCF2mmVPuwdMVClk1ViNSdjohFeNw8dfnByAlLm0dRk44SQ&google_hm=eS1fMlRHXzBaRTJwRTNJc2RjQzg0WklOTWJGTU5kM2hVdX5B
content-length: 0

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 91FA 42 B
213 B 110ms
27ms Image
image/gif 34.160.236.64
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESED2YJiwV0FgaZc2kMhlmSZk&google_push=Aa02lx_gh3YJGm81fC1hwpsycA_scZj0zge7cuMhQ24ev0YVfGmG3MoUoWnwhjJVgGBaeTRUN9_bCuYHvzIUKfBxA-bflYVumBKHTwQ&google_cver=1
Requested by: Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.160.236.64 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 64.236.160.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:49 GMT
via: 1.1 google
last-modified: Tue, 28 Jun 2022 14:08:50 GMT
server: nginx
etag: "62bb0b72-2a"
content-type: image/gif
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2 200 trk
ag.innovid.com/ Frame 91FA 43 B
296 B 298ms
27ms Image
image/gif 2a05:d01c:1d8:8100:f325:981e:6456:70dc
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEPG6IYMgZbCafaGAjO7BFvU&google_cver=1&google_push=Aa02lx-LP4xeuYfWkhXM-ZClTlcG8dWkazIvEfc6HbPoz4SFUE8Bd1Wm_v3LTHnUkm6XB_QBegDrIDKvg5ejp-0VryPgetquWZ9dnjY
Requested by: Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8100:f325:981e:6456:70dc London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
cache-control: no-cache
content-length: 43
request-time: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 91FA
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEFZwaoiEglmqE2tqG2NbdNA&google_cver=1&google_push=Aa02lx-JkVlaXKaDrRidbRKe1xq2xqPHL5ERJwHd86AUbb1K-KaMsVQEFnco56orNKzI_gt56nFP-jiYmOWI...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=Aa02lx-JkVlaXKaDrRidbRKe1xq2xqPHL5ERJwHd86AUbb1K-KaMsVQEFnco56orNKzI_gt56nFP-jiYmOWIfwL9P3bLSpcQCUjeWMQ

170 B
188 B

24ms
23ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=Aa02lx-JkVlaXKaDrRidbRKe1xq2xqPHL5ERJwHd86AUbb1K-KaMsVQEFnco56orNKzI_gt56nFP-jiYmOWIfwL9P3bLSpcQCUjeWMQ

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=Aa02lx-JkVlaXKaDrRidbRKe1xq2xqPHL5ERJwHd86AUbb1K-KaMsVQEFnco56orNKzI_gt56nFP-jiYmOWIfwL9P3bLSpcQCUjeWMQ
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 91FA
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESENclMcTA4Bxn7ESpvG8S500&google_cver=1&google_push=Aa02lx-djlht3_ImJPV3zLb5dNknoV98AzafuMwn47Lrrpe0fxbSidKBE87djPANHePB7qUTqkVLV-pVOuXt0d80TELdA2...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESENclMcTA4Bxn7ESpvG8S500&google_cver=1&google_push=Aa02lx-djlht3_ImJPV3zLb5dNknoV98AzafuMwn47Lrrpe0fxbSidKBE87djPANHePB7qUTqkVLV-pVOuXt0d80...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=IcAiqcxaQDSJfRS79jYh1Q&google_push=Aa02lx-djlht3_ImJPV3zLb5dNknoV98AzafuMwn47Lrrpe0fxbSidKBE87djPANHePB7qUTqkVLV-pVOuXt0d8...

170 B
188 B

26ms
26ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=IcAiqcxaQDSJfRS79jYh1Q&google_push=Aa02lx-djlht3_ImJPV3zLb5dNknoV98AzafuMwn47Lrrpe0fxbSidKBE87djPANHePB7qUTqkVLV-pVOuXt0d80TELdA2jxTkNscms

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=IcAiqcxaQDSJfRS79jYh1Q&google_push=Aa02lx-djlht3_ImJPV3zLb5dNknoV98AzafuMwn47Lrrpe0fxbSidKBE87djPANHePB7qUTqkVLV-pVOuXt0d80TELdA2jxTkNscms
access-control-allow-origin: *
date: Sun, 26 Feb 2023 20:04:49 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2 200 sync
ssbsync.smartadserver.com/api/ Frame 91FA 0
45 B 217ms
21ms Image
text/plain 185.86.139.103
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEOPg3aoDGkDMVAtAbyvOhuQ&google_cver=1&google_push=Aa02lx_s54x5YEOh2FHsGO6xOkA-bQa_Q8I6GBOChnKDJVvf2phBUMApz7Pe01klNsHEj_zdEEhVJ_ZWuu6hCYAbhouL2ml8duOEh5Y
Requested by: Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.103 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:48 GMT
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 91FA 0
12 B 25ms
23ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KN4QfurcQN29ZivnolhpC6K4bGYCPsJgphiEBucUVCryPK-r6_phHy22SMvVtzMznJ6KIO

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/325090680463534349/ Frame 6846 7 KB
2 KB 68ms
13ms Document
text/html 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/325090680463534349/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2ea5f4377b4e52037ece02b9b7e4521041820790d01b43334e4b2644a294ed42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 563930
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2422
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 20 Feb 2023 07:25:59 GMT
expires: Tue, 20 Feb 2024 07:25:59 GMT
last-modified: Tue, 14 Feb 2023 09:32:55 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6BD2 0
0 160ms
70ms Fetch
image/gif 142.251.208.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvXhJrDU1KeSfv0X96aZOM2wEKicmusrAsjY0-HQ9fj9mK5eHixqCplMHEgI05lowTg4urpUkRTaicz6SfOLMssGJOZVNcja4F_Fywy449nvCIoDb44sNSWBVP52xIHhPjSWbfXPEW3-dYmyYpF98UicrgLWGkwRvBQ5YqYmPDygULUiob01aSB3Ehicg3nPfCM6xvKYsrVZaJMFwn0tkE0KlF8ZIF88HanmmEcswPq8KCAS1EI2e54WP-T6ji9oPR3u31jBOf5ih75dtHuZwdKDlfHke5_LJv5r29cJvEgGAMC0b7q4Q9nPWI_-llNFG0l_RNxnc0jr2kCBpAzu5Jwiah_u9T9hpRJq40_0Fnz7LWXwL-L9bONCfYPUzF_A4j-d7bHAkrj7ddOFFoIw4RmgCFI1--NT7tn9ufJR057aGHgymmp8pHCLspJhBl7v3z41AVbeWxp4Tl120kV4zcVoko4tC1UxkurttyJf9OMWiPwYYPv8loYp77ITs7aHjhOBE2pgOdvTB9r63YIyHUzMd_5SPsNCWtPK75gxiXU2dqJsUnR2vEmOt7xNGUHE_bwrICbMRHZqKLzaglmyC7RDjnpdZeT0l2ou7ctEiOAeSs80S3OEg9tjzXenvP6I4i1ROZYoT4p8EgUn7_XkCmgqtYSe59_CpZ3tnOd0CspDRCD4-dt5DaVvuqJYdJF6CaVQ-sbL2K5aZqi_xN5faIc1f-U8dBIY8AxqlYe1vbIekOU1rFqe2m0eiNjHnxaAubNwSPGXpczAS2ksbFT0mDd5Pd3QTR5GI-i9Y7QJTG-aZoWOdO-oe0VEwDDuEQKnip_01qEF9QNI5BBu7YnW0uYMzL21oIMyQL-CpNaB6NhH0Job0Zyg2sYy7tjezPIJg74-dzbYbWx3oJxxMtxKRonHzBxpylWVbWhBjbjouPTEk2LND-quQlAq_CqsQOg3T0oRk7EIHBDCuXKflhoX6YG1giJQG1sj3HdYpRgK6LJv3No0jouJZWpfyF5CB9PQIviKzym35hm-Q4mVJIUmO3bvNmpjwR2ZjeBdrTuXE7PJNOIltGKNcP1a03YAZN5pelX8reLzG7Zi8ickog3c6WZj-_6mRohkP32z_W2DrAzF2ZRM-CzMq5aRU6kA82wCwSjXaS-HwYMpt43aE2tPyNtFtPSMnXKtBcBZb0XqVKQQjpwouICTsw5FzfdHjMXRzyb&sai=AMfl-YTZdNtPlbpGOtpBRBejHKqjV2K2HuOchlA0ADGVGM-Y6m6Wqu1vLbreFOYHQlxBNA9mrXG-qyUAz8sBXmkm9wMk20svnVw1SxWmc810n0Hd2xUKguSMHvQYIAGSifLdO1JJBWJr0pnTVyPOpI7OUA52zA9qFA6bkYu0lk00O69pW3m2JYWYeRqCmCSQ-iUvybjkIjKjMRNpp0CCNKiOovlY3cKq1FXA97I0IutD8RBDr-rZXnS-8nTtUdUMmZHMs213x4c&sig=Cg0ArKJSzDO00iDJqtNXEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=151&cbvp=1&cstd=147&cisv=r20230222.89439&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: amdm.ru
URL: https://amdm.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.208.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 26 Feb 2023 20:04:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 26 Feb 2023 20:04:49 GMT

GET
H2 200 hit.gif
visitanalytics.userreport.com/ Frame 6BD2 43 B
517 B 104ms
9ms Image
image/gif 13.225.78.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://visitanalytics.userreport.com/hit.gif?t=DCO2fa74be3&gdpr_consent=&gdpr=
Requested by: Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-amz-version-id: fZAqbzuxSGtIKd7g0Oj0VzvG4UrkztnT
date: Sun, 26 Feb 2023 06:10:32 GMT
via: 1.1 1bf129b8787cf2e96d3bce725554e4d4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
age: 50112
x-amz-meta-cb-modifiedtime: Tue, 14 Apr 2015 11:43:27 GMT
x-cache: Hit from cloudfront
content-length: 43
last-modified: Thu, 15 Oct 2015 11:22:45 GMT
server: AmazonS3
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
x-amz-cf-id: ibFbFswTOkzbw7IIrmtNW-7Q63cAN9ZX9J5uZpGznNv7AALGsf8COw==
expires: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4740 22 KB
8 KB 16ms
16ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 94408
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Feb 2023 17:51:21 GMT
expires: Sun, 25 Feb 2024 17:51:21 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 300x250.html Show response
s0.2mdn.net/sadbundle/1768707744346019216/ Frame 8F52 6 KB
2 KB 62ms
16ms Document
text/html 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1768707744346019216/300x250.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13c6baf37addf0d209486ef46b082e3cf00fccff1a5fd0caddebef63d5fcde4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 475490
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2367
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Feb 2023 07:59:59 GMT
expires: Wed, 21 Feb 2024 07:59:59 GMT
last-modified: Tue, 14 Feb 2023 11:30:27 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C0F9 0
0 156ms
73ms Fetch
image/gif 142.251.208.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss9JWTtl5QhIyn2GmojpN8R4Rhcx15X9SiNP05rZLM3qC46X_SwY4OICAs38JVRJ8H8tHxOEI-NkMSHCFDcpXTgSWCWn5l6c91pA7O-pIutNCyaeUiECgdCx7G_lc0NbQU-kbJ_-RLL3qop84RR0paPW8S5DstR072nbcLm3Uow0dtlPZQg2Pn7u2cXjJ0bm9JLoHTQLpS_81nBWF-lhl_esp9toUCbrm4Y3fk9hdZL_ElF9hqdG38wJvRG-0LcB_HssDDcQZFfXRGDwiU5mip9X6sjSd7gsuLNR2cVjQIZBEk9whlT1lW6yk0NJIQ-_NKHMCPCIqYJHC3s2Iwbhr56SPiGC_33Bui9bMeOzNK_nd_ctgra1GUS2lrDAZAx17mXyOT2GUeBOa1F-d8YSMcbf5lClY17FGNY9yxeXEXBsGHVfx6ZVE8YR01QNo0ZMRWlR1SIN_9JYXZJaG-XbJPHNsoAHHY2jR7CyjqCk0Yy73C9tX2ON58NhgxdhD8TRx0CMWKFwsBWm-R8J5AFyoj2P8WYW8LbuBs9w-uPMnKpR-2PvLfuRu3UFwx5cBSSu2K8SEQP5ZgbOpVyWtds7Y-gpakqVbkAgHT6Tct7vopPffPLaprB7HeMKwdWDYCtoVfUaSYh82IX_Mq0rvYncjpXkrWr_edmuRmLVHV9eos_o-AiNedwJsYGrDU3hlTk3zM9l7y_r-MHOFB20irbxIEpi4y_5EJQZpH-5uBc2ukpThSnl_DwiCGKsfkx1RIwYq9ekqPUjsoifmworbpec55uJ4NWfkmL6e1DDriPmXtRUY45q1HvMxl40lzbSf-CdFP2HIS8I70Pku_UWlaVXh1Ov9U8bM1T9wZSM0gnbz4g-hjmi-ePCoDzO0DIqO2gXEh8dGuwZP58HH-_pC2obOV2ACPREUR0zqHChBdmO-2p5tvQR9-n5X8Asz54--a7V8Ha0LVEDmR0t0c7z2me7gxF3P31mrQscTS3u8ivPD_sxvTfg_5NM1x8izYzj-BjMpVMDa7CkO4Pu9xk5U394LTk67fE-Z4aMs39eEoXcdgvzaalEYKVtZvLnBDeOdfqCVybBmlnefpS3LRX6hsFHfe-Ey577W0nhtrA6d9ihYvK1IgBkoIbMO2LsZz3TcF35SMQUE9fUYaO9JfxrbCCrt4gslsrHRXBL4KA2FXNdB6Qmy1yocXM6ZrrRrmAy1Ge7NoqWdkJqTSxdsMhX_3CicLjVNbB-iRxgVnP3A5MB1z4Y51P0-j-ywtU8nz1cbjEWUufAxinkPfqBULhFLk&sai=AMfl-YQeCmTGHV2wOBy5Y0Q42CW2VNTnAoJjhnPUzR_rCmiVyaqm7kh77FpXwU04DUfnxHTvsDcbj-509bIY-vlXp25LE0T8ixfSip2-v6pIcYHEG7guymMuTrIWcvgbagslI7uklNg1DYzS9bmxUFidl9_Dtd2l4d0pXHJMJjVBLhDIGVPlD-5F7ywxN2dOTc1Idq19Kh-6FNwRJq9Ygd_hjSU_0O27TuElLgt13rCp3xM1UdFepzKcmQpxvJaGNFGIKshBrKw&sig=Cg0ArKJSzJV9brZZVLPqEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=144&cbvp=1&cstd=143&cisv=r20230222.20511&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: amdm.ru
URL: https://amdm.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.208.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 26 Feb 2023 20:04:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 26 Feb 2023 20:04:49 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame D9E0
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEKMzfVwJj1eAF0SeMfSYaF4&google_cver=1&google_push=Aa02lx8Y66PuJUv9Z5wLjA6W06De51nJAh70WXVyOJDIAanNqDlL8I6FkCGI9m5DC2ydMzhaYEkUXmHAq1bJb-tquiEY6XmGTPf0&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKMzfVwJj1eAF0SeMfSYaF4&google_cver=1&google_push=Aa02lx8Y66PuJUv9Z5wLjA6W06De51nJAh70WXVyOJDIAanNqDlL8I6FkCGI9m5DC2ydMzhaYEkUXmHAq1bJb-tquiEY6XmGTPf...

43 B
418 B

205ms
174ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKMzfVwJj1eAF0SeMfSYaF4&google_cver=1&google_push=Aa02lx8Y66PuJUv9Z5wLjA6W06De51nJAh70WXVyOJDIAanNqDlL8I6FkCGI9m5DC2ydMzhaYEkUXmHAq1bJb-tquiEY6XmGTPf0&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAa02lx8Y66PuJUv9Z5wLjA6W06De51nJAh70WXVyOJDIAanNqDlL8I6FkCGI9m5DC2ydMzhaYEkUXmHAq1bJb-tquiEY6XmGTPf0%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 79fb4ac06831bb83-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 79
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKMzfVwJj1eAF0SeMfSYaF4&google_cver=1&google_push=Aa02lx8Y66PuJUv9Z5wLjA6W06De51nJAh70WXVyOJDIAanNqDlL8I6FkCGI9m5DC2ydMzhaYEkUXmHAq1bJb-tquiEY6XmGTPf0&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAa02lx8Y66PuJUv9Z5wLjA6W06De51nJAh70WXVyOJDIAanNqDlL8I6FkCGI9m5DC2ydMzhaYEkUXmHAq1bJb-tquiEY6XmGTPf0%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 79fb4abefd45bb83-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D9E0
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJRZEcsyWm5ijw8j6VuWS18&google_push=Aa02lx8aSvveOCOgZ8WMgxixQMv9OIF6uWLKd8ozShbOMySKuwV78Fnsy4...

170 B
188 B

27ms
27ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJRZEcsyWm5ijw8j6VuWS18&google_push=Aa02lx8aSvveOCOgZ8WMgxixQMv9OIF6uWLKd8ozShbOMySKuwV78Fnsy4SaeBjiUkVVGmsGeQDBolMVJKY_lATqlRMBlsxi-qE

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230064-FRA
pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1677441889.147172,VS0,VE113
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJRZEcsyWm5ijw8j6VuWS18&google_push=Aa02lx8aSvveOCOgZ8WMgxixQMv9OIF6uWLKd8ozShbOMySKuwV78Fnsy4SaeBjiUkVVGmsGeQDBolMVJKY_lATqlRMBlsxi-qE
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame D9E0 0
174 B 77ms
23ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESENYTiK9hYz1we9JRbUOkjRI&google_cver=1&google_push=Aa02lx8h8NsOkG345Riz9xSiR2tQhe9MO72i5-WJd2XbtaB0BkKpG7NegesauJuaP_ttAp9J7p8_n0fq5PNlX26YeHGWORjcRapJ
Requested by: Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:49 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D9E0
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEPrglBWKsuAWm9PdEhUNtHE&google_cver=1&google_push=Aa02lx8hRvjDjBPSPqvgVDWZ1gjOLodwXPUR7NeeXIl4L9r5t9waNrR3XUAnhoBMq6SV12_PMRfRY-wnfmgMGnfcg0la...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEPrglBWKsuAWm9PdEhUNtHE&google_cver=1&google_push=Aa02lx8hRvjDjBPSPqvgVDWZ1gjOLodwXPUR7NeeXIl4L9r5t9waNrR3XUAnhoBMq6SV12_PMRfRY-wnfmgMGn...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=Aa02lx8hRvjDjBPSPqvgVDWZ1gjOLodwXPUR7NeeXIl4L9r5t9waNrR3XUAnhoBMq6SV12_PMRfRY-wnfmgMGnfcg0lajaWamYcL&google_hm=1AX7_YAaQGqO-jl-FhxzBw==

170 B
188 B

25ms
25ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=Aa02lx8hRvjDjBPSPqvgVDWZ1gjOLodwXPUR7NeeXIl4L9r5t9waNrR3XUAnhoBMq6SV12_PMRfRY-wnfmgMGnfcg0lajaWamYcL&google_hm=1AX7_YAaQGqO-jl-FhxzBw==

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=Aa02lx8hRvjDjBPSPqvgVDWZ1gjOLodwXPUR7NeeXIl4L9r5t9waNrR3XUAnhoBMq6SV12_PMRfRY-wnfmgMGnfcg0lajaWamYcL&google_hm=1AX7_YAaQGqO-jl-FhxzBw==
date: Sun, 26 Feb 2023 20:04:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D9E0
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEGbzn2qd4z1a1cEBlLlNp2g&google_cver=1&google_push=Aa02lx8Z5_ecT3w6FW21Sxzi_R_gJiasve1Aj0fEU_nV6nZzW3W_XKQLqR_ZxfWfAk4L-ooc9PkozJnudlc6FqiWtSYghcC...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx8Z5_ecT3w6FW21Sxzi_R_gJiasve1Aj0fEU_nV6nZzW3W_XKQLqR_ZxfWfAk4L-ooc9PkozJnudlc6FqiWtSYghcCZ1MHg&google_hm=eS0zblV2dDN4RTJwRW1peG...

170 B
188 B

30ms
28ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx8Z5_ecT3w6FW21Sxzi_R_gJiasve1Aj0fEU_nV6nZzW3W_XKQLqR_ZxfWfAk4L-ooc9PkozJnudlc6FqiWtSYghcCZ1MHg&google_hm=eS0zblV2dDN4RTJwRW1peGc5bDhUc3lXWmVoelNCazUxbn5B

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 26 Feb 2023 20:04:49 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx8Z5_ecT3w6FW21Sxzi_R_gJiasve1Aj0fEU_nV6nZzW3W_XKQLqR_ZxfWfAk4L-ooc9PkozJnudlc6FqiWtSYghcCZ1MHg&google_hm=eS0zblV2dDN4RTJwRW1peGc5bDhUc3lXWmVoelNCazUxbn5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D9E0
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEEBVbb8zQeCHHc3LDbyjYrk&google_cver=1&google_push=Aa02lx82oKmyIwwjJkvXf14rIwFrhdcNUk4ny2ZYjyZbhyeBV3gK8dfYSqjuc_XHpBOVwwOSGiWTTYH_aPmFRk-coJUBRUn...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEEBVbb8zQeCHHc3LDbyjYrk&google_cver=1&google_push=Aa02lx82oKmyIwwjJkvXf14rIwFrhdcNUk4ny2ZYjyZbhyeBV3gK8dfYSqjuc_XHpBOVwwOSGiWTTYH_aPmFRk-coJUBR...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=Aa02lx82oKmyIwwjJkvXf14rIwFrhdcNUk4ny2ZYjyZbhyeBV3gK8dfYSqjuc_XHpBOVwwOSGiWTTYH_aPmFRk-coJUBRUn1SmU

170 B
188 B

29ms
29ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=Aa02lx82oKmyIwwjJkvXf14rIwFrhdcNUk4ny2ZYjyZbhyeBV3gK8dfYSqjuc_XHpBOVwwOSGiWTTYH_aPmFRk-coJUBRUn1SmU

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=Aa02lx82oKmyIwwjJkvXf14rIwFrhdcNUk4ny2ZYjyZbhyeBV3gK8dfYSqjuc_XHpBOVwwOSGiWTTYH_aPmFRk-coJUBRUn1SmU
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D9E0
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBW-xIQO3d02LeMPf_1PXvw&google_cver=1&google_push=Aa02lx8OzMMe0iYL3EPUEPj4sD6eHE1EWXu0v7GWn1D1i7-UF6TPK_NQ2R_d-M8VIs-W381tz_l...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEVMVEw4NjMtVS1JRDlV&google_push=Aa02lx8OzMMe0iYL3EPUEPj4sD6eHE1EWXu0v7GWn1D1i7-UF6TPK_NQ2R_d-M8VIs-W381tz_lUZ93TeC1FYI6Ip9rDmntr-1kl

170 B
188 B

31ms
29ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEVMVEw4NjMtVS1JRDlV&google_push=Aa02lx8OzMMe0iYL3EPUEPj4sD6eHE1EWXu0v7GWn1D1i7-UF6TPK_NQ2R_d-M8VIs-W381tz_lUZ93TeC1FYI6Ip9rDmntr-1kl

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEVMVEw4NjMtVS1JRDlV&google_push=Aa02lx8OzMMe0iYL3EPUEPj4sD6eHE1EWXu0v7GWn1D1i7-UF6TPK_NQ2R_d-M8VIs-W381tz_lUZ93TeC1FYI6Ip9rDmntr-1kl
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 28e1e7d28d06b07ec669bc9e43057b8e
Expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame D9E0 0
12 B 24ms
21ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I8fjeEbaGHnFierl26d43JJ3zv6lt4mkHVOpPIHQbHNNteFdB96g5zGND8eDRov24DLF1r

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 ENhUjQ5Efr1LKcBlRSMtCxEMsPeXm4hb-JW7itjXrRA.js Show response
pagead2.googlesyndication.com/bg/ Frame 2C42 36 KB
14 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/ENhUjQ5Efr1LKcBlRSMtCxEMsPeXm4hb-JW7itjXrRA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

10d8548d0e447ebd4b29c06545232d0b110cb0f7979b885bf895bb8ad8d7ad10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 10:37:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 120432
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14306
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 25 Feb 2024 10:37:37 GMT

GET
H3 200 ENhUjQ5Efr1LKcBlRSMtCxEMsPeXm4hb-JW7itjXrRA.js Show response
pagead2.googlesyndication.com/bg/ Frame 4740 36 KB
14 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/ENhUjQ5Efr1LKcBlRSMtCxEMsPeXm4hb-JW7itjXrRA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

10d8548d0e447ebd4b29c06545232d0b110cb0f7979b885bf895bb8ad8d7ad10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sat, 25 Feb 2023 10:37:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 120432
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14306
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 25 Feb 2024 10:37:37 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 6846 60 KB
24 KB 24ms
21ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/325090680463534349/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/325090680463534349/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 Feb 2023 20:04:49 GMT

GET
H3 200 cssruleplugin_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 6846 2 KB
1013 B 35ms
32ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/cssruleplugin_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/325090680463534349/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d9095c25f5663901783868e1cd2994842dcbb4967ff5d0f0d3b9409b67675c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/325090680463534349/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 985
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:22:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 Feb 2023 20:04:49 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/sadbundle/325090680463534349/ Frame 6846 6 KB
3 KB 16ms
13ms Script
application/x-javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/325090680463534349/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/325090680463534349/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc806e5924e10cb8a72cbd6031c135a34f32263b1902afd915aaa78942b71ff8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/325090680463534349/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Mon, 20 Feb 2023 07:25:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 563930
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2587
x-xss-protection: 0
last-modified: Tue, 14 Feb 2023 09:32:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 20 Feb 2024 07:25:59 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 8F52 236 KB
63 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1768707744346019216/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1768707744346019216/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 Feb 2023 20:04:49 GMT

GET
H3 200 300x250.js Show response
s0.2mdn.net/sadbundle/1768707744346019216/ Frame 8F52 62 KB
11 KB 14ms
13ms Script
application/x-javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1768707744346019216/300x250.js?1675934849791

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1768707744346019216/300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2237cdc9773e2c20f3d5a95aa7ad60dfee2ffe869fc23b79aaba7dc936f27864

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1768707744346019216/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 00:38:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 329173
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10932
x-xss-protection: 0
last-modified: Tue, 14 Feb 2023 11:30:27 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 23 Feb 2024 00:38:36 GMT

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame C0F9
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1272511/69505650/4.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1010256565&ias_pubId=pub-8643561401961308&ias_chanId=1&ias_placementId=19312087806&bidurl=ht...
https://static.adsafeprotected.com/4.js?bundleId=${BUNDLE_ID}

1 KB
1 KB

15ms
14ms

Script
application/javascript

2600:9000:21f3:8e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?bundleId=${BUNDLE_ID}
Requested by: Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:21f3:8e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 22 Feb 2023 19:35:42 GMT
x-amz-version-id: vtoVcOeStqySRz0ovnOpcMO_.XzI7BRS
content-encoding: gzip
via: 1.1 03d509e8374e9f42668961b5e0201348.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
age: 347348
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Wed, 22 Feb 2023 19:35:40 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: v0piQ_lJyCMCcmFcmoKDr1zBwNzfQi-HEnv4d5P1wRtwj5dnWShIEg==

Redirect headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
server: nginx
x-server-name: app03.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?bundleId=${BUNDLE_ID}
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame CCDD 91 KB
23 KB 64ms
13ms Script
application/javascript 2600:9000:21f3:8e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:8e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Tue, 15 Nov 2022 01:04:21 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 03d509e8374e9f42668961b5e0201348.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
age: 8967629
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: yv1Byr0sCoGrYrayGXpnbUY0b6KLGvjyObTUpe-j7W1TMmLd2FPbOA==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame C0F9 43 B
216 B 546ms
177ms Image
image/gif 2600:1f13:800:7780:b3c6:43:249b:76fd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1272511&asId=6247c867-63d7-3b84-cbcc-faa1494daf21&tv=%7Bc:5mkKC8,pingTime:-3,time:61,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:21%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:62,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B55~0%5D,as:%5B55~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tx0bdAz+11%7C12%7C13%7C14%7C151%7C152%7C1531%7C154%7C16*.1272511-69505650%7C161%7C162%7C1631%7C164%7C17,idMap:16*,rmeas:1,rend:0,renddet:na,siq:23%7D&br=c
Requested by: Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:b3c6:43:249b:76fd Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
server: nginx
x-server-name: dt16.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame C0F9 43 B
215 B 544ms
178ms Image
image/gif 2600:1f13:800:7780:b3c6:43:249b:76fd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1272511&asId=6247c867-63d7-3b84-cbcc-faa1494daf21&tv=%7Bc:5mkKCb,pingTime:-6,time:64,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:64,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B57~0%5D,as:%5B57~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tx0bdAz+11%7C12%7C13%7C14%7C151%7C152%7C1531%7C154%7C16*.1272511-69505650%7C161%7C162%7C1631%7C164%7C17,idMap:16*,rmeas:1,rend:0,renddet:na,siq:23%7D&tpiLookup=ao:amdm.ru*&br=c
Requested by: Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:b3c6:43:249b:76fd Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
server: nginx
x-server-name: dt14.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame C0F9 43 B
215 B 517ms
179ms Image
image/gif 2600:1f13:800:7780:b3c6:43:249b:76fd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1272511&asId=6247c867-63d7-3b84-cbcc-faa1494daf21&tv=%7Bc:5mkKCF,pingTime:-2,time:94,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:652,beZ:653,mfA:655,cmA:657,inA:657,inZ:661,prA:661,prZ:668,si:674,poA:675,poZ:696,cmZ:696,mfZ:696,loA:715,loZ:717,ltA:745,ltZ:745%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:21%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:94,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B87~0%5D,as:%5B87~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tx0bdAz+11%7C12%7C13%7C14%7C151%7C152%7C1531%7C154%7C16*.1272511-69505650%7C161%7C162%7C1631%7C164%7C17,idMap:16*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:na,siq:23,sinceFw:69,readyFired:true%7D&br=c
Requested by: Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:b3c6:43:249b:76fd Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
server: nginx
x-server-name: dt09.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 comdirect_berater_970x250_v2_js.png
s0.2mdn.net/sadbundle/325090680463534349/ Frame 6846 124 KB
124 KB 18ms
17ms Image
image/png 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/325090680463534349/comdirect_berater_970x250_v2_js.png

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2936fdc1c21003a76a9528b55a9b9e8dde948c5b1f294b3c5bc62f727e08587

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/325090680463534349/index.html
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Mon, 20 Feb 2023 07:25:59 GMT
x-content-type-options: nosniff
age: 563930
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 126740
x-xss-protection: 0
last-modified: Tue, 14 Feb 2023 09:32:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 20 Feb 2024 07:25:59 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6BD2 0
0 68ms
67ms Fetch
image/gif 142.251.208.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvXhJrDU1KeSfv0X96aZOM2wEKicmusrAsjY0-HQ9fj9mK5eHixqCplMHEgI05lowTg4urpUkRTaicz6SfOLMssGJOZVNcja4F_Fywy449nvCIoDb44sNSWBVP52xIHhPjSWbfXPEW3-dYmyYpF98UicrgLWGkwRvBQ5YqYmPDygULUiob01aSB3Ehicg3nPfCM6xvKYsrVZaJMFwn0tkE0KlF8ZIF88HanmmEcswPq8KCAS1EI2e54WP-T6ji9oPR3u31jBOf5ih75dtHuZwdKDlfHke5_LJv5r29cJvEgGAMC0b7q4Q9nPWI_-llNFG0l_RNxnc0jr2kCBpAzu5Jwiah_u9T9hpRJq40_0Fnz7LWXwL-L9bONCfYPUzF_A4j-d7bHAkrj7ddOFFoIw4RmgCFI1--NT7tn9ufJR057aGHgymmp8pHCLspJhBl7v3z41AVbeWxp4Tl120kV4zcVoko4tC1UxkurttyJf9OMWiPwYYPv8loYp77ITs7aHjhOBE2pgOdvTB9r63YIyHUzMd_5SPsNCWtPK75gxiXU2dqJsUnR2vEmOt7xNGUHE_bwrICbMRHZqKLzaglmyC7RDjnpdZeT0l2ou7ctEiOAeSs80S3OEg9tjzXenvP6I4i1ROZYoT4p8EgUn7_XkCmgqtYSe59_CpZ3tnOd0CspDRCD4-dt5DaVvuqJYdJF6CaVQ-sbL2K5aZqi_xN5faIc1f-U8dBIY8AxqlYe1vbIekOU1rFqe2m0eiNjHnxaAubNwSPGXpczAS2ksbFT0mDd5Pd3QTR5GI-i9Y7QJTG-aZoWOdO-oe0VEwDDuEQKnip_01qEF9QNI5BBu7YnW0uYMzL21oIMyQL-CpNaB6NhH0Job0Zyg2sYy7tjezPIJg74-dzbYbWx3oJxxMtxKRonHzBxpylWVbWhBjbjouPTEk2LND-quQlAq_CqsQOg3T0oRk7EIHBDCuXKflhoX6YG1giJQG1sj3HdYpRgK6LJv3No0jouJZWpfyF5CB9PQIviKzym35hm-Q4mVJIUmO3bvNmpjwR2ZjeBdrTuXE7PJNOIltGKNcP1a03YAZN5pelX8reLzG7Zi8ickog3c6WZj-_6mRohkP32z_W2DrAzF2ZRM-CzMq5aRU6kA82wCwSjXaS-HwYMpt43aE2tPyNtFtPSMnXKtBcBZb0XqVKQQjpwouICTsw5FzfdHjMXRzyb&sai=AMfl-YTZdNtPlbpGOtpBRBejHKqjV2K2HuOchlA0ADGVGM-Y6m6Wqu1vLbreFOYHQlxBNA9mrXG-qyUAz8sBXmkm9wMk20svnVw1SxWmc810n0Hd2xUKguSMHvQYIAGSifLdO1JJBWJr0pnTVyPOpI7OUA52zA9qFA6bkYu0lk00O69pW3m2JYWYeRqCmCSQ-iUvybjkIjKjMRNpp0CCNKiOovlY3cKq1FXA97I0IutD8RBDr-rZXnS-8nTtUdUMmZHMs213x4c&sig=Cg0ArKJSzDO00iDJqtNXEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=437&vt=11&dtpt=286&dett=3&cstd=147&cisv=r20230222.89439&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: amdm.ru
URL: https://amdm.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.208.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 26 Feb 2023 20:04:49 GMT

GET
H3 200 300x250_atlas_NP_1.jpg
s0.2mdn.net/sadbundle/1768707744346019216/images/ Frame 8F52 47 KB
47 KB 15ms
15ms Image
image/jpeg 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1768707744346019216/images/300x250_atlas_NP_1.jpg?1676042808041

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a1970ff46100dd5956301a63c44bb423700c7afaaee4f43cbe2c984e6bac2d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1768707744346019216/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 08:48:14 GMT
x-content-type-options: nosniff
age: 299795
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47953
x-xss-protection: 0
last-modified: Tue, 14 Feb 2023 11:30:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 23 Feb 2024 08:48:14 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C0F9 0
0 65ms
65ms Fetch
image/gif 142.251.208.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss9JWTtl5QhIyn2GmojpN8R4Rhcx15X9SiNP05rZLM3qC46X_SwY4OICAs38JVRJ8H8tHxOEI-NkMSHCFDcpXTgSWCWn5l6c91pA7O-pIutNCyaeUiECgdCx7G_lc0NbQU-kbJ_-RLL3qop84RR0paPW8S5DstR072nbcLm3Uow0dtlPZQg2Pn7u2cXjJ0bm9JLoHTQLpS_81nBWF-lhl_esp9toUCbrm4Y3fk9hdZL_ElF9hqdG38wJvRG-0LcB_HssDDcQZFfXRGDwiU5mip9X6sjSd7gsuLNR2cVjQIZBEk9whlT1lW6yk0NJIQ-_NKHMCPCIqYJHC3s2Iwbhr56SPiGC_33Bui9bMeOzNK_nd_ctgra1GUS2lrDAZAx17mXyOT2GUeBOa1F-d8YSMcbf5lClY17FGNY9yxeXEXBsGHVfx6ZVE8YR01QNo0ZMRWlR1SIN_9JYXZJaG-XbJPHNsoAHHY2jR7CyjqCk0Yy73C9tX2ON58NhgxdhD8TRx0CMWKFwsBWm-R8J5AFyoj2P8WYW8LbuBs9w-uPMnKpR-2PvLfuRu3UFwx5cBSSu2K8SEQP5ZgbOpVyWtds7Y-gpakqVbkAgHT6Tct7vopPffPLaprB7HeMKwdWDYCtoVfUaSYh82IX_Mq0rvYncjpXkrWr_edmuRmLVHV9eos_o-AiNedwJsYGrDU3hlTk3zM9l7y_r-MHOFB20irbxIEpi4y_5EJQZpH-5uBc2ukpThSnl_DwiCGKsfkx1RIwYq9ekqPUjsoifmworbpec55uJ4NWfkmL6e1DDriPmXtRUY45q1HvMxl40lzbSf-CdFP2HIS8I70Pku_UWlaVXh1Ov9U8bM1T9wZSM0gnbz4g-hjmi-ePCoDzO0DIqO2gXEh8dGuwZP58HH-_pC2obOV2ACPREUR0zqHChBdmO-2p5tvQR9-n5X8Asz54--a7V8Ha0LVEDmR0t0c7z2me7gxF3P31mrQscTS3u8ivPD_sxvTfg_5NM1x8izYzj-BjMpVMDa7CkO4Pu9xk5U394LTk67fE-Z4aMs39eEoXcdgvzaalEYKVtZvLnBDeOdfqCVybBmlnefpS3LRX6hsFHfe-Ey577W0nhtrA6d9ihYvK1IgBkoIbMO2LsZz3TcF35SMQUE9fUYaO9JfxrbCCrt4gslsrHRXBL4KA2FXNdB6Qmy1yocXM6ZrrRrmAy1Ge7NoqWdkJqTSxdsMhX_3CicLjVNbB-iRxgVnP3A5MB1z4Y51P0-j-ywtU8nz1cbjEWUufAxinkPfqBULhFLk&sai=AMfl-YQeCmTGHV2wOBy5Y0Q42CW2VNTnAoJjhnPUzR_rCmiVyaqm7kh77FpXwU04DUfnxHTvsDcbj-509bIY-vlXp25LE0T8ixfSip2-v6pIcYHEG7guymMuTrIWcvgbagslI7uklNg1DYzS9bmxUFidl9_Dtd2l4d0pXHJMJjVBLhDIGVPlD-5F7ywxN2dOTc1Idq19Kh-6FNwRJq9Ygd_hjSU_0O27TuElLgt13rCp3xM1UdFepzKcmQpxvJaGNFGIKshBrKw&sig=Cg0ArKJSzJV9brZZVLPqEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=448&vt=11&dtpt=304&dett=3&cstd=143&cisv=r20230222.20511&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: amdm.ru
URL: https://amdm.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.208.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 26 Feb 2023 20:04:49 GMT

GET
DATA 200
OK truncated
/ Frame 6846 46 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05606cc2fc47dffcf9056d38d0c28814fa8be2457841e601057b82343681a97a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 6846 16 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 02f012d77f69d09efb2d4adc62a748a007a30a0c52f135f50d2873a9334db36d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 6846 33 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 381c15ec3889b1231b0a7556199933fac63fd895f13877c24c4ae542d7a50b4a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C42 0
20 B 119ms
119ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BCptlYLv7Y6mANLqPjuwPv6W4GAAAAAA4AeAEAg&bg=!rq2lrfnNAAZYlHKzeJQ7ADkAdvg8Ws2bilqp0IAy6DEjWMt55-myD5IfEDi3XreKtgslk0Qpqn5YmF0aXQ_YA1g1L4FThWJFke8CAAABrlIAAAACaAEHmQLlr0_cN_FHq6z6KxgXX7Cutnapo56Mdn_MmE3Be4C7XGAjClAoFGAj7a_5cYc0aPL7H_i87bXrolsr1R20a9u1W10jyebLioQiYDMlmTjqZ2_BEZpdCO-K8jk0XkWTBHS9FK1HfT2WU4NFFOqSX-_l9QHdZSnjeHs-1PLxV_m861rI7mcGCI4_y2uQ_98p00ciT0mDYU39dHfexjeDihh_Wo1_gJEByfvepNH2QJ9j8Q5PgpCr6xNYBP9TnwogKK_k2X1LLbMbgngBVHSe7NCrzJlgf8kALddw_-dskDv8hgVxjeoQAHEvuvtqIeMx3aGBsqbMHak4BeD8tto5MF2D5mEmre1cgXxGedLt5f2ab1BrxFS8MrecxXibbgljCoi2zcd0H4ymV8TEQ81MVfWQX6r3hePWY-HsmOg_SXe7Ww8775KvXa5IZ4KvoiIH2ojA2QQWkqUJELXtAC2xCOw0tkc95C8QXEb0qQcQ7ZJ2fKvQSxXr0jPN2aNbahqPfCCb5E0es8-7DaghtcRXnvp9uzGqiuuhGMRYiCQz0xGsJ3v8MjVnoMFbzk6wnSgmuitRILQdMRP4BKAAHNXWdjvkpOua1hUYV202jZiRQJukIAebGa1aQ-ioUsBxdEr-Vntew6UbFQGsfScamsi6duPApX3cvGdUtsxZSGwN2eIQOcUDBqQ12qwKmkybEK0xNMPF4g3YWoJKRFW4tw2sViwnB3_aJ0LRXATLU8ipPHGbZC4rKoi1WF-lHVvXv0bN8ZKkghgTWxFooPw0kXNKqQjwDLC719tzRmaGrb5psTDcoZpWoOz9Rcfx8s2jgTiltq0FshdeR2CayHE7t1tPl0i7-G-QiM-b60EpnbBSbpzw2NQHtglMlUddlwyvNhB_Fof9xIW-fSwyeWcBG33YRi0oxAi2IuPcMXip7fOkd8cFIasQ5nOLMOJL8QxX0o_tOjcGM8860KHkSfTncsS4M-VmuOvlY9o1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame C0F9 43 B
215 B 248ms
179ms Image
image/gif 2600:1f13:800:7780:b3c6:43:249b:76fd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1272511&asId=6247c867-63d7-3b84-cbcc-faa1494daf21&tv=%7Bc:5mkKGZ,time:362,type:e,im:%7Bpci:%7Btdr:116%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:362,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B355~0%5D,as:%5B355~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tx0bdAz+11%7C12%7C13%7C14%7C151%7C152%7C1531%7C154%7C16*.1272511-69505650%7C161%7C162%7C1631%7C164%7C17,idMap:16*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:23,sis:229%7D&br=c
Requested by: Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:b3c6:43:249b:76fd Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
server: nginx
x-server-name: dt15.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4740 0
20 B 120ms
119ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BnBr1YLv7Y5P0M6KKjuwPxrKh6AEAAAAAOAHgBAI&bg=!kZKlksbNAAZYlHKzeJQ7ADkAdvg8Wl-5HafMet38sA9KcVrtPIVrcMfHF-GESkVZEhBo9Sj-2H0tbewvIrUE5ja4IIzdFrqc_R4CAAABu1IAAAACaAEHmQLjULrfkNvPGqeCHwKsBrq_uCLjq2vQnQFj8xbUxThgyjjoi4_HbIiRMd29piQGxaYX1O1Rxeq3iDtx7NAFdlPlWPfdyMkczun6S_DXx5wb6GC16KVUucdMItqGqbSZlRDSsHQQRV3eB3MBxXyHOukK2hpFs52wWfkWPvHnE_5AqdGFwNG9kz8JXM5ycFvpzVgLbnq8jpiRJFD7ACBmFLQfpK4ONr8Vywt15vO5GtSnRGE3IdaPywM8NHIv0Sb3lLD78lbBHSUxLl0B2jm0xDHFD_wUEE8QT0H0e6Qx9PEmuKAlfThNzQDv2NdCg_Uvbn0nGzsQz08NTo5kW2iygHLAQXVZu8QQftkFEae3UniLXzMxdmfXYMtRFMk3gj97RyfShTqF7wSIZIouuZHZLHVtRU50MVpy6MXrLy3bJo-JLLpaYAWtmUr4WI9D9NukPrFyCdnvwbwdGRnp4JJ9HOr3Das1HbU5l787d1FiWoXqxEdQq0OVT8SVoMSSOoA5UnCZpCk-VHoqJbPFgP9rqN2KW4lbT9lksWq8w6H1L0QRTP9tdFRn9MuTCBHFdoWxhTQZCEN2G28P1eZkTgpuzEkRc6N_ypLoPzGGxq1JP2-06ZrfnUizImKFwQUlMlFMjsXY1xwND8ru_ymzYT8kwMloUpVdTVnYGtF7IlASN0RumlCjTuZKMc_3S_7lcQkeJTvGyV5B2FNQvWls7gMQa0rMKKL4W5pbf7O4Zr1shUIKLJ5dVvSbTfWQ8NSYdww_-RUlQ3-THn30UB3DWdG9MZrrIhEFB9EG43x8ST1glw64i-ejLSxT91usdLgsJlfKls3WqT1YrmiN5W81-fxU1J1qK2Fe9ZifRcoGOqpk8-D7m4C-aYdLXI7Zkp1jz4IAdrv_8CJwWn0IziQKpdxmN34iE2PNkk5m_Ibik5H8ahhxEKYsv7TERTbYMhczh0OI7OfIVWnIia6_KMXpKxdcb9lxhAXuVA

Requested by

Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame C0F9 43 B
215 B 180ms
180ms Image
image/gif 2600:1f13:800:7780:b3c6:43:249b:76fd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1272511&asId=6247c867-63d7-3b84-cbcc-faa1494daf21&tv=%7Bc:5mkKJw,pingTime:-10,time:519,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTEwLjAuNTQ4MS4xNzcgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.6.2v222222220002222202222222222222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1677441889758%7C%7Ca68ccb55ed0946f00424fc568cd390d9%7C%7C15c1c3073e5c3cda0308b87e66c0c1e4%7C%7C10627af4555d519c7a18905751e73191%7C%7C0171378a99efb27d639339a85f4cf7bf%7C%7C1363ad0d1b4e0d51ebb4538cfc22f59e%7C%7Ccff5369cf4e7a4934017dcde8c407429%7C%7C3852717f19e9f2ca193bce12f9bb03bc%7C%7C1663701684%7D
Requested by: Host: e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com
URL: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:b3c6:43:249b:76fd Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:49 GMT
server: nginx
x-server-name: dt24.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6BD2 42 B
64 B 124ms
123ms Fetch
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssq5ZoodtHFWVDu2gPu5HxFLGrVwxbjU8_gE5-rjJpM_1K7DWm0S3ysmaIUB2n3VmbJ5LphXQk46xIPyJ_f15NHZSOs0FCFI81HEGYkiBHa9s2vsGAXM5SGSnij&sai=AMfl-YS-MAzXC6QAahK7rWckZJdPwhlZnqavge6J3yVyogYK5Tyvc2s9dbONOdS0eHOU0wN21Du7hKsxM4uQZZkujjF7UGt6Pmo_jXY_7YgZNyxsqGUduHgBhSHO_rLP&sig=Cg0ArKJSzOwrlVi7saxuEAE&cid=CAQSPADUE5ymM6O87RCFZYULnlOlf__g2FKJYdsUVj460cBlh9pTlRybnhypfXV4LVsSzmDaN_9wT0ybYX2ThhgB&id=lidar2&mcvt=1001&p=255,315,505,1285&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20230222&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2118771456&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1677441888579&rpt=381&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6BD2 0
20 B 115ms
114ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=5359009987461&version=m202301230201&ct=76&x=1&cor=15410687026121624000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 8E81 281 B
554 B 104ms
14ms Document
text/html 104.126.125.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn-b.notsy.io
URL: https://cdn-b.notsy.io/amd/a/ym.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.126.125.209 Haarlem, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-126-125-209.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://amdm.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sun, 26 Feb 2023 20:04:50 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 sync Show response
eb2.3lift.com/ Frame AE89 37 B
140 B 491ms
163ms Document
image/gif 35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: cdn-b.notsy.io
URL: https://cdn-b.notsy.io/amd/a/ym.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://amdm.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif
date: Sun, 26 Feb 2023 20:04:51 GMT

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame E961 3 KB
2 KB 78ms
15ms Document
text/html 104.18.11.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn-b.notsy.io
URL: https://cdn-b.notsy.io/amd/a/ym.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.11.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://amdm.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 472
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 79fb4ac9ca70901f-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 26 Feb 2023 20:04:50 GMT
expires: Mon, 27 Feb 2023 00:04:50 GMT
last-modified: Mon, 25 Jul 2022 19:18:26 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 39D2 52 KB
17 KB 72ms
6ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn-b.notsy.io
URL: https://cdn-b.notsy.io/amd/a/ym.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://amdm.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 48629
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Sun, 26 Feb 2023 20:04:50 GMT
ETag: W/"623de86a-cf34"
Expires: Sun, 19 Feb 2023 22:55:08 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 10, 309757
X-Served-By: cache-lga13626-LGA, cache-fra-eddf8230064-FRA
X-Timer: S1677441891.851172,VS0,VE0

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 39D2 0
863 B 15ms
15ms Script
text/html 185.89.210.141
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:50 GMT
AN-X-Request-Uuid: af69ac26-2bae-492e-bb8d-b0d6009a6b1a
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 178.162.209.131; 178.162.209.131; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 8E81 33 KB
10 KB 19ms
15ms Script
text/html 104.126.125.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.126.125.209 Haarlem, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-126-125-209.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 30531e4a3c5f69b672d93c7c056a883c03e8ece6012ee795c50d0735574a4777

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Sun, 26 Feb 2023 20:04:50 GMT
Content-Encoding: gzip
Last-Modified: Sun, 26 Feb 2023 02:28:29 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=23045
Connection: keep-alive
Content-Length: 10006
Expires: Mon, 27 Feb 2023 02:28:55 GMT

GET
H2 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame 293A 2 KB
1 KB 203ms
135ms Document
text/html 104.18.25.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Famdm.ru%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a9763d843f3d5e184b8957d9c2571162b0a10dbd07b3e785ff821018bbd202e3

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 79fb4aca7b595c32-FRA
content-encoding: br
content-type: text/html
date: Sun, 26 Feb 2023 20:04:51 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qp95cmcAvAiyhE58vRTapdaf%2BTGkzXN1eviKgAL85%2B%2BOwafxz33jdK19VWt7yQugEjGi2CYe0CKEbrgwoNvzId%2FwOe%2FMCYsMQtXHGAb2e4Z1l%2FgMH1zx2sbFrOUDsL8FadkGzRSXPzj%2BmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 8E81
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LELTL863-U-ID9U

0
643 B

250ms
191ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LELTL863-U-ID9U
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:50 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: A15A8133600745639066E30F70B1A103 Ref B: FRAEDGE1222 Ref C: 2023-02-26T20:04:51Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX1n+AOpcTQtt3ny1Pr5Q==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LELTL863-U-ID9U
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 8E81
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEHIGy0UeZW_1p3uZWFCS4j4&google_cver=1

0
239 B

10ms
9ms

Image
image/gif

69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEHIGy0UeZW_1p3uZWFCS4j4&google_cver=1
Protocol: HTTP/1.1
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 28e1e7d28d06b07ec669bc9e43057b8e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:51 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEHIGy0UeZW_1p3uZWFCS4j4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 8E81
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/tBUYSN6nlT0B9IQ8NpU8pQ?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-JK6gu3tE2oKh.Ghhh4RMajeCX5ms2YJH_BOCUg--~A

0
239 B

11ms
9ms

Image
image/gif

69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-JK6gu3tE2oKh.Ghhh4RMajeCX5ms2YJH_BOCUg--~A
Protocol: HTTP/1.1
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 28e1e7d28d06b07ec669bc9e43057b8e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Sun, 26 Feb 2023 20:04:51 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-JK6gu3tE2oKh.Ghhh4RMajeCX5ms2YJH_BOCUg--~A
content-length: 0

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame 8E81
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=FNIkHFYnTZ6CgfUBOjWu0A&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=FNIkHFYnTZ6CgfUBOjWu0A

43 B
479 B

36ms
36ms

Image
image/gif

67.220.226.234
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=FNIkHFYnTZ6CgfUBOjWu0A

Protocol

HTTP/1.1

Server

67.220.226.234 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:51 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: C2H587K12H0VTF99QAFY
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=FNIkHFYnTZ6CgfUBOjWu0A
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 28e1e7d28d06b07ec669bc9e43057b8e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame 8E81 70 B
265 B 145ms
36ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sun, 26 Feb 2023 20:04:51 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8E81
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDA5MDk1YjBlZWE2OTFmM2FmNjg4ZTcyN2IxMjAyMTFkNDJiMTVmMg

170 B
188 B

27ms
26ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDA5MDk1YjBlZWE2OTFmM2FmNjg4ZTcyN2IxMjAyMTFkNDJiMTVmMg

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDA5MDk1YjBlZWE2OTFmM2FmNjg4ZTcyN2IxMjAyMTFkNDJiMTVmMg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 8E81
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=eoFdJ2KaRQGFVWfHKxdCGQ&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=eoFdJ2KaRQGFVWfHKxdCGQ

43 B
479 B

111ms
111ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=eoFdJ2KaRQGFVWfHKxdCGQ

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:51 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 6Y29MB99G0GVH5QE9JVP
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=eoFdJ2KaRQGFVWfHKxdCGQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 28e1e7d28d06b07ec669bc9e43057b8e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8E81
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEVMVEw4NjMtVS1JRDlV

170 B
188 B

29ms
27ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEVMVEw4NjMtVS1JRDlV

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-213-116-14.eu-west-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEVMVEw4NjMtVS1JRDlV
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C0F9 0
20 B 115ms
114ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6265661936854&version=m202301230201&ct=76&x=1&cor=10488911842324677000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e3f8de8b4aed2ce19843ae83a0c5106f.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 293A
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y_u7YDgrtmXBNyQLxbcLFgAADNUAAAAB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y_u7YDgrtmXBNyQLxbcLFgAADNUAAAAB&dcc=t

43 B
855 B

113ms
112ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y_u7YDgrtmXBNyQLxbcLFgAADNUAAAAB&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Famdm.ru%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:51 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: XBK4BDZK8XGGAKH6JYTV
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:51 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 4G50PQHYN262AW0XSTWK
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y_u7YDgrtmXBNyQLxbcLFgAADNUAAAAB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 293A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Y_u7YDgrtmXBNyQLxbcLFgAADNUAAAAB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEFAW8xV1GP8sOlebe4ZzA1o&google_cver=1

43 B
335 B

33ms
32ms

Image
image/gif

104.18.25.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEFAW8xV1GP8sOlebe4ZzA1o&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Famdm.ru%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Server: 104.18.25.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:51 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IwMLCXSmce7mL35olKaSSZurZF1ZItRBhlRMoEmHRPkuG5F%2FWve%2FZYINCSeHA3X1k4cQ86WUTmj1OsOaerQzj1aoEKFM3aC%2B31Fs7VnYvrc99hBSDhN0XRP3UoGb66f0oeKfJ5oc1eSr4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 79fb4acb9d4a5c32-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 26 Feb 2023 20:04:51 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEFAW8xV1GP8sOlebe4ZzA1o&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame 293A 70 B
264 B 52ms
37ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Famdm.ru%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sun, 26 Feb 2023 20:04:51 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 Y_u7YDgrtmXBNyQLxbcLFgAADNUAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 293A 43 B
601 B 35ms
33ms Image
image/gif 2a05:d018:d29:3605:8485:2ae1:3dca:6549
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/Y_u7YDgrtmXBNyQLxbcLFgAADNUAAAAB?gdpr_consent=&us_privacy=&gdpr=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Famdm.ru%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3605:8485:2ae1:3dca:6549 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:51 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

Y_u7YDgrtmXBNyQLxbcLFgAADNUAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 293A
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=Y_u7YDgrtmXBNyQLxbcLFgAADNUAAAAB&gdpr_consent=&us_privacy=&gdpr=
https://pr-bh.ybp.yahoo.com/sync/casale/Y_u7YDgrtmXBNyQLxbcLFgAADNUAAAAB

43 B
601 B

35ms
35ms

Image
image/gif

2a05:d018:d29:3605:8485:2ae1:3dca:6549
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/Y_u7YDgrtmXBNyQLxbcLFgAADNUAAAAB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Famdm.ru%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

Server

2a05:d018:d29:3605:8485:2ae1:3dca:6549 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:51 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/Y_u7YDgrtmXBNyQLxbcLFgAADNUAAAAB
date: Sun, 26 Feb 2023 20:04:51 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK ie
match.prod.bidr.io/cookie-sync/ Frame 293A 43 B
433 B 140ms
29ms Image
image/gif 52.213.116.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/ie

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Famdm.ru%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.213.116.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:51 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 293A
Redirect Chain

https://s.company-target.com/s/ix?cm_dsp_id=18&us_privacy=&gdpr=&gdpr_consent=
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1693080291&external_user_id=09674489-eb04-4fd6-9e19-1a9d26fbc77e

43 B
632 B

23ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1693080291&external_user_id=09674489-eb04-4fd6-9e19-1a9d26fbc77e
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Famdm.ru%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:51 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

date: Sun, 26 Feb 2023 20:04:51 GMT
via: 1.1 google
access-control-allow-methods: GET,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: *.casalemedia.com
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1693080291&external_user_id=09674489-eb04-4fd6-9e19-1a9d26fbc77e
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 157

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 293A
Redirect Chain

https://sync.taboola.com/sg/indexscod/1/cm/?us_privacy=&gdpr=&gdpr_consent=&id=Y-u7YDgrtmXBNyQLxbcLFgAA%263285
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=c95f84d1-379c-4747-84a3-226cad0a9d0a-tuctaf540e3

43 B
632 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=c95f84d1-379c-4747-84a3-226cad0a9d0a-tuctaf540e3
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Famdm.ru%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 26 Feb 2023 20:04:51 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=c95f84d1-379c-4747-84a3-226cad0a9d0a-tuctaf540e3
date: Sun, 26 Feb 2023 20:04:51 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 13411

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame 293A 43 B
353 B 54ms
13ms Image
image/gif 104.18.11.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?Y-u7YDgrtmXBNyQLxbcLFgAA%263285
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Famdm.ru%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.11.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 20:04:51 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 75035
etag: "da1f1d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 79fb4acbbe9f37f5-FRA
content-length: 43
expires: Mon, 27 Feb 2023 20:04:51 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 39D2 0
863 B 14ms
14ms Script
text/html 185.89.210.141
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS