www.qe2.com Open in urlscan Pro
172.104.158.251 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.qe2.com/
Effective URL:
https://www.qe2.com/en/
Submission: On October 05 via api (October 5th 2023, 10:41:53 am UTC) from AE — Scanned from DE

Summary HTTP 118 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 53 IPs in 9 countries across 61 domains to perform 118 HTTP transactions. The main IP is 172.104.158.251, located in Frankfurt am Main, Germany and belongs to AKAMAI-LINODE-AP Akamai Connected Cloud, SG. The main domain is www.qe2.com.
TLS certificate: Issued by R3 on September 28th 2023. Valid for: 3 months.

This is the only time www.qe2.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 4	172.104.158.251 172.104.158.251	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
30	2600:9000:223... 2600:9000:223e:1800:2:3039:ce40:21	16509 (AMAZON-02) (AMAZON-02)
3	23.206.209.57 23.206.209.57	16625 (AKAMAI-AS) (AKAMAI-AS)
1 3	151.101.66.83 151.101.66.83	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f08... 2a03:2880:f083:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
4	35.244.188.9 35.244.188.9	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:400c:c04::9d	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
5	107.178.244.119 107.178.244.119	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f17... 2a03:2880:f177:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	37.157.6.234 37.157.6.234	198622 (ADFORM) (ADFORM)
2 2	142.250.185.166 142.250.185.166	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:81c::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
6 9	185.89.210.82 185.89.210.82	29990 (ASN-APPNEX) (ASN-APPNEX)
8 8	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:80e::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
3	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
4 16	37.157.4.29 37.157.4.29	198622 (ADFORM) (ADFORM)
1	185.167.164.39 185.167.164.39	198622 (ADFORM) (ADFORM)
1	37.157.6.243 37.157.6.243	198622 (ADFORM) (ADFORM)
1	34.249.150.14 34.249.150.14	16509 (AMAZON-02) (AMAZON-02)
1	23.35.237.75 23.35.237.75	16625 (AKAMAI-AS) (AKAMAI-AS)
1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	35.157.26.234 35.157.26.234	16509 (AMAZON-02) (AMAZON-02)
1	185.86.139.101 185.86.139.101	201081 (SMARTADSE...) (SMARTADSERVER)
1	3.71.149.231 3.71.149.231	16509 (AMAZON-02) (AMAZON-02)
1	2.21.20.202 2.21.20.202	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	3.121.134.250 3.121.134.250	16509 (AMAZON-02) (AMAZON-02)
1 2	104.18.26.193 104.18.26.193	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6 7	77.243.51.121 77.243.51.121	42697 (NETIC-AS) (NETIC-AS)
2 2	85.114.159.93 85.114.159.93	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
1	52.57.150.20 52.57.150.20	16509 (AMAZON-02) (AMAZON-02)
2 2	34.254.143.3 34.254.143.3	16509 (AMAZON-02) (AMAZON-02)
1	2a02:6ea0:c70... 2a02:6ea0:c700::11	60068 (CDN77 ^_^) (CDN77 ^_^)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1 2	52.31.175.73 52.31.175.73	16509 (AMAZON-02) (AMAZON-02)
2	69.192.160.219 69.192.160.219	16625 (AKAMAI-AS) (AKAMAI-AS)
1	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	34.246.44.190 34.246.44.190	16509 (AMAZON-02) (AMAZON-02)
1	52.218.36.234 52.218.36.234	16509 (AMAZON-02) (AMAZON-02)
2 2	51.222.80.231 51.222.80.231	16276 (OVH) (OVH)
4 5	62.141.38.122 62.141.38.122	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
1 1	193.135.9.129 193.135.9.129	48314 (IP-PROJECTS) (IP-PROJECTS)
1 1	139.162.147.24 139.162.147.24	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
1	79.125.32.89 79.125.32.89	16509 (AMAZON-02) (AMAZON-02)
1	198.47.127.205 198.47.127.205	3257 (GTT-BACKB...) (GTT-BACKBONE GTT)
1	65.9.66.72 65.9.66.72	16509 (AMAZON-02) (AMAZON-02)
2 3	52.203.124.67 52.203.124.67	14618 (AMAZON-AES) (AMAZON-AES)
2 2	34.254.109.178 34.254.109.178	16509 (AMAZON-02) (AMAZON-02)
1 1	108.129.25.174 108.129.25.174	16509 (AMAZON-02) (AMAZON-02)
1	95.101.148.198 95.101.148.198	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	3.73.105.217 3.73.105.217	16509 (AMAZON-02) (AMAZON-02)
1	69.169.86.38 69.169.86.38	29838 (AMC) (AMC)
1	141.95.98.65 141.95.98.65	16276 (OVH) (OVH)
2 2	35.190.24.218 35.190.24.218	15169 (GOOGLE) (GOOGLE)
1	104.75.89.75 104.75.89.75	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:9000:211... 2600:9000:211e:ea00:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
2 2	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	46.19.11.36 46.19.11.36	51790 (SIEL) (SIEL)
1	13.248.245.213 13.248.245.213	16509 (AMAZON-02) (AMAZON-02)
1	3.126.31.96 3.126.31.96	16509 (AMAZON-02) (AMAZON-02)
118	53

4 172.104.158.251 (Frankfurt am Main, Germany) 2 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: qe2.cloud.bluebeetle.me

www.qe2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 2600:9000:223e:1800:2:3039:ce40:21 (United States)

ASN16509 (AMAZON-02, US)

d1zdqtt14m14p.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.206.209.57 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-206-209-57.deploy.static.akamaitechnologies.com

www.tripadvisor.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.66.83 (United States) 1 redirects

ASN54113 (FASTLY, US)

www.jscache.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.tacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.244.188.9 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 9.188.244.35.bc.googleusercontent.com

static.sojern.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400c:c04::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 107.178.244.119 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 119.244.178.107.bc.googleusercontent.com

beacon.sojern.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.sojern.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f177:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.6.234 (Denmark)

ASN198622 (ADFORM, DK)

s2.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.166 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 185.89.210.82 (Frankfurt am Main, Germany) 6 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.250.184.194 (United States) 8 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

fcmatch.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fcmatch.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 37.157.4.29 (Denmark) 4 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dmp.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.167.164.39 (Denmark)

ASN198622 (ADFORM, DK)

a2.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.6.243 (Denmark)

ASN198622 (ADFORM, DK)

a1.seadform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.249.150.14 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-150-14.eu-west-1.compute.amazonaws.com

ad.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.35.237.75 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-237-75.deploy.static.akamaitechnologies.com

ad.yieldlab.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.157.26.234 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-26-234.eu-central-1.compute.amazonaws.com

ih.adscale.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.139.101 (France)

ASN201081 (SMARTADSERVER, FR)

rtb-csync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.71.149.231 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.21.20.202 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-21-20-202.deploy.static.akamaitechnologies.com

ads.stickyadstv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.121.134.250 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-121-134-250.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.26.193 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 77.243.51.121 (Denmark) 6 redirects

ASN42697 (NETIC-AS, DK)

uipglob.semasio.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
se.semasio.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 85.114.159.93 (Weil am Rhein, Germany) 2 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com

dsp.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.57.150.20 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-150-20.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.254.143.3 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-254-143-3.eu-west-1.compute.amazonaws.com

loadm.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6ea0:c700::11 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)

load77.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.31.175.73 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-31-175-73.eu-west-1.compute.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.192.160.219 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-160-219.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.246.44.190 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-246-44-190.eu-west-1.compute.amazonaws.com

api.adrtx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.218.36.234 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: s3-eu-west-1.amazonaws.com

s3-eu-west-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.222.80.231 (Canada) 2 redirects

ASN16276 (OVH, FR)
PTR: pikafka-us-1.cloudy.ovh

pixel.onaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 62.141.38.122 (Germany) 4 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: cm44.as.net

cm.adsafety.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.135.9.129 (Germany) 1 redirects

ASN48314 (IP-PROJECTS, DE)

ads.smartstream.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.162.147.24 (Frankfurt am Main, Germany) 1 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: tags2.adsafety.net

tags.adsafety.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 79.125.32.89 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-79-125-32-89.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.47.127.205 (United States)

ASN3257 (GTT-BACKBONE GTT, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.66.72 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-72.fra56.r.cloudfront.net

pdw-adf.userreport.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.203.124.67 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-203-124-67.compute-1.amazonaws.com

a.audrte.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.254.109.178 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-254-109-178.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.129.25.174 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-108-129-25-174.eu-west-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.101.148.198 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a95-101-148-198.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.73.105.217 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-73-105-217.eu-central-1.compute.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.169.86.38 (United States)

ASN29838 (AMC, US)

global.ib-ibi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.98.65 (France)

ASN16276 (OVH, FR)
PTR: ns3216659.ip-141-95-98.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.24.218 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 218.24.190.35.bc.googleusercontent.com

redirect.frontend.weborama.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.75.89.75 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-89-75.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:211e:ea00:1b:5138:8a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.113.62 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.19.11.36 (Slovenia)

ASN51790 (SIEL, SI)
PTR: ilog.vsn.si

match.contentexchange.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.248.245.213 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.126.31.96 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-31-96.eu-central-1.compute.amazonaws.com

e1.emxdgt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	cloudfront.net d1zdqtt14m14p.cloudfront.net	618 KB
18	adform.net 4 redirects s2.adform.net — Cisco Umbrella Rank: 7290 c1.adform.net — Cisco Umbrella Rank: 643 a2.adform.net — Cisco Umbrella Rank: 10839 dmp.adform.net — Cisco Umbrella Rank: 3616	43 KB
13	doubleclick.net 10 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 98 ad.doubleclick.net — Cisco Umbrella Rank: 173 cm.g.doubleclick.net — Cisco Umbrella Rank: 255	4 KB
9	adnxs.com 6 redirects secure.adnxs.com — Cisco Umbrella Rank: 542 ib.adnxs.com — Cisco Umbrella Rank: 261	7 KB
9	sojern.com static.sojern.com — Cisco Umbrella Rank: 15161 beacon.sojern.com — Cisco Umbrella Rank: 6176 pixel.sojern.com — Cisco Umbrella Rank: 8495	39 KB
7	semasio.net 6 redirects uipglob.semasio.net — Cisco Umbrella Rank: 1270 se.semasio.net — Cisco Umbrella Rank: 22364	4 KB
6	adsafety.net 5 redirects cm.adsafety.net — Cisco Umbrella Rank: 21747 tags.adsafety.net — Cisco Umbrella Rank: 91058	10 KB
4	google.com 2 redirects region1.analytics.google.com — Cisco Umbrella Rank: 2714 adservice.google.com — Cisco Umbrella Rank: 118 fcmatch.google.com — Cisco Umbrella Rank: 4031	2 KB
4	qe2.com 2 redirects www.qe2.com	53 KB
3	audrte.com 2 redirects a.audrte.com — Cisco Umbrella Rank: 2979	2 KB
3	exelator.com 2 redirects loadm.exelator.com — Cisco Umbrella Rank: 2048 load77.exelator.com — Cisco Umbrella Rank: 3804	2 KB
3	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 402	445 B
3	google.de www.google.de — Cisco Umbrella Rank: 6147 adservice.google.de — Cisco Umbrella Rank: 13042	991 B
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 56	254 KB
3	tripadvisor.com www.tripadvisor.com — Cisco Umbrella Rank: 9950	11 KB
2	tapad.com 2 redirects pixel.tapad.com — Cisco Umbrella Rank: 521	1 KB
2	weborama.fr 2 redirects redirect.frontend.weborama.fr — Cisco Umbrella Rank: 14143	631 B
2	w55c.net 2 redirects pm.w55c.net — Cisco Umbrella Rank: 1069	1 KB
2	demdex.net 2 redirects dpm.demdex.net — Cisco Umbrella Rank: 242	2 KB
2	onaudience.com 2 redirects pixel.onaudience.com — Cisco Umbrella Rank: 3315	968 B
2	bluekai.com tags.bluekai.com — Cisco Umbrella Rank: 734	648 B
2	crwdcntrl.net 1 redirects sync.crwdcntrl.net — Cisco Umbrella Rank: 1011	483 B
2	adition.com 2 redirects dsp.adfarm1.adition.com — Cisco Umbrella Rank: 1617	928 B
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 716	1 KB
2	adscale.de 2 redirects ih.adscale.de — Cisco Umbrella Rank: 3185	690 B
2	tacdn.com static.tacdn.com — Cisco Umbrella Rank: 11761	11 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 187	87 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 42	21 KB
1	emxdgt.com e1.emxdgt.com — Cisco Umbrella Rank: 2433	44 B
1	3lift.com eb2.3lift.com — Cisco Umbrella Rank: 434	140 B
1	contentexchange.me match.contentexchange.me — Cisco Umbrella Rank: 29639	49 B
1	smaato.net s.ad.smaato.net — Cisco Umbrella Rank: 893	236 B
1	teads.tv sync.teads.tv — Cisco Umbrella Rank: 1584	163 B
1	id5-sync.com id5-sync.com — Cisco Umbrella Rank: 470	921 B
1	ib-ibi.com global.ib-ibi.com — Cisco Umbrella Rank: 2273	72 B
1	mathtag.com pixel.mathtag.com — Cisco Umbrella Rank: 2109	418 B
1	agkn.com 1 redirects aa.agkn.com — Cisco Umbrella Rank: 587	491 B
1	userreport.com pdw-adf.userreport.com — Cisco Umbrella Rank: 27221	444 B
1	pubmatic.com simage2.pubmatic.com — Cisco Umbrella Rank: 959	472 B
1	krxd.net beacon.krxd.net — Cisco Umbrella Rank: 903	337 B
1	smartstream.tv 1 redirects ads.smartstream.tv — Cisco Umbrella Rank: 28871	849 B
1	amazonaws.com s3-eu-west-1.amazonaws.com	390 B
1	adrtx.net 1 redirects api.adrtx.net — Cisco Umbrella Rank: 32266	407 B
1	openx.net eu-u.openx.net — Cisco Umbrella Rank: 2959	264 B
1	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 445	98 B
1	eyeota.net ps.eyeota.net — Cisco Umbrella Rank: 1189	344 B
1	bidswitch.net x.bidswitch.net — Cisco Umbrella Rank: 387	146 B
1	stickyadstv.com ads.stickyadstv.com — Cisco Umbrella Rank: 620	684 B
1	yahoo.com ups.analytics.yahoo.com — Cisco Umbrella Rank: 363	125 B
1	smartadserver.com rtb-csync.smartadserver.com — Cisco Umbrella Rank: 898	114 B
1	rubiconproject.com token.rubiconproject.com — Cisco Umbrella Rank: 504	214 B
1	yieldlab.net ad.yieldlab.net — Cisco Umbrella Rank: 4701	400 B
1	360yield.com ad.360yield.com — Cisco Umbrella Rank: 761	199 B
1	seadform.net a1.seadform.net — Cisco Umbrella Rank: 25365	467 B
1	youtube.com fcmatch.youtube.com — Cisco Umbrella Rank: 4036	432 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 116	185 B
1	gstatic.com fonts.gstatic.com	22 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 49	882 B
1	jscache.com 1 redirects www.jscache.com — Cisco Umbrella Rank: 18057	861 B
0	e-volution.ai Failed sync.e-volution.ai Failed
0	1dmp.io Failed sync.1dmp.io Failed
118	61

	Domain	Requested by
30	d1zdqtt14m14p.cloudfront.net	www.qe2.com d1zdqtt14m14p.cloudfront.net
13	c1.adform.net	4 redirects a2.adform.net c1.adform.net
8	cm.g.doubleclick.net	8 redirects
6	secure.adnxs.com	3 redirects static.sojern.com c1.adform.net
5	cm.adsafety.net	4 redirects c1.adform.net
4	se.semasio.net	3 redirects c1.adform.net
4	pixel.sojern.com	static.sojern.com c1.adform.net
4	static.sojern.com	www.googletagmanager.com www.qe2.com static.sojern.com
4	www.qe2.com	2 redirects www.qe2.com
3	dmp.adform.net	c1.adform.net
3	a.audrte.com	2 redirects c1.adform.net
3	uipglob.semasio.net	3 redirects
3	match.adsrvr.org	static.sojern.com c1.adform.net
3	ib.adnxs.com	3 redirects
3	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
3	www.googletagmanager.com	www.qe2.com www.googletagmanager.com www.google-analytics.com
3	www.tripadvisor.com	www.qe2.com www.jscache.com
2	pixel.tapad.com	2 redirects
2	redirect.frontend.weborama.fr	2 redirects
2	pm.w55c.net	2 redirects
2	dpm.demdex.net	2 redirects
2	pixel.onaudience.com	2 redirects
2	tags.bluekai.com	c1.adform.net
2	sync.crwdcntrl.net	1 redirects c1.adform.net
2	loadm.exelator.com	2 redirects
2	dsp.adfarm1.adition.com	2 redirects
2	dsum-sec.casalemedia.com	1 redirects c1.adform.net
2	ih.adscale.de	2 redirects
2	static.tacdn.com	www.tripadvisor.com
2	ad.doubleclick.net	2 redirects
2	www.google.de	www.qe2.com
2	region1.analytics.google.com	www.googletagmanager.com
2	connect.facebook.net	www.qe2.com connect.facebook.net
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	e1.emxdgt.com	c1.adform.net
1	eb2.3lift.com	c1.adform.net
1	match.contentexchange.me	c1.adform.net
1	s.ad.smaato.net	c1.adform.net
1	sync.teads.tv	c1.adform.net
1	id5-sync.com	c1.adform.net
1	global.ib-ibi.com	c1.adform.net
1	pixel.mathtag.com	c1.adform.net
1	aa.agkn.com	1 redirects
1	pdw-adf.userreport.com	c1.adform.net
1	simage2.pubmatic.com	c1.adform.net
1	beacon.krxd.net	c1.adform.net
1	tags.adsafety.net	1 redirects
1	ads.smartstream.tv	1 redirects
1	s3-eu-west-1.amazonaws.com	c1.adform.net
1	api.adrtx.net	1 redirects
1	eu-u.openx.net	c1.adform.net
1	idsync.rlcdn.com	c1.adform.net
1	load77.exelator.com	c1.adform.net
1	ps.eyeota.net	c1.adform.net
1	x.bidswitch.net	c1.adform.net
1	ads.stickyadstv.com	c1.adform.net
1	ups.analytics.yahoo.com	c1.adform.net
1	rtb-csync.smartadserver.com	c1.adform.net
1	token.rubiconproject.com	c1.adform.net
1	ad.yieldlab.net	c1.adform.net
1	ad.360yield.com	c1.adform.net
1	a1.seadform.net	static.sojern.com
1	a2.adform.net	s2.adform.net
1	fcmatch.youtube.com	static.sojern.com
1	fcmatch.google.com	1 redirects
1	adservice.google.de	static.sojern.com
1	adservice.google.com	1 redirects
1	s2.adform.net	beacon.sojern.com
1	www.facebook.com	www.qe2.com
1	beacon.sojern.com	static.sojern.com
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	d1zdqtt14m14p.cloudfront.net
1	www.jscache.com	1 redirects
0	sync.e-volution.ai Failed	c1.adform.net
0	sync.1dmp.io Failed	c1.adform.net
118	75

This site contains links to these domains. Also see Links.

Domain
www.tripadvisor.com
d1zdqtt14m14p.cloudfront.net
g.page
goo.gl
www.instagram.com
careers.accor.com
www.facebook.com
www.linkedin.com
www.bluebeetle.ae

Subject Issuer	Validity	Valid
qe2.com R3	`2023-09-28` - `2023-12-27`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2022-12-08` - `2023-12-07`	a year	crt.sh
www.tripadvisor.com GlobalSign RSA OV SSL CA 2018	`2023-05-22` - `2024-06-19`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-07-14` - `2023-10-12`	3 months	crt.sh
*.sojern.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-17` - `2024-02-17`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
track.adform.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-06` - `2024-09-19`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
static.tacdn.com GlobalSign RSA OV SSL CA 2018	`2023-02-22` - `2024-03-19`	a year	crt.sh
*.seadform.net DigiCert TLS RSA SHA256 2020 CA1	`2022-10-20` - `2023-11-09`	a year	crt.sh
*.360yield.com Amazon RSA 2048 M01	`2023-05-29` - `2024-06-26`	a year	crt.sh
*.yieldlab.net DigiCert TLS RSA SHA256 2020 CA1	`2023-09-17` - `2024-09-17`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-05` - `2024-04-03`	a year	crt.sh
*.smartadserver.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-21` - `2024-01-23`	a year	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-08-03` - `2024-01-24`	6 months	crt.sh
*.ads.stickyadstv.com DigiCert TLS RSA SHA256 2020 CA1	`2023-04-16` - `2024-04-16`	a year	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2023-03-23` - `2024-03-23`	a year	crt.sh
eyeota.net GoGetSSL RSA DV CA	`2023-03-08` - `2024-04-07`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2023-02-02` - `2024-03-03`	a year	crt.sh
*.crwdcntrl.net Amazon RSA 2048 M01	`2022-11-07` - `2023-12-06`	a year	crt.sh
odc-pixel-prod-01.oracle.com DigiCert TLS RSA SHA256 2020 CA1	`2023-02-07` - `2024-02-08`	a year	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2023-08-18` - `2024-08-18`	a year	crt.sh
beacon.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2023-04-14` - `2024-04-12`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2023-04-20` - `2024-05-20`	a year	crt.sh
*.userreport.com Amazon RSA 2048 M02	`2023-02-22` - `2024-01-18`	a year	crt.sh
pixel.mathtag.com DigiCert TLS RSA SHA256 2020 CA1	`2023-05-07` - `2024-05-07`	a year	crt.sh
*.ib-ibi.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-03-21` - `2024-04-02`	a year	crt.sh
*.id5-sync.com R3	`2023-09-01` - `2023-11-30`	3 months	crt.sh
teads.tv R3	`2023-10-04` - `2024-01-02`	3 months	crt.sh
s.ad.smaato.net Amazon RSA 2048 M03	`2023-09-04` - `2024-10-02`	a year	crt.sh
*.contentexchange.me Sectigo RSA Domain Validation Secure Server CA	`2023-05-29` - `2024-06-04`	a year	crt.sh
*.3lift.com Amazon RSA 2048 M02	`2023-04-13` - `2024-05-11`	a year	crt.sh
*.emxdgt.com Amazon RSA 2048 M01	`2023-05-03` - `2024-05-31`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://www.qe2.com/en/
Frame ID: D56D8902CD1F06BA3BE4FFA14062631C
Requests: 56 HTTP requests in this frame

Frame: https://static.sojern.com/cip/c/43.html?f_v=cp_v3_js&p_v=1&version=3&auto_url=https%3A%2F%2Fwww.qe2.com%2Fen%2F&auto_ccid=q3ilu-yx3cu-d4a8z-9dtrz-u6puf&auto_ga=142618060.1696502507&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&auto_eml_list=&ws=1600x1200&tz=-120&hpid=112535&pt=HOME_PAGE&et=
Frame ID: 9B79089423BFB4594F9B42CAF66A93EB
Requests: 15 HTTP requests in this frame

Frame: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Frame ID: 905124EBC60E996977121862ADAED3B7
Requests: 48 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Queen Elizabeth 2 | Luxury 13-Deck Floating Hotel, Dubai

Page URL History Show full URLs

http://www.qe2.com/ HTTP 301
https://www.qe2.com/ HTTP 301
https://www.qe2.com/en/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Tripadviser.Widget (Widgets) Expand

Overall confidence: 100%
Detected patterns

tripadvisor\.[\w]+/WidgetEmbed

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

118
Requests

78 %
HTTPS

24 %
IPv6

61
Domains

75
Subdomains

53
IPs

9
Countries

1173 kB
Transfer

2658 kB
Size

69
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://www.tripadvisor.com/Hotel_Review-g295424-d14077573-Reviews-Queen_Elizabeth_2-Dubai_Emirate_of_Dubai.html

Search URL Search Domain Scan URL

URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/uploads/2023/07/QE2-Hotel-Brochure-2023.pdf
Title: Download Hotel Brochure

Search URL Search Domain Scan URL

URL: https://g.page/qe2dubai?share
Title: Get Directions

Search URL Search Domain Scan URL

URL: https://goo.gl/maps/CSAh6YFysNJ8u5sp7
Title: Dubai International Airport 18min

Search URL Search Domain Scan URL

URL: https://goo.gl/maps/uTxWnJPP88RAxb1J8
Title: Palm Jumeirah 25min

Search URL Search Domain Scan URL

URL: https://goo.gl/maps/TW7NP1Bcbpe7j6Kj8
Title: Dubai Mall 15min

Search URL Search Domain Scan URL

URL: https://goo.gl/maps/Qj3MRhVJFbgFAMBS7
Title: Mall of Emirates 25min

Search URL Search Domain Scan URL

URL: https://goo.gl/maps/p2avTVKWZBnrJDHR6
Title: Burj Al Arab 20min

Search URL Search Domain Scan URL

URL: https://goo.gl/maps/gT6BDc3otSGRsnca9
Title: Burj Khalifa 15min

Search URL Search Domain Scan URL

URL: https://www.instagram.com/qe2dubai
Title: Share your memories with @qe2dubai

Search URL Search Domain Scan URL

URL: https://careers.accor.com/global/en
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.facebook.com/qe2dubai/

Search URL Search Domain Scan URL

URL: https://www.instagram.com/qe2dubai/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/qe2dubai

Search URL Search Domain Scan URL

URL: https://www.bluebeetle.ae/
Title: Blue Beetle

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.qe2.com/ HTTP 301
https://www.qe2.com/ HTTP 301
https://www.qe2.com/en/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

https://www.jscache.com/wejs?wtype=selfserveprop&uniq=753&locationId=14077573&lang=en_US&rating=true&nreviews=5&writereviewlink=true&popIdx=false&iswide=false&border=true&display_version=2 HTTP 301
https://www.tripadvisor.com/wejs?wtype=selfserveprop&uniq=753&locationId=14077573&lang=en_US&rating=true&nreviews=5&writereviewlink=true&popIdx=false&iswide=false&border=true&display_version=2

Request Chain 51

https://ad.doubleclick.net/ddm/activity/src=12373456;type=homep0;cat=mgall0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v3_js%257Cp_v%253D1%257Cversion%253D3%257Cauto_url%253Dhttps%25253A%25252F%25252Fwww.qe2.com%25252Fen%25252F%257Cauto_ccid%253Dq3ilu-yx3cu-d4a8z-9dtrz-u6puf%257Cauto_ga%253D142618060.1696502507%257Cauto_eml_count%253D0%257Cws%253D1600x1200%257Ctz%253D-120%257Chpid%253D112535%257Cpt%253DHOME_PAGE%257Cet%253D;u2=;u3=;u4=;u5=;u9=;u10=;u11=;u12=;u13=;u14=;u15=;u16=;u19=112535;u20=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=orderID HTTP 302
https://ad.doubleclick.net/ddm/activity/src=12373456;dc_pre=CMKXzqrc3oEDFc8PogMd_IAItQ;type=homep0;cat=mgall0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v3_js%257Cp_v%253D1%257Cversion%253D3%257Cauto_url%253Dhttps%25253A%25252F%25252Fwww.qe2.com%25252Fen%25252F%257Cauto_ccid%253Dq3ilu-yx3cu-d4a8z-9dtrz-u6puf%257Cauto_ga%253D142618060.1696502507%257Cauto_eml_count%253D0%257Cws%253D1600x1200%257Ctz%253D-120%257Chpid%253D112535%257Cpt%253DHOME_PAGE%257Cet%253D;u2=;u3=;u4=;u5=;u9=;u10=;u11=;u12=;u13=;u14=;u15=;u16=;u19=112535;u20=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=orderID HTTP 302
https://adservice.google.com/ddm/fls/p/src=12373456;dc_pre=CMKXzqrc3oEDFc8PogMd_IAItQ;type=homep0;cat=mgall0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v3_js%257Cp_v%253D1%257Cversion%253D3%257Cauto_url%253Dhttps%25253A%25252F%25252Fwww.qe2.com%25252Fen%25252F%257Cauto_ccid%253Dq3ilu-yx3cu-d4a8z-9dtrz-u6puf%257Cauto_ga%253D142618060.1696502507%257Cauto_eml_count%253D0%257Cws%253D1600x1200%257Ctz%253D-120%257Chpid%253D112535%257Cpt%253DHOME_PAGE%257Cet%253D;u2=;u3=;u4=;u5=;u9=;u10=;u11=;u12=;u13=;u14=;u15=;u16=;u19=112535;u20=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=orderID;~oref=https://static.sojern.com/ HTTP 302
https://adservice.google.de/ddm/fls/p/src=12373456;dc_pre=CMKXzqrc3oEDFc8PogMd_IAItQ;type=homep0;cat=mgall0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v3_js%257Cp_v%253D1%257Cversion%253D3%257Cauto_url%253Dhttps%25253A%25252F%25252Fwww.qe2.com%25252Fen%25252F%257Cauto_ccid%253Dq3ilu-yx3cu-d4a8z-9dtrz-u6puf%257Cauto_ga%253D142618060.1696502507%257Cauto_eml_count%253D0%257Cws%253D1600x1200%257Ctz%253D-120%257Chpid%253D112535%257Cpt%253DHOME_PAGE%257Cet%253D;u2=;u3=;u4=;u5=;u9=;u10=;u11=;u12=;u13=;u14=;u15=;u16=;u19=112535;u20=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=orderID;~oref=https://static.sojern.com/

Request Chain 52

https://secure.adnxs.com/px?id=1644722&t=1 HTTP 307
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1644722%26t%3D1

Request Chain 53

https://secure.adnxs.com/seg?add=32307654&t=1 HTTP 307
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D32307654%26t%3D1

Request Chain 54

https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=QkHq0UBzOeAno40QoHyEJw&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=bO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn9648wurI63YsR&sjrn_ula=7315437973 HTTP 302
https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=QkHq0UBzOeAno40QoHyEJw&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=bO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn9648wurI63YsR&sjrn_ula=7315437973&google_tc= HTTP 302
https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=bO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn9648wurI63YsR&sjrn_ula=7315437973&google_gid=CAESEESlnSORD3Zf_CXHel8fIyU&google_cver=1

Request Chain 55

https://cm.g.doubleclick.net/pixel?google_hm=QkHq0UBzOeAno40QoHyEJw&google_nid=sojern_adh HTTP 302
https://cm.g.doubleclick.net/pixel?google_hm=QkHq0UBzOeAno40QoHyEJw&google_nid=sojern_adh&google_tc= HTTP 302
https://fcmatch.google.com/pixel?google_gm=AMnCDopBda0uxipX7Am3Bms7Vq6wFuLv9MG7PC6CLyprC3_3-7siXSTDWGlPreBQ0HDlwOWkDvpItY_TxBAmvpEo5BznjSaxox3sgJfBVy88rjwX5i_NGnE HTTP 302
https://fcmatch.youtube.com/pixel?google_gm=AMnCDopBda0uxipX7Am3Bms7Vq6wFuLv9MG7PC6CLyprC3_3-7siXSTDWGlPreBQ0HDlwOWkDvpItY_TxBAmvpEo5BznjSaxox3sgJfBVy88rjwX5i_NGnE

Request Chain 56

https://ib.adnxs.com/getuid?https://pixel.sojern.com/idsync/apn?id=$UID&sjrn_id=bO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn9648wurI63YsR HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fpixel.sojern.com%2Fidsync%2Fapn%3Fid%3D%24UID%26sjrn_id%3DbO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn9648wurI63YsR HTTP 302
https://pixel.sojern.com/idsync/apn?id=2972291638147184319&sjrn_id=bO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn9648wurI63YsR

Request Chain 58

https://c1.adform.net/serving/cookie/match?cid=4241ead1-4073-39e0-27a3-8d10a07c8427&party=1296 HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&cid=4241ead1-4073-39e0-27a3-8d10a07c8427&party=1296 HTTP 302
https://pixel.sojern.com/idsync/adf?adfid=3949932466863171880&cid=4241ead1-4073-39e0-27a3-8d10a07c8427

Request Chain 72

https://ih.adscale.de/adscale-ih/tpui?tpid=42&tpuid=3949932466863171880&cburl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d9%26uid%3D__ADSCALE_USER_ID__ HTTP 302
https://ih.adscale.de/adscale-ih/tpui?tpid=42&tpuid=3949932466863171880&cburl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d9%26uid%3D__ADSCALE_USER_ID__&nut&uu=fa1ee5a55e2c4ac9854ed8d62320bf91 HTTP 307
https://c1.adform.net/serving/cookie/match?party=9&uid=b529c2f8ae09864bef1712ce6a2121cd572cd75157e9063025b25b5bca7cec22

Request Chain 77

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=3949932466863171880&expiration=1697712108 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=3949932466863171880&expiration=1697712108&C=1

Request Chain 78

https://uipglob.semasio.net/adform/1/info?sType=sync&sExtCookieId=3949932466863171880&sInitiator=external HTTP 302
https://uipglob.semasio.net/adform/1/info2?sType=sync&sExtCookieId=3949932466863171880&sInitiator=external HTTP 302
https://se.semasio.net/sync/1/16266044?sExtCookieId=3949932466863171880&gdpr=&sInitiator=external HTTP 302
https://dsp.adfarm1.adition.com/cookie/?redirect=https%3A%2F%2Fse.semasio.net%2Fsync%2F1%2F647471%3FsExtCookieId%3D%25%25COOKIE%25%25%26sInitiator%3Dinternal&gdpr= HTTP 302
https://se.semasio.net/sync/1/647471?sExtCookieId=7286422789456984203&sInitiator=internal&gdpr= HTTP 302
https://ib.adnxs.com/getuid?https%3A%2F%2Fse.semasio.net%2Fsync%2F1%2F4354957%3FsExtCookieId%3D%24UID%26sInitiator%3Dinternal&gdpr= HTTP 302
https://se.semasio.net/sync/1/4354957?sExtCookieId=2972291638147184319&sInitiator=internal&gdpr= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=semasio_ddp&google_cm&google_hm=QjQ3RTBEMUI0N0I4RkMzRQ&gdpr= HTTP 302
https://uipglob.semasio.net/dbm/1/info?sType=sync&sExtCookieId=CAESEDN-y-XeXqGQdNdrXY6dS_I&sInitiator=internal&google_cver=1&gdpr=&google_cver=1 HTTP 302
https://se.semasio.net/sync/1/12092831?sExtCookieId=CAESEDN-y-XeXqGQdNdrXY6dS_I&sInitiator=internal&google_cver=1&gdpr=

Request Chain 80

https://loadm.exelator.com/load/?p=204&g=710&j=0&buid=3949932466863171880 HTTP 302
https://loadm.exelator.com/load/?p=204&g=710&j=0&buid=3949932466863171880&xl8blockcheck=1 HTTP 302
https://load77.exelator.com/pixel.gif

Request Chain 85

https://api.adrtx.net/thirdparty/click?p=adfo HTTP 302
https://s3-eu-west-1.amazonaws.com/adality-cdn-content/pixel.gif

Request Chain 86

https://pixel.onaudience.com/?mapped=3949932466863171880&partner=68 HTTP 302
https://sync.crwdcntrl.net/map/c=8587/tp=CLOD/tpid=d9cb6615436a2baf/gdpr=1/gdpr_consent=?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%24%7Bgdpr%7D HTTP 302
https://pixel.onaudience.com/?partner=104&icm&cver&mapped=&gdpr=1 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=1

Request Chain 87

https://cm.adsafety.net/?_cmsrc=adformx&idt=100&did=3949932466863171880 HTTP 302
https://ads.smartstream.tv/cm/?cmsrc=cm&cm_uid=CM12023100510f642e7aa6085019cf02&redirect=https%3A%2F%2Fcm.adsafety.net%2F%3F_cmsrc%3Dstv%26_chainsrc%3Dcommon&gdpr_consent= HTTP 302
https://cm.adsafety.net/?_cmsrc=stv&_chainsrc=common&idt=100&did=ee91f040dea2de0ebee3fc1bfe904683&idt_did_status=added&gdpr_consent=&gdpr=0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=dataxtrade_dmp&google_cm&google_hm=Q00xMjAyMzEwMDUxMGY2NDJlN2FhNjA4NTAxOWNmMDI&gdpr_consent=&gdpr=0 HTTP 302
https://cm.adsafety.net/?_cmsrc=dbmx&midt=100&mdid=CAESEDPckxqGp3tUU22xgun4XTc&gdpr_consent=&gdpr=0&google_cver=1 HTTP 302
https://c1.adform.net/serving/cookie/match?party=28&cid=CM12023100510f642e7aa6085019cf02 HTTP 302
https://cm.adsafety.net/?_cmsrc=adform&idt=100&did=3949932466863171880 HTTP 302
https://tags.adsafety.net/v1/cm?cm_uid=CM12023100510f642e7aa6085019cf02&redirect=https%3A%2F%2Fcm.adsafety.net%2F%3F_cmsrc%3Dct%26_chainsrc%3Dcommon%26idt%3D%5B%25IDT%25%5D%26did%3D%5B%25DID%25%5D&gdpr=0&gdpr_consent= HTTP 302
https://cm.adsafety.net/?_cmsrc=ct&_chainsrc=common&idt=100&did=ee91f040dea2de0ebee3fc1bfe904683

Request Chain 89

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_cm&google_ula=1641347&party=1&google_hm=Mzk0OTkzMjQ2Njg2MzE3MTg4MA HTTP 302
https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMZemnbzG_2VYIHj4r3R-Xw&google_cver=1&google_ula=1641347,0

Request Chain 90

https://secure.adnxs.com/getuid?https://c1.adform.net/serving/cookie/match?party=3&id=$UID&redirect=1 HTTP 302
https://c1.adform.net/serving/cookie/match?party=3&id=2972291638147184319&redirect=1 HTTP 302
https://secure.adnxs.com/setuid?entity=91&code=3949932466863171880

Request Chain 94

https://a.audrte.com/a?adform_uid=3949932466863171880 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=OGY3VE5PVERuVW9ReGV2ZmJpdDdYUDNpUQ==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%253D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent= HTTP 302
https://a.audrte.com/p

Request Chain 95

https://dpm.demdex.net/ibs:dpid=1586&dpuuid=3949932466863171880&redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1007%26cid%3D%24%7BDD_UUID%7D%26noredirect%3D1 HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1586&dpuuid=3949932466863171880&redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1007%26cid%3D%24%7BDD_UUID%7D%26noredirect%3D1 HTTP 302
https://c1.adform.net/serving/cookie/match?party=1007&cid=45294225948898933542415791631936408863&noredirect=1

Request Chain 96

https://aa.agkn.com/adscores/g.pixel?sid=9212269628&_puid=3949932466863171880 HTTP 302
https://dmp.adform.net/serving/cookie/match/?party=1014&cid=219563204660001753379

Request Chain 97

https://dsp.adfarm1.adition.com/cookie/?redirect=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1049%26cid%3D%25%25COOKIE%25%25 HTTP 302
https://dmp.adform.net/serving/cookie/match/?party=1049&cid=7286422789458229408

Request Chain 100

https://pm.w55c.net/ping_match.gif?st=adform&rurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1084%26cid%3D_wfivefivec_ HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&st=adform&rurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1084%26cid%3D_wfivefivec_ HTTP 302
https://c1.adform.net/serving/cookie/match?party=1084&cid=Nl5HOzQ01QOlNG5

Request Chain 104

https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1145%26cid%3D%7BWEBO_CID%7D HTTP 307
https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1145%26cid%3D%7BWEBO_CID%7D&bounce=1&random=1354630342 HTTP 302
https://dmp.adform.net/serving/cookie/match/?party=1145&cid=EsgRSODA/BFeP5oX52xAye

Request Chain 108

https://pixel.tapad.com/idsync/ex/receive?partner_id=2032&partner_device_id=3949932466863171880&partner_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d2007%26cid%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2032&partner_device_id=3949932466863171880&partner_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d2007%26cid%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://c1.adform.net/serving/cookie/match?party=2007&cid=8c0eff85-c436-4de5-828a-7c8ec5e1c8b6

118 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.qe2.com/en/
Redirect Chain

http://www.qe2.com/
https://www.qe2.com/
https://www.qe2.com/en/

33 KB
8 KB

22ms
22ms

Document
text/html

172.104.158.251
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.104.158.251 Frankfurt am Main, Germany, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),

Reverse DNS

qe2.cloud.bluebeetle.me

Software

Apache /

Resource Hash

c8ad234dbf69dbbd0591529b69dcc2dd213b9c5765f5cd5c3bfe45437a7537d9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=600, private, must-revalidate
content-encoding: gzip
content-security-policy: frame-ancestors none;
content-type: text/html; charset=UTF-8
date: Thu, 05 Oct 2023 10:41:46 GMT
expires: Thu, 05 Oct 2023 10:41:46 GMT
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
referrer-policy: same-origin
server: Apache
strict-transport-security: max-age=63072000; includeSubdomains;
vary: User-Agent
x-cache-handler: cache-enabler-engine
x-content-type-options: nosniff
x-frame-options: sameorigin
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block

Redirect headers

cache-control: max-age=3600 max-age=600, private, must-revalidate
content-length: 0
content-security-policy: frame-ancestors none;
content-type: text/html; charset=UTF-8
date: Thu, 05 Oct 2023 10:41:46 GMT
expires: Thu, 05 Oct 2023 11:41:46 GMT
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
location: https://www.qe2.com/en/
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
pragma: no-cache
referrer-policy: same-origin
server: Apache
strict-transport-security: max-age=63072000; includeSubdomains;
vary: User-Agent
x-content-type-options: nosniff
x-frame-options: sameorigin
x-permitted-cross-domain-policies: none
x-redirect-by: WordPress
x-xss-protection: 1; mode=block

GET
H2 200 SangBleuSunrise-Regular.woff2
www.qe2.com/wp-content/themes/bbtheme/fonts/ 43 KB
44 KB 8ms
7ms Font
font/woff2 172.104.158.251
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.qe2.com/wp-content/themes/bbtheme/fonts/SangBleuSunrise-Regular.woff2

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.104.158.251 Frankfurt am Main, Germany, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),

Reverse DNS

qe2.cloud.bluebeetle.me

Software

Apache /

Resource Hash

e80d16372db62c37941adb80895949bce9106e87323f3bbb0cdc4465a63d2d53

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.qe2.com/en/
Origin: https://www.qe2.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:46 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
x-permitted-cross-domain-policies: none
content-length: 44120
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Sun, 06 Dec 2020 06:19:08 GMT
server: Apache
x-frame-options: sameorigin
vary: User-Agent
access-control-allow-methods: GET
access-control-allow-origin: *
content-type: font/woff2
cache-control: max-age=2592000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
expires: Sat, 04 Nov 2023 10:41:46 GMT

GET
H2 200 styles.css
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/ 121 KB
19 KB 84ms
23ms Stylesheet
text/css 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

0a1721a5d58454c9736542654e4bcaf7337a9772b5e9d6635c6f98a39d297f2f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubdomains;
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
date: Wed, 04 Oct 2023 06:48:12 GMT
x-amz-cf-pop: FRA56-P4
age: 100414
x-cache: Hit from cloudfront
content-length: 18838
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 19 Jul 2023 16:15:56 GMT
server: Apache
x-frame-options: sameorigin
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800, public
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: qrHokKnuC49FwBxEwnN4eCiEbQlFyGBlwekjmUd48TgZ10-5VRqkIQ==
expires: Fri, 03 Nov 2023 06:48:12 GMT

GET
H2 200 joinchat-btn.min.css
d1zdqtt14m14p.cloudfront.net/wp-content/plugins/creame-whatsapp-me/public/css/ 6 KB
3 KB 84ms
23ms Stylesheet
text/css 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/plugins/creame-whatsapp-me/public/css/joinchat-btn.min.css

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

79094ff19836671da581cd093530d058dff33873a169d49f4f99e157289fc420

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 17:34:09 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 407257
x-cache: Hit from cloudfront
content-length: 2141
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 28 Dec 2022 08:07:11 GMT
server: Apache
x-frame-options: sameorigin
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800, public
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
vary: Accept-Encoding
accept-ranges: bytes
x-amz-cf-id: rspHanHSpyyqMrS1kRqYojLXM9pWlTbuUeATfsCQ8sngwEa0F8-euw==
expires: Mon, 30 Oct 2023 17:34:09 GMT

GET
H2 200 jquery.min.js Show response
d1zdqtt14m14p.cloudfront.net/wp-includes/js/jquery/ 87 KB
31 KB 110ms
49ms Script
application/javascript 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-includes/js/jquery/jquery.min.js

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubdomains;
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
date: Thu, 05 Oct 2023 07:55:23 GMT
x-amz-cf-pop: FRA56-P4
age: 9983
x-cache: Hit from cloudfront
content-length: 30908
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 10 Aug 2021 11:44:33 GMT
server: Apache
x-frame-options: sameorigin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=216000, public
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: F8TnM2TBjqGOtbkige-7pqXpNBIkxkPm186cD_R-WUYG6IZHmgP2mQ==
expires: Sat, 04 Nov 2023 07:55:23 GMT

GET
H2 200 jquery-migrate.min.js Show response
d1zdqtt14m14p.cloudfront.net/wp-includes/js/jquery/ 11 KB
5 KB 85ms
24ms Script
application/javascript 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-includes/js/jquery/jquery-migrate.min.js

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 05:18:48 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 105778
x-cache: Hit from cloudfront
content-length: 4169
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Sun, 13 Dec 2020 05:16:49 GMT
server: Apache
x-frame-options: sameorigin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=216000, public
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
vary: Accept-Encoding
accept-ranges: bytes
x-amz-cf-id: 5-eQ7BiJzmV1i3i8Y1ybUHjQ1Y8-FAhLZzqGiEh0WL7ZUZF-I6kcYg==
expires: Fri, 03 Nov 2023 05:18:48 GMT

GET
H2 200 Tripadvisor_lockup_horizontal_secondary_registered-11900-2.svg
www.tripadvisor.com/img/cdsi/img2/branding/v2/ 5 KB
3 KB 359ms
264ms Image
image/svg+xml 23.206.209.57
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tripadvisor.com/img/cdsi/img2/branding/v2/Tripadvisor_lockup_horizontal_secondary_registered-11900-2.svg
Requested by: Host: www.qe2.com
URL: https://www.qe2.com/en/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.206.209.57 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-206-209-57.deploy.static.akamaitechnologies.com
Software: envoy /
Resource Hash: b148a123dd65aa6603102281e5203539c1e3ad6514e035a9fd4096e5779017d3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:47 GMT
content-encoding: br
server: envoy
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: private, max-age=43200
timing-allow-origin: https://www.tripadvisor.com
content-length: 2160
x-request-id: ec09b1d7-bf52-419d-a22c-dffd77056510
expires: Thu, 05 Oct 2023 22:41:47 GMT

GET
H2

200

wejs Show response
www.tripadvisor.com/
Redirect Chain

https://www.jscache.com/wejs?wtype=selfserveprop&uniq=753&locationId=14077573&lang=en_US&rating=true&nreviews=5&writereviewlink=true&popIdx=false&iswide=false&border=true&display_version=2
https://www.tripadvisor.com/wejs?wtype=selfserveprop&uniq=753&locationId=14077573&lang=en_US&rating=true&nreviews=5&writereviewlink=true&popIdx=false&iswide=false&border=true&display_version=2

339 B
2 KB

267ms
267ms

Script
application/x-javascript

23.206.209.57
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tripadvisor.com/wejs?wtype=selfserveprop&uniq=753&locationId=14077573&lang=en_US&rating=true&nreviews=5&writereviewlink=true&popIdx=false&iswide=false&border=true&display_version=2
Requested by: Host: www.qe2.com
URL: https://www.qe2.com/en/
Protocol: H2
Server: 23.206.209.57 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-206-209-57.deploy.static.akamaitechnologies.com
Software: envoy /
Resource Hash: c10a6dd00a64ddae4e61608baa4f15cd5427a3a925407857c96717e19df409d0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
content-encoding: br
server: envoy
vary: Accept-Encoding
content-type: application/x-javascript;charset=UTF-8
cache-control: no-cache,no-store,must-revalidate
timing-allow-origin: https://www.tripadvisor.com
content-length: 200
x-request-id: 2083e3ae-8623-468f-b41b-9b7c2bebf465
expires: 0

Redirect headers

x-cache-hits: 0
date: Thu, 05 Oct 2023 10:41:47 GMT
via: 1.1 varnish
x-cache: MISS
content-length: 0
x-request-id: ba6e4741-6931-403c-b5ed-ee45129154d0
x-served-by: cache-fra-eddf8230044-FRA
pragma: no-cache
server: envoy
x-timer: S1696502507.081491,VS0,VE119
content-type: text/plain; charset=utf-8
location: https://www.tripadvisor.com/wejs?wtype=selfserveprop&uniq=753&locationId=14077573&lang=en_US&rating=true&nreviews=5&writereviewlink=true&popIdx=false&iswide=false&border=true&display_version=2
cache-control: no-cache,no-store,must-revalidate
accept-ranges: bytes
timing-allow-origin: https://www.tripadvisor.com
expires: 0

GET
H2 200 time-4.jpg
d1zdqtt14m14p.cloudfront.net/wp-content/uploads/2023/01/ 4 KB
5 KB 20ms
20ms Image
image/jpeg 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/uploads/2023/01/time-4.jpg

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

8183fd82ee119ca755619dd0781847a87517791a3c9f2c4dad6e78fefc9573d9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 12:46:15 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: FRA56-P4
age: 1202132
x-cache: Hit from cloudfront
content-length: 4391
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 18 Jan 2023 10:34:13 GMT
server: Apache
x-frame-options: sameorigin
content-type: image/jpeg
cache-control: max-age=2592000, public
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: oZc4CZE72Q6qE0IzfFbt6NN-9zfKSrRaaaB3RcXw3q_56u3-CaAnUw==
expires: Fri, 20 Sep 2024 12:46:15 GMT

GET
H2 200 yikes-inc-easy-mailchimp-extender-public.min.css
d1zdqtt14m14p.cloudfront.net/wp-content/plugins/yikes-inc-easy-mailchimp-extender/public/css/ 5 KB
2 KB 32ms
32ms Stylesheet
text/css 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/plugins/yikes-inc-easy-mailchimp-extender/public/css/yikes-inc-easy-mailchimp-extender-public.min.css

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

9bc275748b6e752959c418c0b9745cd9bb9427134086b258d32efdc34cdfad79

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubdomains;
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
date: Tue, 03 Oct 2023 19:28:25 GMT
x-amz-cf-pop: FRA56-P4
age: 141201
x-cache: Hit from cloudfront
content-length: 1242
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Mon, 23 Nov 2020 08:14:53 GMT
server: Apache
x-frame-options: sameorigin
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800, public
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: fI6Wurfmdga8WXuIz9suEZ_ANe8zkCwHQzhtDQvTAoUf0H9HvriLow==
expires: Thu, 02 Nov 2023 19:28:25 GMT

GET
H2 200 scripts.js Show response
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/js/ 565 KB
157 KB 22ms
22ms Script
application/javascript 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/js/scripts.js

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

edb1df31b97a8ef7faafb459576082cf68715e4f82807b9dcc1f0a818a2ba887

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubdomains;
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
date: Thu, 05 Oct 2023 01:51:34 GMT
x-amz-cf-pop: FRA56-P4
age: 31812
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 13 Jul 2023 10:45:44 GMT
server: Apache
x-frame-options: sameorigin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=216000, public
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: ApLEHYiOvRBdnaGzAkCEMW7X3eoATcbtJ-qK5LX8q9Ykrny-FILIGg==
expires: Sat, 04 Nov 2023 01:51:34 GMT

GET
H2 200 joinchat.min.js Show response
d1zdqtt14m14p.cloudfront.net/wp-content/plugins/creame-whatsapp-me/public/js/ 8 KB
3 KB 46ms
46ms Script
application/javascript 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/plugins/creame-whatsapp-me/public/js/joinchat.min.js

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

59fc5a88fa6aad3642d9914c53490174cef0abce3ab397589364018c4acd74e0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubdomains;
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
date: Thu, 05 Oct 2023 07:55:23 GMT
x-amz-cf-pop: FRA56-P4
age: 9983
x-cache: Hit from cloudfront
content-length: 2727
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 28 Dec 2022 08:07:11 GMT
server: Apache
x-frame-options: sameorigin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=216000, public
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: CgWjINkO3jDstsfActW0D7JwsYXNNaQUozqCGYdYjGWMgUS_tm0-xg==
expires: Sat, 04 Nov 2023 07:55:23 GMT

GET
H2 200 yikes-mc-ajax-forms.min.js Show response
d1zdqtt14m14p.cloudfront.net/wp-content/plugins/yikes-inc-easy-mailchimp-extender/public/js/ 8 KB
2 KB 20ms
19ms Script
application/javascript 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/plugins/yikes-inc-easy-mailchimp-extender/public/js/yikes-mc-ajax-forms.min.js

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

6200fd7ac0a1c0d9bbebceba4a943d61e6959fd2db8c7a22acd16ba6be823805

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 06:24:32 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 15435
x-cache: Hit from cloudfront
content-length: 1530
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Mon, 23 Nov 2020 08:14:53 GMT
server: Apache
x-frame-options: sameorigin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=216000, public
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
vary: Accept-Encoding
accept-ranges: bytes
x-amz-cf-id: OQtJwz_4EPqWlkHpEasZX8eO0xCDWWUcx3hMku6CSdW2yg0dsWe_Eg==
expires: Sat, 04 Nov 2023 06:24:32 GMT

GET
H2 200 form-submission-helpers.min.js Show response
d1zdqtt14m14p.cloudfront.net/wp-content/plugins/yikes-inc-easy-mailchimp-extender/public/js/ 3 KB
2 KB 20ms
19ms Script
application/javascript 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/plugins/yikes-inc-easy-mailchimp-extender/public/js/form-submission-helpers.min.js

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

e9ab8622c3331d34e83e71075072f6db718e4bcef6592ec1dc47557a007ac025

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 04:56:52 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 107095
x-cache: Hit from cloudfront
content-length: 1111
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Mon, 23 Nov 2020 08:14:53 GMT
server: Apache
x-frame-options: sameorigin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=216000, public
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
vary: Accept-Encoding
accept-ranges: bytes
x-amz-cf-id: EIgrnIS6kp6OZaClzYY5bMl4ADu5jEkJlb-7roud-cIVLCyNd1QYDw==
expires: Fri, 03 Nov 2023 04:56:52 GMT

GET
H2 200 css
fonts.googleapis.com/ 3 KB
882 B 112ms
32ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Assistant:300,400,700&display=swap

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

69b85d24e7ceacf67b42b94a6877886294c1856880f3effc7f22fd1a97b4b6db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 05 Oct 2023 10:41:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 05 Oct 2023 10:41:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 05 Oct 2023 10:41:46 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 228 KB
79 KB 188ms
132ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WHX9HQ5

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3d17b025da0f0b154ed1611f9264fa1269d77d5ffb09f64b1c1350beafaa209e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:47 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 80725
x-xss-protection: 0
last-modified: Thu, 05 Oct 2023 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 05 Oct 2023 10:41:47 GMT

GET
H2 200 logo-blue.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 44 KB
17 KB 20ms
20ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/logo-blue.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

4495410c4fed4379b668162aacdfbe6eab10d5e39a29ff9c6d0e135fd7e26a1b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 23 Dec 2022 05:36:15 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 24728732
x-cache: Hit from cloudfront
content-length: 16831
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Mon, 03 Oct 2022 05:40:16 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: NM2XdNyGKyLpk572XzBV0GmLrJRXm159HDpGhQ4iA_FjhmFDH9wmxw==
expires: Sat, 23 Dec 2023 05:36:15 GMT

GET
H2 200 SangBleuSunrise-Regular.woff2
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/fonts/ 43 KB
44 KB 58ms
13ms Font
font/woff2 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/fonts/SangBleuSunrise-Regular.woff2

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

e80d16372db62c37941adb80895949bce9106e87323f3bbb0cdc4465a63d2d53

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
Origin: https://www.qe2.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 10 Sep 2023 16:28:15 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
via: 1.1 3431ec594cac61983aae2d9ffaf23980.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: FRA56-P4
age: 2139212
x-cache: Hit from cloudfront
content-length: 44120
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Sun, 06 Dec 2020 06:19:08 GMT
server: Apache
x-frame-options: sameorigin
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=2592000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: _LiX2pnxLPNxsUV6nc2HVlUE2aZwMPJHKCvv_w9PEldqwSbqE_o-Og==
expires: Tue, 10 Oct 2023 16:28:15 GMT

GET
H2 200 ta-icon.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 2 KB
2 KB 19ms
12ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ta-icon.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

1485662d796450f4007c0a163104f27844a27b108caa9c045ea39d0260449c39

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 23 Dec 2022 05:36:15 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 24728732
x-cache: Hit from cloudfront
content-length: 1027
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Sun, 17 Oct 2021 07:56:10 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: X3jhOojA4HZnj6EUdulnn175jgqYPWw2y-m3cxXPUKDGuhvy6vOFMg==
expires: Sat, 23 Dec 2023 05:36:15 GMT

GET
H2 200 QE2-2.jpg
d1zdqtt14m14p.cloudfront.net/wp-content/uploads/2023/09/ 211 KB
212 KB 30ms
23ms Image
image/jpeg 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/uploads/2023/09/QE2-2.jpg

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

00b6ed74f9dbbc3a6679c9488e03d92367f3a9a84603e776a658664002f95617

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.qe2.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 14:57:22 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: FRA56-P4
age: 848665
x-cache: Hit from cloudfront
content-length: 215711
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Mon, 25 Sep 2023 14:06:45 GMT
server: Apache
x-frame-options: sameorigin
content-type: image/jpeg
cache-control: max-age=2592000, public
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: ZM_vC8P_5QSscOPQ2iI-UTh_3CM6HmhowAyTXXNbMTnwFR8lGEfeOA==
expires: Tue, 24 Sep 2024 14:57:22 GMT

GET
H2 200 blue-plane.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 1 KB
1 KB 49ms
42ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/blue-plane.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

88ab854269f161b857d7cf998ef620fedcbf13ff272c1fde2afc3d2108db483f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 23 Dec 2022 05:36:16 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 24728731
x-cache: Hit from cloudfront
content-length: 688
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 19 Feb 2020 11:36:05 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: U2KbkkhOqGDltS9P38ktnb82_hNLYYAAhDIzUl-xFpvYKixCQ0s6bg==
expires: Sat, 23 Dec 2023 05:36:16 GMT

GET
H2 200 blue-palm.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 4 KB
3 KB 49ms
42ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/blue-palm.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

4b69efb271935ae60c1da42864e95296e4ba9ff12b7c0230b6c277759f94216f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 15 May 2023 01:28:48 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 12388379
x-cache: Hit from cloudfront
content-length: 2146
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 19 Feb 2020 11:36:05 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: wrys7iY8Nfk2MUGhm5mMfmv8OsZV0lv0Nz6XMnhxoUYXTbl-jTsHIw==
expires: Tue, 14 May 2024 01:28:48 GMT

GET
H2 200 blue-shopping-bag.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 805 B
1 KB 50ms
43ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/blue-shopping-bag.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

1f5e16ca6a71ab2f30d925f1fc0d293533891fa95d5ec2eb417a3721ca576ec5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 04:19:20 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 6502947
x-cache: Hit from cloudfront
content-length: 468
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 19 Feb 2020 11:36:05 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: LcYur6vmN79m7zDUEQ6QANC6imLVQs-fs4X1GF1PSGFKUoOMx4_uMA==
expires: Sun, 21 Jul 2024 04:19:20 GMT

GET
H2 200 blue-moe.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 1 KB
1 KB 47ms
43ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/blue-moe.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d4ca054ec6ad22876414693df7e5ea685833c3c462325dc54fecc75c4d891f3c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 23 Dec 2022 05:36:15 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 24728732
x-cache: Hit from cloudfront
content-length: 559
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 19 Feb 2020 11:36:05 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: 3Y0JkSedm4_yBmHeVjGIijg8Dj131YdT4fE_yCkN14cdRufrusG-_g==
expires: Sat, 23 Dec 2023 05:36:15 GMT

GET
H2 200 blue-burj-arab.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 1 KB
1 KB 50ms
46ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/blue-burj-arab.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

71b55bd025da35caa66b69d6ec16b01322aa217dd7339dd9f4fbc1d30bddc94d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 23 Dec 2022 05:36:15 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 24728732
x-cache: Hit from cloudfront
content-length: 563
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 19 Feb 2020 11:36:05 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: NMUVwj5TiuLDUYbA2Q_fllenw1pSFennAaBJG0CgWSo2g_lCdrgl7A==
expires: Sat, 23 Dec 2023 05:36:15 GMT

GET
H2 200 blue-burj-khalifa.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 1 KB
1 KB 48ms
44ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/blue-burj-khalifa.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

967e42416ec9d51743d1ddb586930f4133019025d6c1bfcc78b473e43df1a0c8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 23 Dec 2022 05:36:15 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 24728732
x-cache: Hit from cloudfront
content-length: 501
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 19 Feb 2020 11:36:05 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: qgUHadKUF5IXqqdQb0fgkAfc-MqDm8BVgxzY8xgCwCgRU77Na97H7g==
expires: Sat, 23 Dec 2023 05:36:15 GMT

GET
H2 200 blue-facebook.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 405 B
1 KB 50ms
46ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/blue-facebook.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

c541240818310fe8ff748795716bb51fa6e0702eb843ae3ca65286dbfe702508

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 23 Dec 2022 05:36:15 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 24728732
x-cache: Hit from cloudfront
content-length: 278
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 19 Feb 2020 11:36:05 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: OuVdE4iG0uW5aY94uvtQ3svFsX8nVJVFAUz-moxMnT5hip9eABoGfg==
expires: Sat, 23 Dec 2023 05:36:15 GMT

GET
H2 200 blue-instagram.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 2 KB
2 KB 48ms
45ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/blue-instagram.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

29b2d84b648be7219ab0742fda84ca9b9ead06c20709410685b21fda82aaca8c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 23 Dec 2022 05:36:15 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 24728732
x-cache: Hit from cloudfront
content-length: 827
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 19 Feb 2020 11:36:05 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: UJHZRV4PdPkfRCiYjfBEqezdsOod_rIFFWcDN-zVxToGTwcQBBIycQ==
expires: Sat, 23 Dec 2023 05:36:15 GMT

GET
H2 200 blue-linkedin.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 478 B
1 KB 48ms
45ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/blue-linkedin.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

2df29022727e08b1d89c707e38327ae115035d0568d9310fe5e47739761fa4ae

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 26 May 2023 15:40:14 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 11386893
x-cache: Hit from cloudfront
content-length: 324
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 19 Feb 2020 11:36:05 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: cmaKtK-L_emEtljH-x1_8YESETNmRYxHaUFULCwGxfIPq3K4Y9sJBw==
expires: Sat, 25 May 2024 15:40:14 GMT

GET
H2 200 2sDcZGJYnIjSi6H75xkzaGW5.woff2
fonts.gstatic.com/s/assistant/v19/ 21 KB
22 KB 50ms
15ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/assistant/v19/2sDcZGJYnIjSi6H75xkzaGW5.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Assistant:300,400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

39e8cbda3d0dbdebf90ffd27f3990859a78f3e7561a8ff2b1f12df25306854a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.qe2.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 28 Sep 2023 18:43:53 GMT
x-content-type-options: nosniff
age: 575874
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21700
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:44:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 27 Sep 2024 18:43:53 GMT

GET
H2 200 brown-arrow-right.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 209 B
956 B 11ms
10ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/brown-arrow-right.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

57a79fab8c7649aeb41bf34b5a9d96176cc27ffbe14c8a7740536976e3ad0481

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 23 Dec 2022 06:42:51 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 24724736
x-cache: Hit from cloudfront
content-length: 169
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 19 Feb 2020 11:36:05 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: uWON60b0rPfVLym4hzeVOnzrquXc_Ys3RsFQxagVqrdmVL8dFoBv6A==
expires: Sat, 23 Dec 2023 06:42:51 GMT

GET
H2 200 map-scaled.jpg
d1zdqtt14m14p.cloudfront.net/wp-content/uploads/2020/11/ 89 KB
89 KB 16ms
16ms Image
image/jpeg 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/uploads/2020/11/map-scaled.jpg

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

41c6c77f3f052213923de4db028dbb1739b900b44fca8460785b19b30d3d2bc1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.qe2.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 05:47:29 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: FRA56-P4
age: 2350458
x-cache: Hit from cloudfront
content-length: 90737
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Sun, 03 Jan 2021 13:30:49 GMT
server: Apache
x-frame-options: sameorigin
content-type: image/jpeg
cache-control: max-age=2592000, public
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: l0kDnqxXxO7oEjzZ7XzSk9t39Bz-8L1QLfI0jC0wOxMUN9A6fuaw3g==
expires: Sat, 07 Sep 2024 05:47:29 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 63ms
7ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WHX9HQ5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 05 Oct 2023 09:49:42 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 3125
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 05 Oct 2023 11:49:42 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 198 KB
53 KB 53ms
15ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

805270b078cde87b61bb57c8bd44f8b58b0d128f5a8efdd4395470b45b291d65

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 05 Oct 2023 10:41:47 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 53356
x-xss-protection: 0
pragma: public
x-fb-debug: LMiRn2C6+c6IJma+lwVAY5eZ6AAquCMZtb5OZmoLQ621SmB+mG3F4M/BgIP6JrV5Pj7deOGZEpBkOf9Lzz5k1Q==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 sjrn_autocx.js Show response
static.sojern.com/utils/ 6 KB
6 KB 62ms
8ms Script
text/javascript 35.244.188.9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.sojern.com/utils/sjrn_autocx.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WHX9HQ5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.188.9 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 9.188.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 573df05aa08d415383b527f34ba575f6d58ba0fef033b6da852ce2327f04b0a0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 09:48:39 GMT
age: 3188
x-guploader-uploadid: ADPycdt9fUdGhq0XjPUsVUpW-J5SnycNqTcAAK3CELcbM6F5QpRu6rFfEZmrUqcKX6R7uYfVNCBF3sXG-fSI3YYqWt_NAEzs9OOM
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6138
last-modified: Fri, 09 Jun 2023 10:52:22 GMT
server: UploadServer
etag: "b0e6a30a07bca6d9e5f647a711382aec"
x-goog-generation: 1686307942516200
x-goog-hash: crc32c=ueAaFw==, md5=sOajCge8ptnl9kenETgq7A==
content-type: text/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 6138
accept-ranges: bytes
expires: Thu, 05 Oct 2023 10:48:39 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 275 KB
91 KB 33ms
33ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-9VMH7J2G2K&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WHX9HQ5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

31d63f0566f6714517b77fee08e181f6d59bd6497df4e0e686ea3d76a790b73e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:47 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93278
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 05 Oct 2023 10:41:47 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
251 B 57ms
31ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-9VMH7J2G2K&gtm=45je3a20&_p=2048344527&_gaz=1&cid=142618060.1696502507&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&_s=1&sid=1696502507&sct=1&seg=0&dl=https%3A%2F%2Fwww.qe2.com%2Fen%2F&dt=Queen%20Elizabeth%202%20%7C%20Luxury%2013-Deck%20Floating%20Hotel%2C%20Dubai&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9VMH7J2G2K&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.qe2.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
251 B 63ms
20ms Ping
text/plain 2a00:1450:400c:c04::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-9VMH7J2G2K&cid=142618060.1696502507&gtm=45je3a20&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9VMH7J2G2K&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c04::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.qe2.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 60ms
35ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-9VMH7J2G2K&cid=142618060.1696502507&gtm=45je3a20&aip=1&z=119982059

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 5275591475888184 Show response
connect.facebook.net/signals/config/ 131 KB
34 KB 76ms
76ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/5275591475888184?v=2.9.132&r=stable&domain=www.qe2.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

be896fd9c4433bdc88e8f61efd9b980d47cf2c062e58dc7eff8e309f196bdeaf

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 05 Oct 2023 10:41:47 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: aJS6UT8jVyTzW+RzyL3Q7Ri8qkuIxJViT5ayEQfgiA7Q+3PmkoaKcEI0wEP8tNo1gomw38YvpIgyTQvdwyoPxA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 43.html Show response
static.sojern.com/cip/c/ Frame 9B79 7 KB
8 KB 13ms
11ms Document
text/html 35.244.188.9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.sojern.com/cip/c/43.html?f_v=cp_v3_js&p_v=1&version=3&auto_url=https%3A%2F%2Fwww.qe2.com%2Fen%2F&auto_ccid=q3ilu-yx3cu-d4a8z-9dtrz-u6puf&auto_ga=142618060.1696502507&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&auto_eml_list=&ws=1600x1200&tz=-120&hpid=112535&pt=HOME_PAGE&et=
Requested by: Host: www.qe2.com
URL: https://www.qe2.com/en/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.188.9 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 9.188.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: a90e21ca39b126b23712ff533fa8164e82d0c69bb9e666111a98e00d659f84cf

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2352
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-length: 7400
content-type: text/html
date: Thu, 05 Oct 2023 10:02:35 GMT
etag: "29b3ae6256471e6a026df08a465ca124"
expires: Thu, 05 Oct 2023 11:02:35 GMT
last-modified: Wed, 13 Sep 2023 07:42:31 GMT
server: UploadServer
x-goog-generation: 1694590951925972
x-goog-hash: crc32c=Zup2ZA== md5=KbOuYlZHHmoCbfCKRlyhJA==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 7400
x-guploader-uploadid: ADPycdt3MHLKAac7rHHz8j0xGuVqGX2bsx0M_9Eky5uXpczzzr8lmago7i-Eq9H2n6Rdntoiqv_2UCeS10B57CrYBT363XrrXsAr

POST
H2 200 collect Show response
www.google-analytics.com/j/ 16 B
219 B 15ms
14ms XHR
text/plain 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=2048344527&t=pageview&_s=1&dl=https%3A%2F%2Fwww.qe2.com%2Fen%2F&ul=en-us&de=UTF-8&dt=Queen%20Elizabeth%202%20%7C%20Luxury%2013-Deck%20Floating%20Hotel%2C%20Dubai&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAACAAI~&jid=102119429&gjid=1676364308&cid=142618060.1696502507&tid=UA-117211517-1&_gid=1742565445.1696502507&_r=1&_slc=1&gtm=45He3a20n81WHX9HQ5&z=1159493316

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

4882b3356202c66430dd6acfc02042447a71f57a84c6ba934d04d5c31be7803d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.qe2.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 hasher.js Show response
static.sojern.com/cip/ Frame 9B79 18 KB
18 KB 12ms
11ms Script
text/javascript 35.244.188.9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.sojern.com/cip/hasher.js
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/cip/c/43.html?f_v=cp_v3_js&p_v=1&version=3&auto_url=https%3A%2F%2Fwww.qe2.com%2Fen%2F&auto_ccid=q3ilu-yx3cu-d4a8z-9dtrz-u6puf&auto_ga=142618060.1696502507&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&auto_eml_list=&ws=1600x1200&tz=-120&hpid=112535&pt=HOME_PAGE&et=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.188.9 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 9.188.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: ded6dff29c705adb48c831fe4a652814472affd0e7164d66832b00f594573b7f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/cip/c/43.html?f_v=cp_v3_js&p_v=1&version=3&auto_url=https%3A%2F%2Fwww.qe2.com%2Fen%2F&auto_ccid=q3ilu-yx3cu-d4a8z-9dtrz-u6puf&auto_ga=142618060.1696502507&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&auto_eml_list=&ws=1600x1200&tz=-120&hpid=112535&pt=HOME_PAGE&et=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:27:42 GMT
age: 845
x-guploader-uploadid: ADPycdsHYIYJzKyCZHPWVZVCnTPDT8wF-L0IPzBq_YodJobDq_j0P1clAThr9McSOwvMkpY8QEUKl5wiIctT9cS2GplLxaAiinoK
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18469
last-modified: Tue, 07 Dec 2021 16:23:19 GMT
server: UploadServer
etag: "676881567863e15eb1b6aa81b384455c"
x-goog-generation: 1638894199335821
x-goog-hash: crc32c=T9fXIw==, md5=Z2iBVnhj4V6xtqqBs4RFXA==
content-type: text/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 18469
accept-ranges: bytes
expires: Thu, 05 Oct 2023 11:27:42 GMT

GET
H3 200 create_params.js Show response
static.sojern.com/utils/ Frame 9B79 4 KB
4 KB 11ms
11ms Script
text/javascript 35.244.188.9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.sojern.com/utils/create_params.js
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/cip/c/43.html?f_v=cp_v3_js&p_v=1&version=3&auto_url=https%3A%2F%2Fwww.qe2.com%2Fen%2F&auto_ccid=q3ilu-yx3cu-d4a8z-9dtrz-u6puf&auto_ga=142618060.1696502507&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&auto_eml_list=&ws=1600x1200&tz=-120&hpid=112535&pt=HOME_PAGE&et=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.188.9 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 9.188.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 3107e5779ba7aef5eb3d38abf73567905761c49a6da871adb8798425745d49db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/cip/c/43.html?f_v=cp_v3_js&p_v=1&version=3&auto_url=https%3A%2F%2Fwww.qe2.com%2Fen%2F&auto_ccid=q3ilu-yx3cu-d4a8z-9dtrz-u6puf&auto_ga=142618060.1696502507&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&auto_eml_list=&ws=1600x1200&tz=-120&hpid=112535&pt=HOME_PAGE&et=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:12:28 GMT
age: 1759
x-guploader-uploadid: ADPycduVEkwGrAaLX0LJ7qn5HUyzDb18S4acbxy7XJ0zC4iP40spudkR1CjBpemiJ1RzNKvt6MV3-yCh2USTtQoKlj1AzRvbqEaS
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4219
last-modified: Wed, 26 Apr 2023 13:18:45 GMT
server: UploadServer
etag: "c4ca3af5c34884e0dfd4291b07f65037"
x-goog-generation: 1682515125984075
x-goog-hash: crc32c=eNqgAQ==, md5=xMo69cNIhODf1CkbB/ZQNw==
content-type: text/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 4219
accept-ranges: bytes
expires: Thu, 05 Oct 2023 11:12:28 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
148 B 21ms
21ms XHR
text/plain 2a00:1450:400c:c04::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-117211517-1&cid=142618060.1696502507&jid=102119429&gjid=1676364308&_gid=1742565445.1696502507&_u=YCDACEAABAAAACAAI~&z=1758104858

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 05 Oct 2023 10:41:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.qe2.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 239 KB
84 KB 27ms
26ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-T3RRMMZGL3&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e6ab868fb10dfd43c69d0e8062068e551a9ee44b5d2894dd2d6b9b9063609c31

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:47 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 85665
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 05 Oct 2023 10:41:47 GMT

GET
H2 200 43 Show response
beacon.sojern.com/pixel/cp/ Frame 9B79 6 KB
2 KB 52ms
18ms Script
application/javascript 107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.sojern.com/pixel/cp/43?f_v=cp_v3_js&p_v=4&f_v=cp_v3_js&cid=s%3Dccid_ga%7Cccid_auto%7Cf_v%3Dcp_v3_js%7Cp_v%3D1%7Cversion%3D3%7Cauto_url%3Dhttps%253A%252F%252Fwww.qe2.com%252Fen%252F%7Cauto_ccid%3Dq3ilu-yx3cu-d4a8z-9dtrz-u6puf%7Cauto_ga%3D142618060.1696502507%7Cauto_eml_count%3D0%7Cws%3D1600x1200%7Ctz%3D-120%7Chpid%3D112535%7Cpt%3DHOME_PAGE%7Cet%3D&p_v=1&version=3&ws=1600x1200&tz=-120&hpid=112535&pt=HOME_PAGE&et=&domain=https%3A%2F%2Fwww.qe2.com%2Fen%2F&s=ccid_ga%7Cccid_auto&ccid=142618060.1696502507%7Cq3ilu-yx3cu-d4a8z-9dtrz-u6puf
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/cip/c/43.html?f_v=cp_v3_js&p_v=1&version=3&auto_url=https%3A%2F%2Fwww.qe2.com%2Fen%2F&auto_ccid=q3ilu-yx3cu-d4a8z-9dtrz-u6puf&auto_ga=142618060.1696502507&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&auto_eml_list=&ws=1600x1200&tz=-120&hpid=112535&pt=HOME_PAGE&et=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: 1ec53568245e45cbbc96784bb664434c6517a2dbba39904d2be75defccf1182d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:47 GMT
content-encoding: gzip
via: 1.1 google
vary: Accept-Encoding
content-type: application/javascript
p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1369

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 30ms
8ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=5275591475888184&ev=PageView&dl=https%3A%2F%2Fwww.qe2.com%2Fen%2F&rl=&if=false&ts=1696502507499&sw=1600&sh=1200&v=2.9.132&r=stable&ec=0&o=30&fbp=fb.1.1696502507498.1509844031&ler=empty&it=1696502507400&coo=false&exp=a0&rqm=GET

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 05 Oct 2023 10:41:47 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 18ms
16ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-T3RRMMZGL3&gtm=45je3a20&_p=2048344527&_gaz=1&ul=en-us&sr=1600x1200&cid=142618060.1696502507&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=ABAI&_s=1&dl=https%3A%2F%2Fwww.qe2.com%2Fen%2F&dt=Queen%20Elizabeth%202%20%7C%20Luxury%2013-Deck%20Floating%20Hotel%2C%20Dubai&sid=1696502507&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3RRMMZGL3&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.qe2.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
stats.g.doubleclick.net/g/ 0
17 B 21ms
21ms Ping
text/plain 2a00:1450:400c:c04::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-T3RRMMZGL3&cid=142618060.1696502507&gtm=45je3a20&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3RRMMZGL3&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400c:c04::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.qe2.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 35ms
34ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-T3RRMMZGL3&cid=142618060.1696502507&gtm=45je3a20&aip=1&z=1353526035

Requested by

Host: www.qe2.com
URL: https://www.qe2.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 trackpoint-async.js Show response
s2.adform.net/banners/scripts/st/ Frame 9B79 81 KB
31 KB 151ms
22ms Script
application/javascript 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/banners/scripts/st/trackpoint-async.js
Requested by: Host: beacon.sojern.com
URL: https://beacon.sojern.com/pixel/cp/43?f_v=cp_v3_js&p_v=4&f_v=cp_v3_js&cid=s%3Dccid_ga%7Cccid_auto%7Cf_v%3Dcp_v3_js%7Cp_v%3D1%7Cversion%3D3%7Cauto_url%3Dhttps%253A%252F%252Fwww.qe2.com%252Fen%252F%7Cauto_ccid%3Dq3ilu-yx3cu-d4a8z-9dtrz-u6puf%7Cauto_ga%3D142618060.1696502507%7Cauto_eml_count%3D0%7Cws%3D1600x1200%7Ctz%3D-120%7Chpid%3D112535%7Cpt%3DHOME_PAGE%7Cet%3D&p_v=1&version=3&ws=1600x1200&tz=-120&hpid=112535&pt=HOME_PAGE&et=&domain=https%3A%2F%2Fwww.qe2.com%2Fen%2F&s=ccid_ga%7Cccid_auto&ccid=142618060.1696502507%7Cq3ilu-yx3cu-d4a8z-9dtrz-u6puf
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 99c28ba77690124b83aea8cdbbb17ab1145ba247c791aeb4bad747b4248ac459

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:47 GMT
content-encoding: gzip
last-modified: Tue, 23 May 2023 09:56:34 GMT
server: nginx
x-amz-request-id: tx000001bb82daec29e1fab-00646c8ee1-3295a825-default
etag: W/"f937ab3eef01c118930b200e5087d00d"
x-cache-status: HIT
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-rgw-object-type: Normal
cache-control: public, max-age=604800

GET
H2

200

/
adservice.google.de/ddm/fls/p/src=12373456;dc_pre=CMKXzqrc3oEDFc8PogMd_IAItQ;type=homep0;cat=mgall0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v3_js%257Cp_v%253D1%257Cversion%253D3%... Frame 9B79
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=12373456;type=homep0;cat=mgall0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v3_js%257Cp_v%253D1%257Cversion%253D3%257Cauto_url%253Dhttps%2...
https://ad.doubleclick.net/ddm/activity/src=12373456;dc_pre=CMKXzqrc3oEDFc8PogMd_IAItQ;type=homep0;cat=mgall0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v3_js%257Cp_v%253D1%257Cvers...
https://adservice.google.com/ddm/fls/p/src=12373456;dc_pre=CMKXzqrc3oEDFc8PogMd_IAItQ;type=homep0;cat=mgall0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v3_js%257Cp_v%253D1%257Cversi...
https://adservice.google.de/ddm/fls/p/src=12373456;dc_pre=CMKXzqrc3oEDFc8PogMd_IAItQ;type=homep0;cat=mgall0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v3_js%257Cp_v%253D1%257Cversio...

42 B
476 B

74ms
47ms

Image
image/gif

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.de/ddm/fls/p/src=12373456;dc_pre=CMKXzqrc3oEDFc8PogMd_IAItQ;type=homep0;cat=mgall0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v3_js%257Cp_v%253D1%257Cversion%253D3%257Cauto_url%253Dhttps%25253A%25252F%25252Fwww.qe2.com%25252Fen%25252F%257Cauto_ccid%253Dq3ilu-yx3cu-d4a8z-9dtrz-u6puf%257Cauto_ga%253D142618060.1696502507%257Cauto_eml_count%253D0%257Cws%253D1600x1200%257Ctz%253D-120%257Chpid%253D112535%257Cpt%253DHOME_PAGE%257Cet%253D;u2=;u3=;u4=;u5=;u9=;u10=;u11=;u12=;u13=;u14=;u15=;u16=;u19=112535;u20=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=orderID;~oref=https://static.sojern.com/

Requested by

Host: static.sojern.com
URL: https://static.sojern.com/cip/c/43.html?f_v=cp_v3_js&p_v=1&version=3&auto_url=https%3A%2F%2Fwww.qe2.com%2Fen%2F&auto_ccid=q3ilu-yx3cu-d4a8z-9dtrz-u6puf&auto_ga=142618060.1696502507&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&auto_eml_list=&ws=1600x1200&tz=-120&hpid=112535&pt=HOME_PAGE&et=

Protocol

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://adservice.google.de/ddm/fls/p/src=12373456;dc_pre=CMKXzqrc3oEDFc8PogMd_IAItQ;type=homep0;cat=mgall0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v3_js%257Cp_v%253D1%257Cversion%253D3%257Cauto_url%253Dhttps%25253A%25252F%25252Fwww.qe2.com%25252Fen%25252F%257Cauto_ccid%253Dq3ilu-yx3cu-d4a8z-9dtrz-u6puf%257Cauto_ga%253D142618060.1696502507%257Cauto_eml_count%253D0%257Cws%253D1600x1200%257Ctz%253D-120%257Chpid%253D112535%257Cpt%253DHOME_PAGE%257Cet%253D;u2=;u3=;u4=;u5=;u9=;u10=;u11=;u12=;u13=;u14=;u15=;u16=;u19=112535;u20=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=orderID;~oref=https://static.sojern.com/
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
secure.adnxs.com/ Frame 9B79
Redirect Chain

https://secure.adnxs.com/px?id=1644722&t=1
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1644722%26t%3D1

0
802 B

28ms
28ms

Image
application/javascript

185.89.210.82
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1644722%26t%3D1

Requested by

Protocol

Server

185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
an-x-request-uuid: b016caf1-a0ab-4d35-845a-44d807f08704
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.35; 81.95.5.35; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
an-x-request-uuid: 1bcd4e7b-9e93-4351-acc3-ae3978fc9c67
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1644722%26t%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.35; 81.95.5.35; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

bounce
secure.adnxs.com/ Frame 9B79
Redirect Chain

https://secure.adnxs.com/seg?add=32307654&t=1
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D32307654%26t%3D1

0
803 B

28ms
27ms

Image
application/javascript

185.89.210.82
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D32307654%26t%3D1

Requested by

Protocol

Server

185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
an-x-request-uuid: 4d470cd4-78f4-4bbd-9fad-33f657e9ea47
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.35; 81.95.5.35; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
an-x-request-uuid: a014effd-8aeb-49b7-929e-546a75011138
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D32307654%26t%3D1
x-proxy-origin: 81.95.5.35; 81.95.5.35; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

AdX
pixel.sojern.com/idSync/ Frame 9B79
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=QkHq0UBzOeAno40QoHyEJw&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=bO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn...
https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=QkHq0UBzOeAno40QoHyEJw&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=bO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn...
https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=bO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn9648wurI63YsR&sjrn_ula=7315437973&google_gid=CAESEESlnSORD3Zf_CXHel8fIyU&google_cver=1

42 B
263 B

20ms
17ms

Image
image/gif

107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=bO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn9648wurI63YsR&sjrn_ula=7315437973&google_gid=CAESEESlnSORD3Zf_CXHel8fIyU&google_cver=1
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/cip/c/43.html?f_v=cp_v3_js&p_v=1&version=3&auto_url=https%3A%2F%2Fwww.qe2.com%2Fen%2F&auto_ccid=q3ilu-yx3cu-d4a8z-9dtrz-u6puf&auto_ga=142618060.1696502507&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&auto_eml_list=&ws=1600x1200&tz=-120&hpid=112535&pt=HOME_PAGE&et=
Protocol: H2
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date: Thu, 05 Oct 2023 10:41:47 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
vary: Accept-Encoding
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=bO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn9648wurI63YsR&sjrn_ula=7315437973&google_gid=CAESEESlnSORD3Zf_CXHel8fIyU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 413
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
fcmatch.youtube.com/ Frame 9B79
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_hm=QkHq0UBzOeAno40QoHyEJw&google_nid=sojern_adh
https://cm.g.doubleclick.net/pixel?google_hm=QkHq0UBzOeAno40QoHyEJw&google_nid=sojern_adh&google_tc=
https://fcmatch.google.com/pixel?google_gm=AMnCDopBda0uxipX7Am3Bms7Vq6wFuLv9MG7PC6CLyprC3_3-7siXSTDWGlPreBQ0HDlwOWkDvpItY_TxBAmvpEo5BznjSaxox3sgJfBVy88rjwX5i_NGnE
https://fcmatch.youtube.com/pixel?google_gm=AMnCDopBda0uxipX7Am3Bms7Vq6wFuLv9MG7PC6CLyprC3_3-7siXSTDWGlPreBQ0HDlwOWkDvpItY_TxBAmvpEo5BznjSaxox3sgJfBVy88rjwX5i_NGnE

170 B
432 B

104ms
54ms

Image
image/png

2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fcmatch.youtube.com/pixel?google_gm=AMnCDopBda0uxipX7Am3Bms7Vq6wFuLv9MG7PC6CLyprC3_3-7siXSTDWGlPreBQ0HDlwOWkDvpItY_TxBAmvpEo5BznjSaxox3sgJfBVy88rjwX5i_NGnE

Requested by

Protocol

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://fcmatch.youtube.com/pixel?google_gm=AMnCDopBda0uxipX7Am3Bms7Vq6wFuLv9MG7PC6CLyprC3_3-7siXSTDWGlPreBQ0HDlwOWkDvpItY_TxBAmvpEo5BznjSaxox3sgJfBVy88rjwX5i_NGnE
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 360
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

apn
pixel.sojern.com/idsync/ Frame 9B79
Redirect Chain

https://ib.adnxs.com/getuid?https://pixel.sojern.com/idsync/apn?id=$UID&sjrn_id=bO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn9648wurI63YsR
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fpixel.sojern.com%2Fidsync%2Fapn%3Fid%3D%24UID%26sjrn_id%3DbO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn9648wurI63YsR
https://pixel.sojern.com/idsync/apn?id=2972291638147184319&sjrn_id=bO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn9648wurI63YsR

42 B
266 B

22ms
16ms

Image
image/gif

107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idsync/apn?id=2972291638147184319&sjrn_id=bO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn9648wurI63YsR
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/cip/c/43.html?f_v=cp_v3_js&p_v=1&version=3&auto_url=https%3A%2F%2Fwww.qe2.com%2Fen%2F&auto_ccid=q3ilu-yx3cu-d4a8z-9dtrz-u6puf&auto_ga=142618060.1696502507&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&auto_eml_list=&ws=1600x1200&tz=-120&hpid=112535&pt=HOME_PAGE&et=
Protocol: H2
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date: Thu, 05 Oct 2023 10:41:47 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
vary: Accept-Encoding
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
an-x-request-uuid: da7cff2a-e4f8-461b-b75b-080aa413d633
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://pixel.sojern.com/idsync/apn?id=2972291638147184319&sjrn_id=bO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn9648wurI63YsR
x-proxy-origin: 81.95.5.35; 81.95.5.35; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 9B79 70 B
149 B 125ms
35ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=ombl9hp&ttd_puid=bO7INKsjvP1Oaobg5OHIDZ-GbTCcKInKZdn1XoiQW8b2MfqpdVn9648wurI63YsR&ttd_tpi=1
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/cip/c/43.html?f_v=cp_v3_js&p_v=1&version=3&auto_url=https%3A%2F%2Fwww.qe2.com%2Fen%2F&auto_ccid=q3ilu-yx3cu-d4a8z-9dtrz-u6puf&auto_ga=142618060.1696502507&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&auto_eml_list=&ws=1600x1200&tz=-120&hpid=112535&pt=HOME_PAGE&et=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:47 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2

202

adf
pixel.sojern.com/idsync/ Frame 9B79
Redirect Chain

https://c1.adform.net/serving/cookie/match?cid=4241ead1-4073-39e0-27a3-8d10a07c8427&party=1296
https://c1.adform.net/serving/cookie/match?CC=1&cid=4241ead1-4073-39e0-27a3-8d10a07c8427&party=1296
https://pixel.sojern.com/idsync/adf?adfid=3949932466863171880&cid=4241ead1-4073-39e0-27a3-8d10a07c8427

0
209 B

20ms
18ms

Image
text/plain

107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idsync/adf?adfid=3949932466863171880&cid=4241ead1-4073-39e0-27a3-8d10a07c8427
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/cip/c/43.html?f_v=cp_v3_js&p_v=1&version=3&auto_url=https%3A%2F%2Fwww.qe2.com%2Fen%2F&auto_ccid=q3ilu-yx3cu-d4a8z-9dtrz-u6puf&auto_ga=142618060.1696502507&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&auto_eml_list=&ws=1600x1200&tz=-120&hpid=112535&pt=HOME_PAGE&et=
Protocol: H2
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:47 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://pixel.sojern.com/idsync/adf?adfid=3949932466863171880&cid=4241ead1-4073-39e0-27a3-8d10a07c8427
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 WidgetEmbed-selfserveprop Show response
www.tripadvisor.com/ 16 KB
6 KB 328ms
327ms Script
text/javascript 23.206.209.57
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tripadvisor.com/WidgetEmbed-selfserveprop?border=true&popIdx=false&iswide=false&locationId=14077573&display_version=2&uniq=753&rating=true&lang=en_US&nreviews=5&writereviewlink=true
Requested by: Host: www.jscache.com
URL: https://www.jscache.com/wejs?wtype=selfserveprop&uniq=753&locationId=14077573&lang=en_US&rating=true&nreviews=5&writereviewlink=true&popIdx=false&iswide=false&border=true&display_version=2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.206.209.57 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-206-209-57.deploy.static.akamaitechnologies.com
Software: envoy /
Resource Hash: aece1f85aa2e2cd853a39d0bedba58b7f21f0d4d7d68c3f428729c775a1b1af8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:47 GMT
content-encoding: br
server: envoy
x-datadome: protected
accept-ch: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
vary: User-Agent,Accept-Encoding
content-type: text/javascript;charset=UTF-8
cache-control: no-cache,no-store,must-revalidate
timing-allow-origin: https://www.tripadvisor.com
content-length: 3463
x-request-id: 8573a0a3-9aec-469a-be9f-6530901e460e
expires: 0

GET
H2 200 brown-arrow-down.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 208 B
956 B 16ms
16ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/brown-arrow-down.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

4e4684f18e4c920772c017cb01272d76fd2c27806bd771a0d07e60a0369f4abe

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 10:29:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 6567148
x-cache: Hit from cloudfront
content-length: 169
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 19 Feb 2020 11:36:05 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: qHAFcVBTQJrF0p93Ax9Ik-AmpisMI1iCCb-n3EpThk6aWNIsFxxFDg==
expires: Sat, 20 Jul 2024 10:29:19 GMT

GET
H2 200 grey-compass-clock-icon.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 800 B
1 KB 16ms
16ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/grey-compass-clock-icon.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

e5c9d7ae8906342aec278578556e487e335b8fa70c536eb93a91d48ce6e55474

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 23 Dec 2022 05:36:16 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 24728731
x-cache: Hit from cloudfront
content-length: 429
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 05 Mar 2020 10:53:18 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: B3eCXGj79sLQ-yY-sSQc-YL-SGkoMOiz_uAqKCqbhcrmNyqXEOQw-Q==
expires: Sat, 23 Dec 2023 05:36:16 GMT

GET
H2 200 black-ship-wheel-icon.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 6 KB
4 KB 17ms
17ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/black-ship-wheel-icon.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

21ea840550362e3a9e288ea6097b7fd6675a35a55d18162e07558d0e9cce50de

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 11:45:48 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 7512959
x-cache: Hit from cloudfront
content-length: 2862
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 05 Mar 2020 10:53:18 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: Xum8fsFwcVWCsnbJ30W1FxSPtXsrbC3YGIYHDEQVzNUmpg8MvQgTog==
expires: Tue, 09 Jul 2024 11:45:48 GMT

GET
H2 200 / Show response
a2.adform.net/Serving/TrackPoint/ Frame 9B79 869 B
1 KB 302ms
90ms Script
text/javascript 185.167.164.39
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a2.adform.net/Serving/TrackPoint/?pm=3055358&ADFPageName=MGALLERY%20Queen%20Elizabeth%202%20--%20HOME_PAGE%20341015&ADFdivider=%7C&ord=3663556275&ADFtpmode=2&loc=https%3A%2F%2Fstatic.sojern.com%2Fcip%2Fc%2F43.html%3Ff_v%3Dcp_v3_js%26p_v%3D1%26version%3D3%26auto_url%3Dhttps%253A%252F%252Fwww.qe2.com%252Fen%252F%26auto_ccid%3Dq3ilu-yx3cu-d4a8z-9dtrz-u6puf%26auto_ga%3D142618060.1696502507%26e_eml%3Dnull%26auto_eml%3D%26auto_eml_count%3D0%26auto_eml_domain%3D%26auto_eml_list%3D%26ws%3D1600x1200%26tz%3D-120%26hpid%3D112535%26pt%3DHOME_PAGE%26et%3D&Set1=en-US%7Cen-US%7C1600x1200%7C24

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/banners/scripts/st/trackpoint-async.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.39 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

dcc7beea8d2346b46155b3f6c5a9d0c5708a8ded98ce066aa15b9e1d8158c27e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 715
expires: -1

GET
H2 200 t4b_widget_self_serve_property-v24221562771a.css
static.tacdn.com/css2/build/concat/ 34 KB
6 KB 28ms
8ms Stylesheet
text/css 151.101.66.83
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tacdn.com/css2/build/concat/t4b_widget_self_serve_property-v24221562771a.css
Requested by: Host: www.tripadvisor.com
URL: https://www.tripadvisor.com/WidgetEmbed-selfserveprop?border=true&popIdx=false&iswide=false&locationId=14077573&display_version=2&uniq=753&rating=true&lang=en_US&nreviews=5&writereviewlink=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.83 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: envoy /
Resource Hash: 19854b5cccafb0f438f0d86301061bf0f3b6f84861e4fcfdd2e451b7c432d52d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-cache-hits: 2869
date: Thu, 05 Oct 2023 10:41:47 GMT
content-encoding: br
via: 1.1 varnish
age: 3750677
x-cache: HIT
content-length: 6001
x-request-id: cc283a76-2100-403a-9380-7b9b44a8eff0
x-served-by: cache-fra-eddf8230044-FRA
last-modified: Mon, 21 Aug 2023 09:30:59 GMT
server: envoy
x-timer: S1696502508.920729,VS0,VE0
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 22 Aug 2024 00:50:30 GMT

GET
H2 200 cdswidgets_m-c-v22480917520a.js Show response
static.tacdn.com/js3/build/concat/widget/ 15 KB
5 KB 28ms
8ms Script
application/x-javascript 151.101.66.83
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.tacdn.com/js3/build/concat/widget/cdswidgets_m-c-v22480917520a.js
Requested by: Host: www.tripadvisor.com
URL: https://www.tripadvisor.com/WidgetEmbed-selfserveprop?border=true&popIdx=false&iswide=false&locationId=14077573&display_version=2&uniq=753&rating=true&lang=en_US&nreviews=5&writereviewlink=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.83 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: envoy /
Resource Hash: e94e0140ad5ee0dd772ad05d9ba5cc4cf3e2a1f5d420ea5cb783edbdbdda9f10

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-cache-hits: 11685
date: Thu, 05 Oct 2023 10:41:47 GMT
content-encoding: br
via: 1.1 varnish
age: 18110289
x-cache: HIT
content-length: 4911
x-request-id: 21ccd2ae-cd8d-4707-be16-6cc0d4a017f2
x-served-by: cache-fra-eddf8230044-FRA
last-modified: Sun, 26 Feb 2023 12:32:58 GMT
server: envoy
x-timer: S1696502508.920770,VS0,VE0
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Mar 2024 20:03:40 GMT

GET
H2 200 pixels Show response
c1.adform.net/imatch/ Frame 9051 5 KB
2 KB 24ms
24ms Document
text/html 37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645

Requested by

Host: a2.adform.net
URL: https://a2.adform.net/Serving/TrackPoint/?pm=3055358&ADFPageName=MGALLERY%20Queen%20Elizabeth%202%20--%20HOME_PAGE%20341015&ADFdivider=%7C&ord=3663556275&ADFtpmode=2&loc=https%3A%2F%2Fstatic.sojern.com%2Fcip%2Fc%2F43.html%3Ff_v%3Dcp_v3_js%26p_v%3D1%26version%3D3%26auto_url%3Dhttps%253A%252F%252Fwww.qe2.com%252Fen%252F%26auto_ccid%3Dq3ilu-yx3cu-d4a8z-9dtrz-u6puf%26auto_ga%3D142618060.1696502507%26e_eml%3Dnull%26auto_eml%3D%26auto_eml_count%3D0%26auto_eml_domain%3D%26auto_eml_list%3D%26ws%3D1600x1200%26tz%3D-120%26hpid%3D112535%26pt%3DHOME_PAGE%26et%3D&Set1=en-US%7Cen-US%7C1600x1200%7C24

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

0eb4cfbec827d828a6291f9c90bbbecfc79c5091262662d656ffc819090390fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://static.sojern.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 05 Oct 2023 10:41:48 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

GET
H2 200 /
a1.seadform.net/serving/cookie/sync/ Frame 9B79 35 B
467 B 156ms
45ms Image
image/gif 37.157.6.243
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a1.seadform.net/serving/cookie/sync/?uid=3949932466863171880&stamp=-AR7T1hquwQDvP-67D9Y4w2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.243 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
content-type: image/gif
cache-control: private

GET
H2 200 plf
c1.adform.net/imatch/ Frame 9051 0
384 B 24ms
24ms Image
text/plain 37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/imatch/plf?name=plff

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2 200 match
ad.360yield.com/ Frame 9051 43 B
199 B 198ms
48ms Image
image/gif 34.249.150.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.360yield.com/match?publisher_dsp_id=42&external_user_id=3949932466863171880&Expiration=1697712108
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.249.150.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-150-14.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 05 Oct 2023 10:41:48 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1 204
No Content m
ad.yieldlab.net/ Frame 9051 0
400 B 103ms
72ms Image
text/plain 23.35.237.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.yieldlab.net/m?dt_id=4879&ext_id=3949932466863171880
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.237.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-75.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 Oct 2023 10:41:48 GMT
Cache-Control: no-store,no-cache,max-age=-3600,must-revalidate,post-check=0,pre-check=0
Connection: keep-alive
Expires: Wed, 04 Oct 2023 10:41:48 GMT

GET
H/1.1 204
No Content token
token.rubiconproject.com/ Frame 9051 0
214 B 109ms
39ms Image
text/plain 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/token?pid=5232&puid=3949932466863171880
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 28e1e7d28d06b07ec669bc9e43057b8e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

match
c1.adform.net/serving/cookie/ Frame 9051
Redirect Chain

https://ih.adscale.de/adscale-ih/tpui?tpid=42&tpuid=3949932466863171880&cburl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d9%26uid%3D__ADSCALE_USER_ID__
https://ih.adscale.de/adscale-ih/tpui?tpid=42&tpuid=3949932466863171880&cburl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d9%26uid%3D__ADSCALE_USER_ID__&nut&uu=fa1ee5a55e2c4ac98...
https://c1.adform.net/serving/cookie/match?party=9&uid=b529c2f8ae09864bef1712ce6a2121cd572cd75157e9063025b25b5bca7cec22

35 B
600 B

36ms
36ms

Image
image/gif

37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=9&uid=b529c2f8ae09864bef1712ce6a2121cd572cd75157e9063025b25b5bca7cec22

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645

Protocol

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

location: https://c1.adform.net/serving/cookie/match?party=9&uid=b529c2f8ae09864bef1712ce6a2121cd572cd75157e9063025b25b5bca7cec22
date: Thu, 05 Oct 2023 10:41:48 GMT
content-length: 0
p3p: CP=NOI PSA OUR

GET
H2 200 /
rtb-csync.smartadserver.com/redir/ Frame 9051 43 B
114 B 150ms
37ms Image
image/gif 185.86.139.101
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=22&partneruserid=3949932466863171880&redirurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d10%26cid%3DSMART_USER_ID
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.101 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:47 GMT
content-type: image/gif

GET
H2 204 sync
ups.analytics.yahoo.com/ups/55944/ Frame 9051 0
125 B 142ms
33ms Image
text/plain 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55944/sync?uid=3949932466863171880&_origin=1

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.75 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:48 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.75
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK user-registering
ads.stickyadstv.com/ Frame 9051 43 B
684 B 111ms
49ms Image
image/gif 2.21.20.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=189&userId=3949932466863171880
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.21.20.202 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-21-20-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 Oct 2023 10:41:48 GMT
Server: nginx
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 43
x-sticky-vk: 1696502508178043-337
Expires: Thu, 05 Oct 2023 10:41:48 GMT

GET
H2 200 sync
x.bidswitch.net/ Frame 9051 43 B
146 B 79ms
30ms Image
image/gif 3.121.134.250
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=70&user_id=3949932466863171880
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.121.134.250 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-121-134-250.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 9051
Redirect Chain

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=3949932466863171880&expiration=1697712108
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=3949932466863171880&expiration=1697712108&C=1

43 B
341 B

43ms
42ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=3949932466863171880&expiration=1697712108&C=1
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o2mqbsipkSN6VTJmLd5kEEDzAnERExcJMVJdVuOjQLjbaQcJLbdacDzD1pTokb%2Ba%2BHV3j0JnAmR5p%2FeGtG1y1hqUfNWJ%2F92YTZgVwWyStjUmddeyI2X0C2J8AWIk4V%2B%2BS2Rsg5EZlJhTIw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81150de45af3bbeb-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E8POIng7wzlcyhv2Pkssj5gqY8MHcHuEKb%2FwOkWIqOzL%2B2BJ3UxBHsfkjcEehWiGJjkd13AEPmoA8hzGw%2BDC1CjKDBpWvzH12GTjsGozKclkelJwqXWq2odEbroacGgIdlpcBF4aXMV%2BkA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=111&external_user_id=3949932466863171880&expiration=1697712108&C=1
cache-control: no-cache
cf-ray: 81150de41a95bbeb-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H/1.1

200
OK

12092831
se.semasio.net/sync/1/ Frame 9051
Redirect Chain

https://uipglob.semasio.net/adform/1/info?sType=sync&sExtCookieId=3949932466863171880&sInitiator=external
https://uipglob.semasio.net/adform/1/info2?sType=sync&sExtCookieId=3949932466863171880&sInitiator=external
https://se.semasio.net/sync/1/16266044?sExtCookieId=3949932466863171880&gdpr=&sInitiator=external
https://dsp.adfarm1.adition.com/cookie/?redirect=https%3A%2F%2Fse.semasio.net%2Fsync%2F1%2F647471%3FsExtCookieId%3D%25%25COOKIE%25%25%26sInitiator%3Dinternal&gdpr=
https://se.semasio.net/sync/1/647471?sExtCookieId=7286422789456984203&sInitiator=internal&gdpr=
https://ib.adnxs.com/getuid?https%3A%2F%2Fse.semasio.net%2Fsync%2F1%2F4354957%3FsExtCookieId%3D%24UID%26sInitiator%3Dinternal&gdpr=
https://se.semasio.net/sync/1/4354957?sExtCookieId=2972291638147184319&sInitiator=internal&gdpr=
https://cm.g.doubleclick.net/pixel?google_nid=semasio_ddp&google_cm&google_hm=QjQ3RTBEMUI0N0I4RkMzRQ&gdpr=
https://uipglob.semasio.net/dbm/1/info?sType=sync&sExtCookieId=CAESEDN-y-XeXqGQdNdrXY6dS_I&sInitiator=internal&google_cver=1&gdpr=&google_cver=1
https://se.semasio.net/sync/1/12092831?sExtCookieId=CAESEDN-y-XeXqGQdNdrXY6dS_I&sInitiator=internal&google_cver=1&gdpr=

0
415 B

43ms
42ms

Image
text/plain

77.243.51.121
NETIC-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://se.semasio.net/sync/1/12092831?sExtCookieId=CAESEDN-y-XeXqGQdNdrXY6dS_I&sInitiator=internal&google_cver=1&gdpr=
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: HTTP/1.1
Server: 77.243.51.121 , Denmark, ASN42697 (NETIC-AS, DK),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:57 GMT
uip-status: Ok
frontend-id: 02
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Sat, 01 Jan 2011 12:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:57 GMT
frontend-id: 11
p3p: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
location: https://se.semasio.net/sync/1/12092831?sExtCookieId=CAESEDN-y-XeXqGQdNdrXY6dS_I&sInitiator=internal&google_cver=1&gdpr=
uip-response-status: Ok
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-origin: *
content-length: 0
routing-server-id: -1
expires: Sat, 01 Jan 2011 12:00:00 GMT

GET
H/1.1 200
OK match
ps.eyeota.net/ Frame 9051 0
344 B 113ms
25ms Image
text/plain 52.57.150.20
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=3949932466863171880&bid=9gdtmu1
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.57.150.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-150-20.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 10:41:48 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H2

200

pixel.gif
load77.exelator.com/ Frame 9051
Redirect Chain

https://loadm.exelator.com/load/?p=204&g=710&j=0&buid=3949932466863171880
https://loadm.exelator.com/load/?p=204&g=710&j=0&buid=3949932466863171880&xl8blockcheck=1
https://load77.exelator.com/pixel.gif

43 B
377 B

85ms
22ms

Image
image/gif

2a02:6ea0:c700::11
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://load77.exelator.com/pixel.gif
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Server: 2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Thu, 05 Oct 2023 10:41:48 GMT
x-cache: HIT
x-77-cache: HIT
x-age: 62123
x-accel-date: 1696440385
content-length: 43
x-77-nzt: AcO1ryc3Nzf/q/IAAA
x-accel-expires: @1697477185
x-77-age: 62123
last-modified: Wed, 25 Oct 2017 17:03:56 GMT
server: CDN77-Turbo
etag: "59f0c3fc-2b"
x-77-nzt-ray: 25b021310326d43bec921e653e543520
content-type: image/gif
access-control-allow-origin: *
accept-ranges: bytes

Redirect headers

date: Thu, 05 Oct 2023 10:41:48 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://load77.exelator.com/pixel.gif
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
content-length: 0

GET
H2 451 398366.gif
idsync.rlcdn.com/ Frame 9051 0
98 B 88ms
30ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/398366.gif?partner_uid=3949932466863171880
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:48 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 404 gdpr_consent=
sync.crwdcntrl.net/map/c=6466/tp=ADFM/tpid=3949932466863171880/gdpr=/ Frame 9051 49 B
265 B 176ms
82ms Image
image/gif 52.31.175.73
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=6466/tp=ADFM/tpid=3949932466863171880/gdpr=/gdpr_consent=
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.175.73 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-175-73.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.31.19
content-length: 49
expires: 0

GET
H2 200 29729
tags.bluekai.com/site/ Frame 9051 62 B
218 B 247ms
163ms Image
image/gif 69.192.160.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/29729?id=3949932466863171880
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.192.160.219 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-219.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Thu, 05 Oct 2023 10:41:48 GMT
content-length: 62
content-type: image/gif

GET
H2 200 sd
eu-u.openx.net/w/1.0/ Frame 9051 43 B
264 B 194ms
144ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=3949932466863171880
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

pixel.gif
s3-eu-west-1.amazonaws.com/adality-cdn-content/ Frame 9051
Redirect Chain

https://api.adrtx.net/thirdparty/click?p=adfo
https://s3-eu-west-1.amazonaws.com/adality-cdn-content/pixel.gif

35 B
390 B

156ms
65ms

Image
image/gif

52.218.36.234
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-eu-west-1.amazonaws.com/adality-cdn-content/pixel.gif
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: HTTP/1.1
Server: 52.218.36.234 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 10:41:49 GMT
Last-Modified: Thu, 29 Oct 2015 16:41:57 GMT
Server: AmazonS3
x-amz-request-id: 5SBDGRN2ZHKR1MDX
ETag: "c2196de8ba412c60c22ab491af7b1409"
Content-Type: image/gif
Accept-Ranges: bytes
Content-Length: 35
x-amz-id-2: 1JKj3SuJTjvZIG5qZO507VpvOYHzrH4Kmq82yDCDkDbLMkltbTt+2QPbhatzvwgUgNCBO5iJGP4=

Redirect headers

X-Error-Reason: Missing UserId
Date: Thu, 05 Oct 2023 10:41:47 GMT
Server: akka-http/10.2.10
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: https://s3-eu-west-1.amazonaws.com/adality-cdn-content/pixel.gif
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 137

GET
H2

200

generic
match.adsrvr.org/track/cmf/ Frame 9051
Redirect Chain

https://pixel.onaudience.com/?mapped=3949932466863171880&partner=68
https://sync.crwdcntrl.net/map/c=8587/tp=CLOD/tpid=d9cb6615436a2baf/gdpr=1/gdpr_consent=?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%...
https://pixel.onaudience.com/?partner=104&icm&cver&mapped=&gdpr=1
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=1

70 B
148 B

52ms
52ms

Image
image/gif

52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=1
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:48 GMT
server: Kestrel
content-length: 70
content-type: image/gif

Redirect headers

location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=1
content-length: 0

GET
H/1.1

200
OK

/
cm.adsafety.net/ Frame 9051
Redirect Chain

https://cm.adsafety.net/?_cmsrc=adformx&idt=100&did=3949932466863171880
https://ads.smartstream.tv/cm/?cmsrc=cm&cm_uid=CM12023100510f642e7aa6085019cf02&redirect=https%3A%2F%2Fcm.adsafety.net%2F%3F_cmsrc%3Dstv%26_chainsrc%3Dcommon&gdpr_consent=
https://cm.adsafety.net/?_cmsrc=stv&_chainsrc=common&idt=100&did=ee91f040dea2de0ebee3fc1bfe904683&idt_did_status=added&gdpr_consent=&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=dataxtrade_dmp&google_cm&google_hm=Q00xMjAyMzEwMDUxMGY2NDJlN2FhNjA4NTAxOWNmMDI&gdpr_consent=&gdpr=0
https://cm.adsafety.net/?_cmsrc=dbmx&midt=100&mdid=CAESEDPckxqGp3tUU22xgun4XTc&gdpr_consent=&gdpr=0&google_cver=1
https://c1.adform.net/serving/cookie/match?party=28&cid=CM12023100510f642e7aa6085019cf02
https://cm.adsafety.net/?_cmsrc=adform&idt=100&did=3949932466863171880
https://tags.adsafety.net/v1/cm?cm_uid=CM12023100510f642e7aa6085019cf02&redirect=https%3A%2F%2Fcm.adsafety.net%2F%3F_cmsrc%3Dct%26_chainsrc%3Dcommon%26idt%3D%5B%25IDT%25%5D%26did%3D%5B%25DID%25%5D&...
https://cm.adsafety.net/?_cmsrc=ct&_chainsrc=common&idt=100&did=ee91f040dea2de0ebee3fc1bfe904683

43 B
2 KB

25ms
25ms

Image
image/gif

62.141.38.122
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adsafety.net/?_cmsrc=ct&_chainsrc=common&idt=100&did=ee91f040dea2de0ebee3fc1bfe904683
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: HTTP/1.1
Server: 62.141.38.122 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: cm44.as.net
Software: nginx /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 Oct 2023 10:41:48 GMT
Last-Modified: Thu, 05 Oct 2023 10:41:48 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
Connection: keep-alive
Expires: Mon, 28 Jul 1997 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 05 Oct 2023 10:41:48 GMT
Last-Modified: Thu, 05 Oct 2023 10:41:48 GMT
Server: nginx
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=UTF-8
Location: https://cm.adsafety.net/?_cmsrc=ct&_chainsrc=common&idt=100&did=ee91f040dea2de0ebee3fc1bfe904683
Access-Control-Allow-Origin: *
Cache-Control: post-check=0, pre-check=0
Connection: keep-alive
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 204 usermatch.gif
beacon.krxd.net/ Frame 9051 0
337 B 184ms
36ms Image
text/plain 79.125.32.89
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=adform&partner_uid=3949932466863171880
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 79.125.32.89 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-79-125-32-89.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: beacon-n009-dub-prod.krxd.net
date: Thu, 05 Oct 2023 10:41:48 GMT
cache-control: private, no-cache, no-store
x-request-time: D=46 t=1696502508
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

/
c1.adform.net/serving/cookie/match/ Frame 9051
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_cm&google_ula=1641347&party=1&google_hm=Mzk0OTkzMjQ2Njg2MzE3MTg4MA
https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMZemnbzG_2VYIHj4r3R-Xw&google_cver=1&google_ula=1641347,0

35 B
591 B

44ms
43ms

Image
image/gif

37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMZemnbzG_2VYIHj4r3R-Xw&google_cver=1&google_ula=1641347,0

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645

Protocol

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMZemnbzG_2VYIHj4r3R-Xw&google_cver=1&google_ula=1641347,0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 334
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
secure.adnxs.com/ Frame 9051
Redirect Chain

https://secure.adnxs.com/getuid?https://c1.adform.net/serving/cookie/match?party=3&id=$UID&redirect=1
https://c1.adform.net/serving/cookie/match?party=3&id=2972291638147184319&redirect=1
https://secure.adnxs.com/setuid?entity=91&code=3949932466863171880

43 B
827 B

48ms
48ms

Image
image/gif

185.89.210.82
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/setuid?entity=91&code=3949932466863171880

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645

Protocol

Server

185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
an-x-request-uuid: 368a4029-2dfa-4f9a-936a-a73c029d4ee0
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.35; 81.95.5.35; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://secure.adnxs.com/setuid?entity=91&code=3949932466863171880
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame 9051 42 B
472 B 172ms
29ms Image
image/gif 198.47.127.205
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=3949932466863171880
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 05 Oct 2023 10:41:47 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 plf
c1.adform.net/imatch/ Frame 9051 0
384 B 29ms
25ms Image
text/plain 37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/imatch/plf?name=plfm

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H/1.1 200
OK cs
pdw-adf.userreport.com/ Frame 9051 43 B
444 B 96ms
8ms Image
image/gif 65.9.66.72
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pdw-adf.userreport.com/cs
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-72.fra56.r.cloudfront.net
Software: nginx/1.22.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 05:16:01 GMT
Via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx/1.22.0
X-Amz-Cf-Pop: FRA56-C1
Age: 19547
X-Cache: Hit from cloudfront
Content-Type: image/gif
Connection: keep-alive
Content-Length: 43
X-Amz-Cf-Id: OQsgaXXTXy3wWyJ0-G4h6XUfk2RdQEid5YmS0RQEdDVWDKTcVO6tyw==

GET
H/1.1

200

p
a.audrte.com/ Frame 9051
Redirect Chain

https://a.audrte.com/a?adform_uid=3949932466863171880
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=OGY3VE5PVERuVW9ReGV2ZmJpdDdYUDNpUQ==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL...
https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent=
https://a.audrte.com/p

68 B
424 B

91ms
91ms

Image
image/png

52.203.124.67
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: HTTP/1.1
Server: 52.203.124.67 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-203-124-67.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 10:41:49 GMT
Server: nginx/1.22.1
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Thu, 05 Oct 2023 10:41:49 GMT
Server: nginx/1.22.1
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Origin: *
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H2

200

match
c1.adform.net/serving/cookie/ Frame 9051
Redirect Chain

https://dpm.demdex.net/ibs:dpid=1586&dpuuid=3949932466863171880&redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1007%26cid%3D%24%7BDD_UUID%7D%26noredirect%3D1
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1586&dpuuid=3949932466863171880&redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1007%26cid%3D%24%7BDD_UUID%7D%26noredire...
https://c1.adform.net/serving/cookie/match?party=1007&cid=45294225948898933542415791631936408863&noredirect=1

35 B
591 B

32ms
32ms

Image
image/gif

37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=1007&cid=45294225948898933542415791631936408863&noredirect=1

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645

Protocol

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

DCS: dcs-prod-irl1-1-v051-0f0c3ba8d.edge-irl1.demdex.com 4 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: lPOeADTmT1k=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://c1.adform.net/serving/cookie/match?party=1007&cid=45294225948898933542415791631936408863&noredirect=1
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

/
dmp.adform.net/serving/cookie/match/ Frame 9051
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9212269628&_puid=3949932466863171880
https://dmp.adform.net/serving/cookie/match/?party=1014&cid=219563204660001753379

35 B
600 B

36ms
35ms

Image
image/gif

37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.adform.net/serving/cookie/match/?party=1014&cid=219563204660001753379

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645

Protocol

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
server: AAWebServer
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://dmp.adform.net/serving/cookie/match/?party=1014&cid=219563204660001753379
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
expires: 0

GET
H2

200

/
dmp.adform.net/serving/cookie/match/ Frame 9051
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?redirect=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1049%26cid%3D%25%25COOKIE%25%25
https://dmp.adform.net/serving/cookie/match/?party=1049&cid=7286422789458229408

35 B
600 B

65ms
52ms

Image
image/gif

37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.adform.net/serving/cookie/match/?party=1049&cid=7286422789458229408

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645

Protocol

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

Location: https://dmp.adform.net/serving/cookie/match/?party=1049&cid=7286422789458229408
Date: Thu, 05 Oct 2023 10:41:48 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2 200 33302
tags.bluekai.com/site/ Frame 9051 62 B
430 B 276ms
274ms Image
image/gif 69.192.160.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/33302?id=3949932466863171880
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.192.160.219 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-219.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Thu, 05 Oct 2023 10:41:48 GMT
content-length: 62
content-type: image/gif

GET
H/1.1 200
OK img
pixel.mathtag.com/sync/ Frame 9051 43 B
418 B 128ms
39ms Image
image/gif 95.101.148.198
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/sync/img?redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1066%26cid%3D%5BMM_UUID%5D
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.101.148.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-148-198.deploy.static.akamaitechnologies.com
Software: MT3 1031 59fd23a master zrh zrh-pixel-x12 config_version:"1524" /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 10:41:48 GMT
Server: MT3 1031 59fd23a master zrh zrh-pixel-x12 config_version:"1524"
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 43
Expires: Thu, 05 Oct 2023 10:41:47 GMT

GET
H2

200

match
c1.adform.net/serving/cookie/ Frame 9051
Redirect Chain

https://pm.w55c.net/ping_match.gif?st=adform&rurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1084%26cid%3D_wfivefivec_
https://pm.w55c.net/ping_match.gif?scc=1&st=adform&rurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1084%26cid%3D_wfivefivec_
https://c1.adform.net/serving/cookie/match?party=1084&cid=Nl5HOzQ01QOlNG5

35 B
591 B

26ms
24ms

Image
image/gif

37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=1084&cid=Nl5HOzQ01QOlNG5

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645

Protocol

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

Pragma: no-cache
Date: Thu, 05 Oct 2023 10:41:48 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-790-g2a3fdc2#rel-ec2-master i-031606d58fcbc7991@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://c1.adform.net/serving/cookie/match?party=1084&cid=Nl5HOzQ01QOlNG5
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 9051 70 B
148 B 34ms
31ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=71ei9rr&ttd_tpi=1
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:48 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H/1.0 200
OK image.sbmx
global.ib-ibi.com/ Frame 9051 0
72 B 636ms
86ms Image
text/plain 69.169.86.38
AMC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://global.ib-ibi.com/image.sbmx?go=302927&pid=567&xid=3949932466863171880
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: HTTP/1.0
Security: TLS 1.2, RSA, AES_256_CBC
Server: 69.169.86.38 , United States, ASN29838 (AMC, US),
Reverse DNS
Software: BigIP /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Connection: close
Content-Length: 0
Server: BigIP

GET
H2 200 0.gif
id5-sync.com/s/10/ Frame 9051 43 B
921 B 51ms
16ms Image
image/gif 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/s/10/0.gif?puid=3949932466863171880

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Thu, 05 Oct 2023 10:41:47 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

GET
H2

200

/
dmp.adform.net/serving/cookie/match/ Frame 9051
Redirect Chain

https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1145%26cid%3D%7BWEBO_CID%7D
https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1145%26cid%3D%7BWEBO_CID%7D&bounce=1&random=1354630342
https://dmp.adform.net/serving/cookie/match/?party=1145&cid=EsgRSODA/BFeP5oX52xAye

35 B
600 B

30ms
27ms

Image
image/gif

37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.adform.net/serving/cookie/match/?party=1145&cid=EsgRSODA/BFeP5oX52xAye

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645

Protocol

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
via: 1.1 google
last-modified: Thu, 05 Oct 2023 10:41:48 GMT
server: Weborama Collect Frontend
vary: Origin
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
location: https://dmp.adform.net/serving/cookie/match/?party=1145&cid=EsgRSODA/BFeP5oX52xAye
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Tue, 03 Jul 2001 06:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 9051 23 B
163 B 93ms
38ms Image
image/gif 104.75.89.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=119&uid=3949932466863171880
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.89.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-89-75.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

expires: Thu, 05 Oct 2023 10:41:48 GMT
pragma: no-cache
date: Thu, 05 Oct 2023 10:41:48 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

GET pixel.gif
sync.1dmp.io/ Frame 9051 0
0

GET
H2 204 /
s.ad.smaato.net/c/ Frame 9051 0
236 B 122ms
61ms Image
text/plain 2600:9000:211e:ea00:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?dspInit=1001213&dspCookie=3949932466863171880
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:ea00:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:48 GMT
cache-control: no-cache, must-revalidate
via: 1.1 307a3e1075dd3d0976c64513a6ec3d74.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C2
x-amz-cf-id: LME_5WlZPaoN_g7mkiQjGAx1wjJauY5PA323dAQg2L8AEVH4178cfA==
x-cache: Miss from cloudfront

GET
H2

200

match
c1.adform.net/serving/cookie/ Frame 9051
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=2032&partner_device_id=3949932466863171880&partner_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d2007%26cid%3D%24%7BTA_DE...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2032&partner_device_id=3949932466863171880&partner_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d2007%26cid%3D%24%7...
https://c1.adform.net/serving/cookie/match?party=2007&cid=8c0eff85-c436-4de5-828a-7c8ec5e1c8b6

35 B
591 B

24ms
24ms

Image
image/gif

37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=2007&cid=8c0eff85-c436-4de5-828a-7c8ec5e1c8b6

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645

Protocol

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 10:41:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

date: Thu, 05 Oct 2023 10:41:49 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://c1.adform.net/serving/cookie/match?party=2007&cid=8c0eff85-c436-4de5-828a-7c8ec5e1c8b6
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 3949932466863171880
match.contentexchange.me/adform/ Frame 9051 0
49 B 357ms
23ms Image
text/plain 46.19.11.36
SIEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.contentexchange.me/adform/3949932466863171880?redirect_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1219
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 46.19.11.36 , Slovenia, ASN51790 (SIEL, SI),
Reverse DNS: ilog.vsn.si
Software: nginx/1.16.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:49 GMT
content-length: 0
server: nginx/1.16.1

GET
H2 200 xuid
eb2.3lift.com/ Frame 9051 37 B
140 B 331ms
240ms Image
image/gif 13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7354&xuid=3949932466863171880&dongle=AD20
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

GET 296800c6dbd7f8eb22cf034b9927d719.gif
sync.e-volution.ai/ Frame 9051 0
0

GET
H2 204 put
e1.emxdgt.com/ Frame 9051 0
44 B 305ms
7ms Image
text/plain 3.126.31.96
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e1.emxdgt.com/put?d=d52&uid=3949932466863171880
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.31.96 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-31-96.eu-central-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:49 GMT
server: awselb/2.0

GET
H2 204 adf
pixel.sojern.com/idsync/ Frame 9051 0
39 B 22ms
20ms Image
text/plain 107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idsync/adf?adfid=3949932466863171880
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:48 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"

GET
H2 200 plf
c1.adform.net/imatch/ Frame 9051 0
384 B 28ms
27ms Image
text/plain 37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/imatch/plf?name=plfl

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c1.adform.net/imatch/pixels?uid=3949932466863171880&agencyId=8579&advertiserId=2164741&src=tp&rnd=678645
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 10:41:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2 200 blue-qe2-pin.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 7 KB
4 KB 23ms
22ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/blue-qe2-pin.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

6199f38d1f28a31d82f35dec38af1a56c6aaaa06726825d415cf2cbe08794302

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 23 Dec 2022 05:36:18 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 24728731
x-cache: Hit from cloudfront
content-length: 2845
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 19 Feb 2020 11:36:05 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: RE0st3eGmFmoeRjJF09-AwO-cUQBpBc0X-j8Of_BK_SXTdm1-qmeaw==
expires: Sat, 23 Dec 2023 05:36:18 GMT

GET
H2 200 blue-pin.svg
d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/ 775 B
1 KB 25ms
24ms Image
image/svg+xml 2600:9000:223e:1800:2:3039:ce40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/img/blue-pin.svg

Requested by

Host: d1zdqtt14m14p.cloudfront.net
URL: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:1800:2:3039:ce40:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

20ffff80a54a8cf356b45bd4f3b116495cb79f3c5d62e2e6473886474a06e7d3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1zdqtt14m14p.cloudfront.net/wp-content/themes/bbtheme/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 19 Jul 2023 06:31:59 GMT
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff
content-security-policy: frame-ancestors none;
content-encoding: gzip
x-permitted-cross-domain-policies: none
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 6754190
x-cache: Hit from cloudfront
content-length: 457
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Sun, 08 Nov 2020 10:53:13 GMT
server: Apache
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000
feature-policy: microphone 'none'; payment 'none'; sync-xhr 'self' https://www.qe2.com ;
permissions-policy: accelerometer=(), autoplay=(self), encrypted-media=(), fullscreen=*, geolocation=*, microphone=(), payment=(), picture-in-picture=(self), usb=()
accept-ranges: bytes
x-amz-cf-id: 72-0ahga14whrKVB5EFnQ7-x5tIEZ9tJ1X0fwLd-9MQwVfj2M-623Q==
expires: Thu, 18 Jul 2024 06:31:59 GMT

GET
DATA 200
OK truncated
/ 784 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7124300afb79c45a45111f33348a5814dbd0d93064e056d0d6f55225dba53cb1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: sync.1dmp.io
URL: https://sync.1dmp.io/pixel.gif?cid=672a497c-d086-4380-a381-292df6008b87&brid=db693857-60a6-4685-a042-c2286c2ca02d&pid=w&uid=3949932466863171880

Domain: sync.e-volution.ai
URL: https://sync.e-volution.ai/296800c6dbd7f8eb22cf034b9927d719.gif?puid=3949932466863171880

Verdicts & Comments Add Verdict or Comment

119 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

69 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.qe2.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 56nsh3da0inpreire4fgpav310
.qe2.com/	1970-01-21 00:51:02	Name: _ga_9VMH7J2G2K Value: GS1.1.1696502507.1.0.1696502507.60.0.0
.qe2.com/	1970-01-21 00:51:02	Name: _ga Value: GA1.2.142618060.1696502507
.qe2.com/	1970-01-20 15:16:28	Name: _gid Value: GA1.2.1742565445.1696502507
.qe2.com/	1970-01-20 15:15:02	Name: _gat_UA-117211517-1 Value: 1
.qe2.com/	1970-01-20 17:24:38	Name: _fbp Value: fb.1.1696502507498.1509844031
.qe2.com/	1970-01-21 00:51:02	Name: _ga_T3RRMMZGL3 Value: GS1.2.1696502507.1.0.1696502507.60.0.0
.adform.net/	1970-01-20 15:59:40	Name: C Value: 1
.adnxs.com/	1970-01-20 17:24:38	Name: uuid2 Value: 2972291638147184319
.doubleclick.net/	1970-01-21 00:36:38	Name: IDE Value: AHWqTUmfO01AaOldyEfBosT97cUrI7qPvv07ENNbUglqCAbLxNbTen20LC3UI_HbJXY
.adform.net/	1970-01-20 16:41:26	Name: uid Value: 3949932466863171880
.doubleclick.net/	1970-01-20 15:15:03	Name: test_cookie Value: CheckForPermission
.sojern.com/	1970-01-21 00:00:38	Name: cid Value: 4241ead1-4073-39e0-27a3-8d10a07c8427#1696464000000
.sojern.com/	1970-01-20 17:24:38	Name: apnid Value: 2972291638147184319
.sojern.com/	1970-01-21 00:00:38	Name: gid Value: CAESEESlnSORD3Zf_CXHel8fIyU
.sojern.com/	1970-01-21 00:00:38	Name: adfid Value: 3949932466863171880
.adform.net/	1970-01-20 15:16:28	Name: CM Value: 1\|1
.adform.net/	1970-01-20 15:35:12	Name: CM14 Value: 1696588908_1696502508_1_Hu7u4e4e4R7u7u4REREeERERERHhERE
.adscale.de/	1970-01-20 23:57:18	Name: uu Value: fa1ee5a55e2c4ac9854ed8d62320bf91
.adscale.de/	1970-01-20 23:57:18	Name: cct Value: 1696502508186
.casalemedia.com/	1970-01-21 00:00:38	Name: CMID Value: ZR6S7NOdrmZHDzUlFSSEnwAA
.casalemedia.com/	1970-01-20 17:24:38	Name: CMPS Value: 3356
.casalemedia.com/	1970-01-20 17:24:38	Name: CMPRO Value: 3356
.ih.adscale.de/	1970-01-20 23:57:18	Name: tu Value: 4#2164499724#42~3949932466863171880~471250~0~0
.ads.stickyadstv.com/	1970-01-20 16:41:26	Name: uid-bp-617 Value: 3949932466863171880
.ads.stickyadstv.com/	1970-01-20 15:58:14	Name: UID Value: baf473ea6932a061a66624351879d0c7
.seadform.net/	1970-01-20 16:41:30	Name: uid Value: 3949932466863171880
.adnxs.com/	1970-01-20 17:24:38	Name: anj Value: dTM7k!M4/YD>6NRF']wIg2E?jtXyMz!]tb$8i_imf$9G=A^A/r=.xwpDo?]G4GL!O9_^Y(%RpwA=:S)STD._*PlZ[C[-kX-PEQY4
.semasio.net/	1970-01-21 00:00:38	Name: SEUNCY Value: B47E0D1B47B8FC3E
.eyeota.net/	1970-01-20 15:15:03	Name: SERVERID Value: 21571~DM
.exelator.com/	1970-01-20 18:07:50	Name: EE Value: "2a47b1bf11a0767e3a8f3dfd4ee941fd"
.exelator.com/	1970-01-20 18:07:50	Name: ud Value: "eJxrXxzq6XKLQcEo0cQ8yTApzdAw0cDczDzVONEizTglLcUkNdXSxDAtZXFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDQfEl%252BUWb6IhfXxUUpaQyLSopPBR%252Bt3w4AzTUrHw%253D%253D"
cm.adsafety.net/	1970-01-21 00:00:38	Name: UID Value: CM12023100510f642e7aa6085019cf02
.adsafety.net/	1970-01-21 00:00:38	Name: cm_uid Value: CM12023100510f642e7aa6085019cf02
.pubmatic.com/	1970-01-20 15:58:14	Name: KRTBCOOKIE_391 Value: 22924-3949932466863171880&KRTB&23263-3949932466863171880&KRTB&23481-3949932466863171880
.pubmatic.com/	1970-01-20 15:58:14	Name: PugT Value: 1696502507
.krxd.net/	1970-01-20 19:34:14	Name: _kuid_ Value: P1i2dd4g
ads.smartstream.tv/	1970-01-21 00:00:38	Name: DID Value: ee91f040dea2de0ebee3fc1bfe904683
ads.smartstream.tv/	1970-01-21 00:00:38	Name: idt Value: 100
ads.smartstream.tv/	1970-01-21 00:00:38	Name: permanent Value: 1
ads.smartstream.tv/	1970-01-20 15:58:14	Name: cm_uid Value: CM12023100510f642e7aa6085019cf02
cm.adsafety.net/	1970-01-21 00:00:38	Name: permanent Value: 1
.adfarm1.adition.com/	1970-01-20 17:24:38	Name: UserID1 Value: 7286422789456984203
.w55c.net/	1970-01-21 00:46:43	Name: wfivefivec Value: Nl5HOzQ01QOlNG5
.agkn.com/	1970-01-21 00:00:38	Name: ab Value: 0001%3A4wD%2F5FLGqBvbOQzP6F9uKR8XPUkyKVN0
.onaudience.com/	1970-01-21 00:00:38	Name: cookie Value: d9cb6615436a2baf
.onaudience.com/	1970-01-20 15:16:28	Name: done_redirects104 Value: 1
.w55c.net/	1970-01-20 15:58:14	Name: matchadform Value: 5
.demdex.net/	1970-01-20 19:34:14	Name: demdex Value: 45294225948898933542415791631936408863
.dpm.demdex.net/	1970-01-20 19:34:14	Name: dpm Value: 45294225948898933542415791631936408863
.weborama.fr/	1970-01-21 00:40:57	Name: AFFICHE_W Value: hcKvdBZ9xb@F10
tags.adsafety.net/	1970-01-21 00:00:38	Name: UID Value: ee91f040dea2de0ebee3fc1bfe904683
tags.adsafety.net/	1970-01-21 00:00:38	Name: DID Value: ee91f040dea2de0ebee3fc1bfe904683
tags.adsafety.net/	1970-01-21 00:00:38	Name: IDT Value: 100
tags.adsafety.net/	1970-01-21 00:00:38	Name: cookie_ver Value: 2
tags.adsafety.net/	1970-01-20 15:58:14	Name: block_reset Value: 1
.adsafety.net/	1970-01-21 00:00:38	Name: ct_uid Value: ee91f040dea2de0ebee3fc1bfe904683
.adsafety.net/	1970-01-21 00:00:38	Name: ct_did Value: ee91f040dea2de0ebee3fc1bfe904683
.adsafety.net/	1970-01-21 00:00:38	Name: ct_idt Value: 100
cm.adsafety.net/	1970-01-21 00:00:38	Name: cache0 Value: KzFHSk9wMUZsMkpMMjlsMzBXenlaL2JrajNNVnljamlRR294Z01Wc3RZMm85dEowRjNVL2poaFZ1ZlZESHEzNWpVQStoU3JjYmFrNEVacGo5akYrMWxIazQ5aHVOVEM2MDJ1RkVWL1JlbFF5UmlDYzVXTWUxMDg0N2s4ckQvRUVDT3JIdTFQcHZUZ0ZESldSM21jYUFjU2k3SVlZM2xLTURLdkYyTGhEOHVYcDNCOUw2V0NGM1lBdjNYU1Vud2JQL1d4RHRBQkVpdHoya2FYMUhwZ1RYUHgwUWtuMWJoa0lzUGdFRGlCYmNvdUVmNnY1dlBQYlo5aDM1dlVJMlhVbko0T0J4LzJnVkMrRnpkWmNVMHU5Mml4OUJJbVgraTVVa1JzVndHT3d2RFVSeTFEdlNCTnMyMjc1TlJkM3V3QVVHL09pZ1d3eTk3eUhhUmJVZi9DL3pNYnVoaVkvb1ZmU2xCVUxNcVdLcHl5eFhZcVNGdS9WR2psSEMvblkxbTAycUo5elAwdTJ1S1NpeHNiQ041b1F6aDRHaWpJY0NsaFZsaFBNMHJSRmJBTlY4SjdQMUl6SThnNjlLanRvYmY5bW8xWVI2TzJta3RxQ1ZlRW04S0NuMFFtZ1hpc2gzMmhVUnpTQks0QW0vYmVxdnJzMEt4UUc0MHpBSkV1OXc4M2Fqb3JQRjJ2Njdscnp3R3BSekwzcWFXWUwwUVQ4cElUOElxbXlvWVNlTHFONHpyaktSWUtiOXR3Z2xQOXM3R0pFcHB4WUVtSkM0NGxtR3ppbkowODJRWjJXSHRTYVFoR2p5Vm9xMXc1WFA4YjFnclAwaUVaeG56VXJlTVFmZnd2K1c5OXhLTjRxaGVuSXdLd0tPR2VCTnJHOUFRdG5nOWQ1UVkvZDBlWm5sRXA4NkVUUUdhZ2RkQ1k1UmN5cXo3NkQ5Y1VGbXF3aG40S05pcmNmMEJRNjlHUGpMZit4UDRLcFgxMnNzekhyV2txa0Mya3pkZ25xY3kvWGFzRUtFTmtsbVUzZTdjL0s2M08zZm5BTElLWUgvY3pIZDRXVUhWT1RJT1ppNUp4by9xbmFlRktwUUdobmFyV2hRU1hrbVNHbHFZT3kyYzFBMmJwNE1kNzZEOVFZR2c9PQ%3D%3D
.bluekai.com/	1970-01-20 19:38:33	Name: bku Value: aG/99m0ucZPJ1c6+
.bluekai.com/	1970-01-20 19:38:33	Name: bkpa Value: KJy9/Qe5d02pSUHknp1p1p90wtkAwE18BeA81p/6BMRTBM1hBpWTme9e9J8zYWA=
.onaudience.com/	1970-01-20 15:16:28	Name: done_redirects147 Value: 1
.audrte.com/	1970-01-20 15:36:38	Name: arcki2 Value: 8f7TNOTDnUoQxevfbit7XP3iQ!20220908!1696502508885!ip#81.95.5.35
.audrte.com/	1970-01-20 15:36:38	Name: arcki2_adform Value: 3949932466863171880!20220908!1696502508888
.tapad.com/	1970-01-20 16:41:26	Name: TapAd_TS Value: 1696502508896
.tapad.com/	1970-01-20 16:41:26	Name: TapAd_DID Value: 8c0eff85-c436-4de5-828a-7c8ec5e1c8b6
.tapad.com/	1970-01-20 16:41:26	Name: TapAd_3WAY_SYNCS Value:
.audrte.com/	1970-01-20 15:36:38	Name: arcki2_ddp2 Value: 8f7TNOTDnUoQxevfbit7XP3iQ!20220908!1696502509199

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Feature-Policy header: Some features are specified in both Feature-Policy and Permissions-Policy header: microphone, payment. Values defined in Permissions-Policy header will be used.
network	error	URL: https://idsync.rlcdn.com/398366.gif?partner_uid=3949932466863171880 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://sync.crwdcntrl.net/map/c=6466/tp=ADFM/tpid=3949932466863171880/gdpr=/gdpr_consent= Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://sync.e-volution.ai/296800c6dbd7f8eb22cf034b9927d719.gif?puid=3949932466863171880 Message: Failed to load resource: net::ERR_CONNECTION_RESET

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors none;
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.audrte.com
a1.seadform.net
a2.adform.net
aa.agkn.com
ad.360yield.com
ad.doubleclick.net
ad.yieldlab.net
ads.smartstream.tv
ads.stickyadstv.com
adservice.google.com
adservice.google.de
api.adrtx.net
beacon.krxd.net
beacon.sojern.com
c1.adform.net
cm.adsafety.net
cm.g.doubleclick.net
connect.facebook.net
d1zdqtt14m14p.cloudfront.net
dmp.adform.net
dpm.demdex.net
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
e1.emxdgt.com
eb2.3lift.com
eu-u.openx.net
fcmatch.google.com
fcmatch.youtube.com
fonts.googleapis.com
fonts.gstatic.com
global.ib-ibi.com
ib.adnxs.com
id5-sync.com
idsync.rlcdn.com
ih.adscale.de
load77.exelator.com
loadm.exelator.com
match.adsrvr.org
match.contentexchange.me
pdw-adf.userreport.com
pixel.mathtag.com
pixel.onaudience.com
pixel.sojern.com
pixel.tapad.com
pm.w55c.net
ps.eyeota.net
redirect.frontend.weborama.fr
region1.analytics.google.com
rtb-csync.smartadserver.com
s.ad.smaato.net
s2.adform.net
s3-eu-west-1.amazonaws.com
se.semasio.net
secure.adnxs.com
simage2.pubmatic.com
static.sojern.com
static.tacdn.com
stats.g.doubleclick.net
sync.1dmp.io
sync.crwdcntrl.net
sync.e-volution.ai
sync.teads.tv
tags.adsafety.net
tags.bluekai.com
token.rubiconproject.com
uipglob.semasio.net
ups.analytics.yahoo.com
www.facebook.com
www.google-analytics.com
www.google.de
www.googletagmanager.com
www.jscache.com
www.qe2.com
www.tripadvisor.com
x.bidswitch.net
sync.1dmp.io
sync.e-volution.ai
104.18.26.193
104.75.89.75
107.178.244.119
108.129.25.174
13.248.245.213
139.162.147.24
141.95.98.65
142.250.184.194
142.250.185.166
151.101.66.83
172.104.158.251
185.167.164.39
185.86.139.101
185.89.210.82
193.135.9.129
198.47.127.205
2.21.20.202
2001:4860:4802:32::36
23.206.209.57
23.35.237.75
2600:9000:211e:ea00:1b:5138:8a40:93a1
2600:9000:223e:1800:2:3039:ce40:21
2a00:1450:4001:803::2003
2a00:1450:4001:80b::200a
2a00:1450:4001:80e::200e
2a00:1450:4001:81c::2002
2a00:1450:4001:827::2002
2a00:1450:4001:82a::2008
2a00:1450:4001:82b::200e
2a00:1450:4001:830::2003
2a00:1450:4001:830::200e
2a00:1450:400c:c04::9d
2a02:6ea0:c700::11
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f177:83:face:b00c:0:25de
3.121.134.250
3.126.31.96
3.71.149.231
3.73.105.217
34.111.113.62
34.246.44.190
34.249.150.14
34.254.109.178
34.254.143.3
34.98.64.218
35.157.26.234
35.190.24.218
35.244.174.68
35.244.188.9
37.157.4.29
37.157.6.234
37.157.6.243
46.19.11.36
51.222.80.231
52.203.124.67
52.218.36.234
52.223.40.198
52.31.175.73
52.57.150.20
62.141.38.122
65.9.66.72
69.169.86.38
69.173.144.165
69.192.160.219
77.243.51.121
79.125.32.89
85.114.159.93
95.101.148.198
00b6ed74f9dbbc3a6679c9488e03d92367f3a9a84603e776a658664002f95617
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
0a1721a5d58454c9736542654e4bcaf7337a9772b5e9d6635c6f98a39d297f2f
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0eb4cfbec827d828a6291f9c90bbbecfc79c5091262662d656ffc819090390fe
1485662d796450f4007c0a163104f27844a27b108caa9c045ea39d0260449c39
19854b5cccafb0f438f0d86301061bf0f3b6f84861e4fcfdd2e451b7c432d52d
1ec53568245e45cbbc96784bb664434c6517a2dbba39904d2be75defccf1182d
1f5e16ca6a71ab2f30d925f1fc0d293533891fa95d5ec2eb417a3721ca576ec5
20ffff80a54a8cf356b45bd4f3b116495cb79f3c5d62e2e6473886474a06e7d3
21ea840550362e3a9e288ea6097b7fd6675a35a55d18162e07558d0e9cce50de
29b2d84b648be7219ab0742fda84ca9b9ead06c20709410685b21fda82aaca8c
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2df29022727e08b1d89c707e38327ae115035d0568d9310fe5e47739761fa4ae
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
3107e5779ba7aef5eb3d38abf73567905761c49a6da871adb8798425745d49db
31d63f0566f6714517b77fee08e181f6d59bd6497df4e0e686ea3d76a790b73e
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
39e8cbda3d0dbdebf90ffd27f3990859a78f3e7561a8ff2b1f12df25306854a7
3d17b025da0f0b154ed1611f9264fa1269d77d5ffb09f64b1c1350beafaa209e
41c6c77f3f052213923de4db028dbb1739b900b44fca8460785b19b30d3d2bc1
4495410c4fed4379b668162aacdfbe6eab10d5e39a29ff9c6d0e135fd7e26a1b
4882b3356202c66430dd6acfc02042447a71f57a84c6ba934d04d5c31be7803d
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b69efb271935ae60c1da42864e95296e4ba9ff12b7c0230b6c277759f94216f
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e4684f18e4c920772c017cb01272d76fd2c27806bd771a0d07e60a0369f4abe
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
573df05aa08d415383b527f34ba575f6d58ba0fef033b6da852ce2327f04b0a0
57a79fab8c7649aeb41bf34b5a9d96176cc27ffbe14c8a7740536976e3ad0481
59fc5a88fa6aad3642d9914c53490174cef0abce3ab397589364018c4acd74e0
6199f38d1f28a31d82f35dec38af1a56c6aaaa06726825d415cf2cbe08794302
6200fd7ac0a1c0d9bbebceba4a943d61e6959fd2db8c7a22acd16ba6be823805
69b85d24e7ceacf67b42b94a6877886294c1856880f3effc7f22fd1a97b4b6db
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7124300afb79c45a45111f33348a5814dbd0d93064e056d0d6f55225dba53cb1
71b55bd025da35caa66b69d6ec16b01322aa217dd7339dd9f4fbc1d30bddc94d
79094ff19836671da581cd093530d058dff33873a169d49f4f99e157289fc420
805270b078cde87b61bb57c8bd44f8b58b0d128f5a8efdd4395470b45b291d65
8183fd82ee119ca755619dd0781847a87517791a3c9f2c4dad6e78fefc9573d9
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
88ab854269f161b857d7cf998ef620fedcbf13ff272c1fde2afc3d2108db483f
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
967e42416ec9d51743d1ddb586930f4133019025d6c1bfcc78b473e43df1a0c8
99c28ba77690124b83aea8cdbbb17ab1145ba247c791aeb4bad747b4248ac459
9bc275748b6e752959c418c0b9745cd9bb9427134086b258d32efdc34cdfad79
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a90e21ca39b126b23712ff533fa8164e82d0c69bb9e666111a98e00d659f84cf
aece1f85aa2e2cd853a39d0bedba58b7f21f0d4d7d68c3f428729c775a1b1af8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b148a123dd65aa6603102281e5203539c1e3ad6514e035a9fd4096e5779017d3
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
be896fd9c4433bdc88e8f61efd9b980d47cf2c062e58dc7eff8e309f196bdeaf
c10a6dd00a64ddae4e61608baa4f15cd5427a3a925407857c96717e19df409d0
c541240818310fe8ff748795716bb51fa6e0702eb843ae3ca65286dbfe702508
c8ad234dbf69dbbd0591529b69dcc2dd213b9c5765f5cd5c3bfe45437a7537d9
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d4ca054ec6ad22876414693df7e5ea685833c3c462325dc54fecc75c4d891f3c
dcc7beea8d2346b46155b3f6c5a9d0c5708a8ded98ce066aa15b9e1d8158c27e
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
ded6dff29c705adb48c831fe4a652814472affd0e7164d66832b00f594573b7f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5c9d7ae8906342aec278578556e487e335b8fa70c536eb93a91d48ce6e55474
e6ab868fb10dfd43c69d0e8062068e551a9ee44b5d2894dd2d6b9b9063609c31
e80d16372db62c37941adb80895949bce9106e87323f3bbb0cdc4465a63d2d53
e94e0140ad5ee0dd772ad05d9ba5cc4cf3e2a1f5d420ea5cb783edbdbdda9f10
e9ab8622c3331d34e83e71075072f6db718e4bcef6592ec1dc47557a007ac025
edb1df31b97a8ef7faafb459576082cf68715e4f82807b9dcc1f0a818a2ba887
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

www.qe2.com Open in urlscan Pro 172.104.158.251 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

118 Requests

78 %HTTPS

24 %IPv6

61 Domains

75 Subdomains

53 IPs

9 Countries

1173 kBTransfer

2658 kBSize

69 Cookies

15 Outgoing links

Page URL History

Redirected requests

118 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.qe2.com Open in urlscan Pro
172.104.158.251 Public Scan

Screenshot
Live screenshot

Full Image

118
Requests

78 %
HTTPS

24 %
IPv6

61
Domains

75
Subdomains

53
IPs

9
Countries

1173 kB
Transfer

2658 kB
Size

69
Cookies

118 HTTP transactions
1 data transactions