www.edocr.com Open in urlscan Pro
18.213.171.36 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know
Submission: On March 25 via manual (March 25th 2022, 3:19:35 am UTC) from US — Scanned from DE

Summary HTTP 131 Redirects Behaviour Indicators

Summary

This website contacted 25 IPs in 5 countries across 16 domains to perform 131 HTTP transactions. The main IP is 18.213.171.36, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.edocr.com.
TLS certificate: Issued by Amazon on April 28th 2021. Valid for: a year.

This is the only time www.edocr.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10	18.213.171.36 18.213.171.36	14618 (AMAZON-AES) (AMAZON-AES)
11	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
1	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
13	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
5	185.29.134.249 185.29.134.249	30419 (MEDIAMATH...) (MEDIAMATH-INC)
3	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
2	78.46.23.46 78.46.23.46	24940 (HETZNER-AS) (HETZNER-AS)
11	34.251.154.165 34.251.154.165	16509 (AMAZON-02) (AMAZON-02)
2	2.18.233.201 2.18.233.201	16625 (AKAMAI-AS) (AKAMAI-AS)
4	178.63.52.121 178.63.52.121	24940 (HETZNER-AS) (HETZNER-AS)
4	185.29.132.245 185.29.132.245	30419 (MEDIAMATH...) (MEDIAMATH-INC)
1	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
3	46.4.10.47 46.4.10.47	24940 (HETZNER-AS) (HETZNER-AS)
3	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
7	37.157.2.239 37.157.2.239	198622 (ADFORM) (ADFORM)
28	37.157.6.235 37.157.6.235	198622 (ADFORM) (ADFORM)
2	85.114.131.235 85.114.131.235	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
2	2a00:1450:400... 2a00:1450:4001:811::2006	15169 (GOOGLE) (GOOGLE)
131	25

10 18.213.171.36 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-213-171-36.compute-1.amazonaws.com

www.edocr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.29.134.249 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)

tags.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 78.46.23.46 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.46.23.46.78.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 34.251.154.165 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-154-165.eu-west-1.compute.amazonaws.com

s.update.mediamathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.233.201 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-201.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 178.63.52.121 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.121.52.63.178.clients.your-server.de

hal900020.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.29.132.245 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 46.4.10.47 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.47.10.4.46.clients.your-server.de

hal90002.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 37.157.2.239 (Denmark)

ASN198622 (ADFORM, DK)

track.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 37.157.6.235 (Denmark)

ASN198622 (ADFORM, DK)

s1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 85.114.131.235 (Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: srv21039.dus4.fastwebserver.de

cdn.contentspread.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
35	adform.net track.adform.net — Cisco Umbrella Rank: 3334 s1.adform.net — Cisco Umbrella Rank: 8028	394 KB
24	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 90 tpc.googlesyndication.com — Cisco Umbrella Rank: 122	309 KB
11	mediamathtag.com s.update.mediamathtag.com — Cisco Umbrella Rank: 7940	54 KB
11	mathtag.com tags.mathtag.com — Cisco Umbrella Rank: 2892 pixel.mathtag.com — Cisco Umbrella Rank: 1093 sync.mathtag.com — Cisco Umbrella Rank: 384	9 KB
10	edocr.com www.edocr.com	647 KB
9	redintelligence.net hal9000.redintelligence.net — Cisco Umbrella Rank: 28803 hal900020.redintelligence.net — Cisco Umbrella Rank: 180906 hal90002.redintelligence.net — Cisco Umbrella Rank: 204200	13 KB
9	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 38	57 KB
4	gstatic.com www.gstatic.com fonts.gstatic.com	59 KB
3	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 147	109 KB
2	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 246	91 KB
2	contentspread.net cdn.contentspread.net — Cisco Umbrella Rank: 45661	2 KB
2	google.com adservice.google.com — Cisco Umbrella Rank: 57 www.google.com — Cisco Umbrella Rank: 2	2 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	20 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	1 KB
1	google.de adservice.google.de — Cisco Umbrella Rank: 8832	792 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 716	642 B
131	16

	Domain	Requested by
28	s1.adform.net	track.adform.net s1.adform.net www.edocr.com
13	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net
11	s.update.mediamathtag.com	tags.mathtag.com s.update.mediamathtag.com
11	pagead2.googlesyndication.com	www.edocr.com pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
10	www.edocr.com	www.edocr.com
9	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net www.edocr.com www.googletagservices.com
7	track.adform.net	hal900020.redintelligence.net hal90002.redintelligence.net s1.adform.net
5	tags.mathtag.com	googleads.g.doubleclick.net tags.mathtag.com
4	sync.mathtag.com	tags.mathtag.com sync.mathtag.com googleads.g.doubleclick.net
4	hal900020.redintelligence.net	hal9000.redintelligence.net hal900020.redintelligence.net
3	fonts.gstatic.com	fonts.googleapis.com
3	hal90002.redintelligence.net	hal9000.redintelligence.net hal90002.redintelligence.net
3	www.googletagservices.com	googleads.g.doubleclick.net
2	s0.2mdn.net	s1.adform.net
2	cdn.contentspread.net	hal900020.redintelligence.net hal90002.redintelligence.net
2	pixel.mathtag.com	tags.mathtag.com
2	hal9000.redintelligence.net	www.edocr.com
2	www.google-analytics.com	www.edocr.com www.google-analytics.com
1	www.gstatic.com	googleads.g.doubleclick.net
1	fonts.googleapis.com	googleads.g.doubleclick.net
1	www.google.com	tpc.googlesyndication.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
131	24

This site contains no links.

Subject Issuer	Validity	Valid
edocr.com Amazon	`2021-04-28` - `2022-05-27`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
*.mathtag.com DigiCert SHA2 Secure Server CA	`2020-04-15` - `2022-04-22`	2 years	crt.sh
redintelligence.net R3	`2022-01-27` - `2022-04-27`	3 months	crt.sh
update.mediamathtag.com R3	`2022-02-24` - `2022-05-25`	3 months	crt.sh
pixel.mathtag.com DigiCert SHA2 Secure Server CA	`2021-06-29` - `2022-07-07`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
track.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2021-09-06` - `2022-10-07`	a year	crt.sh
contentspread.net R3	`2022-01-27` - `2022-04-27`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh

This page contains 16 frames:

Primary Page: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know
Frame ID: 21F9917EAE60D19BEC39770188FB9F01
Requests: 25 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220323/r20190131/zrt_lookup.html
Frame ID: D0C0F1979103B79E983E247113A3768F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=8628223775&adk=2306401753&adf=1981261236&pi=t.ma~as.8628223775&w=350&lmt=1648178370&psa=0&format=350x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370137&bpp=6&bdt=1266&idt=120&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&correlator=2127865254662&frm=20&pv=2&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-975&ady=474&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CaeE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ds7Y7SKCe7&p=https%3A//www.edocr.com&dtd=138
Frame ID: C58AF87B687E97AF7DB69C4F9A0538C7
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=3095482696&pi=t.ma~as.3952982610&w=120&lmt=1648178370&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370143&bpp=1&bdt=1271&idt=138&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250&correlator=2127865254662&frm=20&pv=1&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=tJp9awNCth&p=https%3A//www.edocr.com&dtd=143
Frame ID: 25F40298C03466C6BA158774461982F4
Requests: 18 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=485626509&pi=t.ma~as.4103433139&w=300&lmt=1648178370&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370144&bpp=1&bdt=1272&idt=145&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250%2C120x600&correlator=2127865254662&frm=20&pv=1&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1270&ady=185&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=Bp2Ol6JAn6&p=https%3A//www.edocr.com&dtd=148
Frame ID: 0013AC2748DD7002535C2BFE303623C7
Requests: 25 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&adk=1812271804&adf=3025194257&lmt=1648178370&plat=1%3A16777216%2C2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370174&bpp=1&bdt=1303&idt=120&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250%2C120x600%2C300x250&nras=1&correlator=2127865254662&frm=20&pv=1&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=127
Frame ID: 0DCF0DD810DD0E4B75A41A61A5491801
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 8D2AF4834A3E18B9673EE9CDB9ABCFCD
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 6150D87079E1CE0D5C4B9A08469A9464
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=Cn1swwTQ9YpO4MZC63wOT37uACc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBJ4CT9A6vUZegTGaxnisZcG-ykQzRJ8Wyrm3yXW5ym6pKHA5FYVFdqYi3YvgIsobOsMXycSwNA9ZSifgpI9swjqQoT_27RZLurKjPpEhg_lglKPByhEN3-1OhtHGzMoL3fDyRVM0fZviDtZ4078Tdp4gODjg4YjBiGidelya8VDgfTRyBaVZIXU2gEyHvErmHVyOUZCVbw1r37gIiAL3-C7gx5WA9G-DPZHuIYaoVZDqq0Bi9V0oDZhcEEqgPH0lKOdRTB8oiELuaufW8AVIIpt0BdBdYOi87pWeeJK4IoJqU3kaCTX4VpAeCwX_oY3JziieM32vKLnsAmdSg5KSJYauC0-FHQRbaqCUtclxscI1Z7n2j7s_9V8IUMpabbqoeYAG8Zj3gKKb94ZyoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAGACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItNjkzMzQ2MTk0MDYyNzY0MRgA&sigh=elYmy0bFc-8&uach_m=[UACH]&cid=CAQSGwCNIrLMw44EPRRkLwwqTY-UV5oVoQ0I9KkSIBgB&tpd=AGWhJmtghFKM0S7jLM5RoNFBBTKoBTIl_Ti1qqs1Dchetdbv6JaccCc7wjiMvYN4YKq-QFXd_Zh5y9vwQEY3870hD0h63fzx6DD0cU0A1zovtAXkriE-UCM8cdwWPwmMCI4qMDU2L-uFWPOsNLxILlEgCsuYoopwry6p5_LH_xSeqBtcy1oxAl1W9487VY0YhHqoHXaiMCegTY6X8z84FePiyubRMdvbjV5DCeOLgS0tqecHRJJLvPHy768xnoOcWN3yG8CmPYrz4vTxoJ9TbwWNg97VbLqzemouJgy3l7K7QDL73bOswApsPeuHix1k2of5yOCUqF7Q2W0JkMup1_-u-w5YfRCBtc6GhOFH2xQrwWvxwaYsMnzw4I3-GesW6VYun0kZB1R_Fb2MxARBMte_oVVyWGSP3LIDKqzP5IN5l12MVR7Uahv43zz_4pEt94PlPy7iI2Vc-XbecbhZ1cRUEoYcMyu8P8g4kO827MKn4RMc779NK9GXBcZ5m6dauDubenORPMk0DcJ_mQeRxTrkyzQbAkQW4_02UWttpxpJh7OJKEHylDcsuVbYRjGg-uz9VpwUt-qqBPDsLHeOJMR6uYhcDHmmXQ5BNUpY5x4x14xGcUAukFQe3rO-dmgV9hXSO0d9H3SzO26JuL85iCqRbTCQ4Of-etr5_fORMM3sBv_hKmVVnjVEYhN8EzzHX3DSxalL4x90lczDHb_C0FRA_vbn04DGQZoNBhjeOFmgo0N1jsgfyF_6L_yG5iFQn7YJEyP01pEHCHTixXc3b1jpcX_NOX_XcvECiXGO9ZssFXFhdJJYOItd4hyvyfSx589Y_lxLJzNTzaELnIaJsD-RDs9Wu6oinBXpQp0ob-0eU9HycSEJRsR8N_EJmprLWf36awIxcsJJWdkVr7YYb8H0yVDKtYijnO0DjOVQTah6IyeF9vgWbzDY_OJbhsiQSnpUstZcm5RVi7JiH8EFjb2i6tWtXdGTWOknIsOmKdRW1XsNyOAw7GZp_EGT4X6BBq45muFdT00utr3EVYlGqFm0pPqy1ijtk3mN6cnSJHMibQyYk_zP8r_HPMFoKSYlaer-tjo9oV3bSU3_ihs
Frame ID: 8AD3D3DD8ECA5B3B1A7BD83915041B3E
Requests: 12 HTTP requests in this frame

Frame: https://hal900020.redintelligence.net/request_content.php?s=26621700014050404380384011909020&a=4ce7d508
Frame ID: 61554A4E76D5090E6898319A85387AFE
Requests: 11 HTTP requests in this frame

Frame: https://hal90002.redintelligence.net/request_content.php?s=69885500011008204380384011909002&a=50b3ab83
Frame ID: F012EB581D0EA4EA9B8D2C2FE7EBE184
Requests: 9 HTTP requests in this frame

Frame: https://sync.mathtag.com/sync/iframe?mt_uuid=bb4e623d-34c2-4f01-89c8-cc53790d2094&no_iframe=1&synclist=4&mt_lim=1&type=1&gdpr=1&gdpr_consent=li&source=bidder
Frame ID: 555AEA0E3189DE2CE02B22704D5C9EDB
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/XFpjqGQyXlGhrIMtqUZEtOx9ZrcGJnYAFO97-LZexEg.js
Frame ID: E0E5FAE3AEA1D71549AEB04146E9CC86
Requests: 1 HTTP requests in this frame

Frame: blob://https://googleads.g.doubleclick.net/f7fa57d2-63fb-4901-b6d6-3616acac38bf
Frame ID: D22BE02F63829E557D3CC9C980D42D80
Requests: 1 HTTP requests in this frame

Frame: https://s1.adform.net/Banners/Elements/Files/160090/10998793/10998793.js?ADFassetID=10998793&bv=258
Frame ID: 8836FF48D51A1FB28672A7699F3699D0
Requests: 13 HTTP requests in this frame

Frame: https://s1.adform.net/Banners/Elements/Files/160090/10998804/10998804.js?ADFassetID=10998804&bv=258
Frame ID: BB5CA3E012E9F805FE0AF9D168A792BC
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

If You Are Suffering PTSD, how to Know | edocr

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Page Statistics

131
Requests

97 %
HTTPS

50 %
IPv6

16
Domains

24
Subdomains

25
IPs

5
Countries

1775 kB
Transfer

4903 kB
Size

11
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

131 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request if-you-are-suffering-ptsd-how-to-know Show response
www.edocr.com/v/517wqd7k/hortensedannelly67/ 7 KB
2 KB 472ms
155ms Document
text/html 18.213.171.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.213.171.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-213-171-36.compute-1.amazonaws.com

Software

/ Express

Resource Hash

cf90ceac479865c66da64bac9449a2917e0654a13dc3870f9ad7fb460b0299e4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

build-number: 2366
content-encoding: gzip
Content-Security-Policy: frame-ancestors 'none'
content-type: text/html; charset=utf-8
date: Fri, 25 Mar 2022 03:19:28 GMT
etag: W/"1a98-gHrrTcGUNUUFBJtB17y24RUkI1w"
vary: Accept-Encoding
x-powered-by: Express
Content-Length: 2147
Connection: keep-alive

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 156 KB
54 KB 54ms
33ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1854c21f36f4fd7c4632eff7b9153f4cdcbbfc7061e45dc60c7a362a4dedf5e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54723
x-xss-protection: 0
server: cafe
etag: 14754760525904595516
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 25 Mar 2022 03:19:28 GMT

GET
H/1.1 200
OK main.00f291007fc7948c83c0.css
www.edocr.com/v/static/ 2 KB
1 KB 108ms
108ms Stylesheet
text/css 18.213.171.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/v/static/main.00f291007fc7948c83c0.css

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.213.171.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-213-171-36.compute-1.amazonaws.com

Software

/ Express

Resource Hash

65e4e63638e9c69fe634cc25b595b20afe3e704f5eb8adf36a551e3c23a12ecf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors 'none'
content-encoding: gzip
etag: W/"814-17f993d2e70"
last-modified: Thu, 17 Mar 2022 18:56:38 GMT
x-powered-by: Express
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=0
date: Fri, 25 Mar 2022 03:19:28 GMT
Connection: keep-alive
accept-ranges: bytes
Content-Length: 957
build-number: 2366

GET
H/1.1 200
OK bundle.js Show response
www.edocr.com/v/static/ 2 MB
574 KB 228ms
119ms Script
application/javascript 18.213.171.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/v/static/bundle.js

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.213.171.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-213-171-36.compute-1.amazonaws.com

Software

/ Express

Resource Hash

aed4513db8174254e7423acc676d4cd8f33ccfd3c52551c56750f714e0535f49

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors 'none'
content-encoding: gzip
etag: W/"20d5e5-17f9957467f"
last-modified: Thu, 17 Mar 2022 19:25:08 GMT
x-powered-by: Express
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0
date: Fri, 25 Mar 2022 03:19:28 GMT
Connection: keep-alive
accept-ranges: bytes
transfer-encoding: chunked
build-number: 2366

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 6278
date: Fri, 25 Mar 2022 01:34:50 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Fri, 25 Mar 2022 03:34:50 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
206 B 13ms
13ms XHR
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1215387951&t=pageview&_s=1&dl=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&ul=en-us&de=UTF-8&dt=If%20You%20Are%20Suffering%20PTSD%2C%20how%20to%20Know%20%7C%20edocr&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1070752040&gjid=1696238629&cid=843357066.1648178369&tid=UA-160144-46&_gid=1845348439.1648178369&_r=1&_slc=1&z=445142953

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.edocr.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 03:19:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.edocr.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220323/r20190131/ Frame D0C0 10 KB
5 KB 26ms
6ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220323/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ce5fc08d0f617e71e1d61bcd79fc7cc1855f4221945b0c09ac774685fe7f52c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4502
x-xss-protection: 0
date: Thu, 24 Mar 2022 14:24:06 GMT
expires: Thu, 07 Apr 2022 14:24:06 GMT
cache-control: public, max-age=1209600
age: 46522
etag: 4044455266028820542
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK 517wqd7k Show response
www.edocr.com/api-user/viewingSession/ 3 KB
2 KB 189ms
189ms XHR
application/json 18.213.171.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/api-user/viewingSession/517wqd7k?isEmbed=false

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.213.171.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-213-171-36.compute-1.amazonaws.com

Software

/ Express

Resource Hash

be8d2506984b22a5aa9f9fcd671777dbedb2839e038c1d6cdd63652f0a931924

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors 'none'
content-encoding: gzip
etag: W/"a38-h8p3NY3ZhHaM27XoScR4Y2L3YQ8"
x-powered-by: Express
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
date: Fri, 25 Mar 2022 03:19:29 GMT
Connection: keep-alive
transfer-encoding: chunked
build-number: 2366

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203170101/ 297 KB
107 KB 49ms
34ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203170101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-6933461940627641&plah=www.edocr.com&bust=31065735

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719b27dfe323e678599d8cf5bebb2744095764a444f9b6bff461e312478a5dd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 109611
x-xss-protection: 0
server: cafe
etag: 2621655698442001611
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 25 Mar 2022 03:19:29 GMT

GET
H/1.1 200
OK restrictions Show response
www.edocr.com/pas/v2/ViewingSessions/hWiqwJET71pC7JVhy6Aqdg/ 226 B
566 B 408ms
408ms XHR
application/json 18.213.171.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/v2/ViewingSessions/hWiqwJET71pC7JVhy6Aqdg/restrictions

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.213.171.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-213-171-36.compute-1.amazonaws.com

Software

nginx / Express

Resource Hash

b1ba9fa4ad8fdf667f000a62ef0aebcd3b169d9e70a0e7079072471016139c68

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accusoft-Gid: S8Pdju6ubyFOiWJajPizYA
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: application/json
Accusoft-Parent-Name: ViewerControl
Referer: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know
Accusoft-Parent-Pid: 0
Accusoft-Parent-Taskid: 0

Response headers

Content-Security-Policy: frame-ancestors 'none'
content-encoding: gzip
server: nginx
x-powered-by: Express
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json;charset=utf-8
access-control-allow-origin: *
date: Fri, 25 Mar 2022 03:19:30 GMT
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-headers: *
Content-Length: 125
build-number: 2366

GET
H/1.1 200
OK 0 Show response
www.edocr.com/pas/Page/q/ 38 KB
19 KB 539ms
538ms XHR
image/svg+xml 18.213.171.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Page/q/0?DocumentID=uhWiqwJET71pC7JVhy6Aqdg&Scale=1&ContentType=svgb

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.213.171.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-213-171-36.compute-1.amazonaws.com

Software

nginx / Express

Resource Hash

40915d40f709750eb1f1e0d1b091e27d51ae05e61783cb35829b041d683c62e0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accusoft-Parent-Name: ViewerControl
Referer: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know
Accusoft-Gid: oWS2C5EcT4wfTfTcidHOxQ
Accept-Language: de-DE,de;q=0.9
Accusoft-Parent-Pid: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accusoft-Parent-Taskid: 0

Response headers

accusoft-data-encrypted: false
content-encoding: gzip
vary: Accept-Encoding
server: nginx
x-powered-by: Express
transfer-encoding: chunked
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
date: Fri, 25 Mar 2022 03:19:30 GMT
Content-Security-Policy: frame-ancestors 'none'
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-headers: *
build-number: 2366

GET
DATA 200
OK truncated
/ 1 KB
1 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b8657baaa6b95a17c934001c3338f3cdff05bf8ce67ffe25c3b7ab53cd580241

Request headers

Referer
Origin: https://www.edocr.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 213 B
642 B 47ms
25ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.edocr.com&callback=_gfp_s_&client=ca-pub-6933461940627641

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203170101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-6933461940627641&plah=www.edocr.com&bust=31065735

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

af5593bd91f52e2007a2073ba805484295d58267e88dd0a48fc6f570ba5af597

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 197
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 46ms
24ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.edocr.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 03:19:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 45ms
23ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.edocr.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 03:19:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C58A 30 KB
11 KB 441ms
428ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=8628223775&adk=2306401753&adf=1981261236&pi=t.ma~as.8628223775&w=350&lmt=1648178370&psa=0&format=350x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370137&bpp=6&bdt=1266&idt=120&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&correlator=2127865254662&frm=20&pv=2&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-975&ady=474&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CaeE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ds7Y7SKCe7&p=https%3A//www.edocr.com&dtd=138

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8477bd11f6b4cce1a91280b37b8c959c7b0870e89cd9484ffbb86221d1132283

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 25 Mar 2022 03:19:30 GMT
server: cafe
content-length: 11293
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 25 Mar 2022 03:19:30 GMT
cache-control: private

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
10 KB 42ms
27ms XHR
application/json 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220323&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

abf8d2aeb03cb656b26c7a29725740627171bfcacb28a6642e4dae2fbc055714

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Mar 2022 03:19:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10620
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 25F4 85 KB
31 KB 521ms
518ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=3095482696&pi=t.ma~as.3952982610&w=120&lmt=1648178370&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370143&bpp=1&bdt=1271&idt=138&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250&correlator=2127865254662&frm=20&pv=1&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=tJp9awNCth&p=https%3A//www.edocr.com&dtd=143

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

806db4e3ac98ee961038785629e89aff582d148133549902f5c88abf17ddb819

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 25 Mar 2022 03:19:30 GMT
server: cafe
content-length: 31297
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 25 Mar 2022 03:19:30 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0013 24 KB
10 KB 301ms
301ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=485626509&pi=t.ma~as.4103433139&w=300&lmt=1648178370&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370144&bpp=1&bdt=1272&idt=145&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250%2C120x600&correlator=2127865254662&frm=20&pv=1&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1270&ady=185&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=Bp2Ol6JAn6&p=https%3A//www.edocr.com&dtd=148

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cace9a9a69b280eb43fca1fe5c83740ddc85bc769c5c5de08d46540f612c22b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 25 Mar 2022 03:19:30 GMT
server: cafe
content-length: 10591
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 25 Mar 2022 03:19:30 GMT
cache-control: private

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 39ms
39ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 03:19:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 39ms
39ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&tn=HEADER&cls=MuiPaper-root%20MuiAppBar-root%20MuiAppBar-positionFixed%20MuiAppBar-colorPrimary%20jss2%20mui-fixed%20MuiPaper-elevation4&ign=false&pw=1600&ph=1200&x=0&y=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 03:19:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0DCF 0
19 B 16ms
15ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&adk=1812271804&adf=3025194257&lmt=1648178370&plat=1%3A16777216%2C2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370174&bpp=1&bdt=1303&idt=120&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250%2C120x600%2C300x250&nras=1&correlator=2127865254662&frm=20&pv=1&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=127

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Fri, 25 Mar 2022 03:19:29 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 25 Mar 2022 03:19:29 GMT
cache-control: private

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 42ms
21ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 25 Mar 2022 03:19:29 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 8D2A 13 KB
5 KB 21ms
6ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 24 Mar 2022 19:54:47 GMT
expires: Fri, 24 Mar 2023 19:54:47 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 26682
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 6150 783 B
1 KB 39ms
18ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

4bf8bb400ae37758a4e865919e301d3796d65f66f8df33b5a5642aaace4cc772

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-b9fHt5lxLLnvZ68L0flNXQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Fri, 25 Mar 2022 03:19:29 GMT
date: Fri, 25 Mar 2022 03:19:29 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-b9fHt5lxLLnvZ68L0flNXQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 XFpjqGQyXlGhrIMtqUZEtOx9ZrcGJnYAFO97-LZexEg.js Show response
pagead2.googlesyndication.com/bg/ Frame 8D2A 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XFpjqGQyXlGhrIMtqUZEtOx9ZrcGJnYAFO97-LZexEg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c5a63a864325e51a1ac832da94644b4ec7d66b70626760014ef7bf8b65ec448

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 01:41:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5866
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13744
x-xss-protection: 0
last-modified: Tue, 22 Mar 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Mar 2023 01:41:43 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 6150 0
0 59ms
59ms Image
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220323&jk=2431937748461322&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 8D2A 0
9 B 6ms
6ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?4ccueQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1 200
OK js Show response
tags.mathtag.com/notify/ Frame 0013 3 KB
2 KB 83ms
48ms Script
application/x-javascript 185.29.134.249
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTkdJNE16Qm1Nemd0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5NjMxNjA4MDcxMjE4ODYzMDcvMTA0MDYyOTAvMTExNDI0ODEvNC9jSGRFdmg2M3BIVnJqNXRsQzhUanM1NnluaDdOZnRLSF9kOGtuTDhSWDlnLzEvNC8wLzAvMTg1MzkyMS8wLzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMzk2MzE2MDgwNzEyMTg4NjMwNy96cmgvMC85MDk5LzMyLzk5OS8yNTgvMjAwMTphYzg6MjA6Oi8wLjAwMC8xNjQ4MTc4MzY5LzE2NDgxOTA5NjkvNC9wdWItNjkzMzQ2MTk0MDYyNzY0MS8/WlTKSblY-ZmQs1EIkKHLmvsgjx0&nodeid=512&group=zrh&auctionid=3963160807121886307&shardkey=3963160807121886307&sid=11142481&cid=10406290&bp=a_bjiibd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.139&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCvPZqwTQ9YpG9MaeOjuwP7NqA2AfPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi02OTMzNDYxOTQwNjI3NjQxyAEJqAMBqgSbAk_QnImxmUJ-awzIpMFc86A_hBj0HjcLs2e4c13M1lXNOqkQKrDrTMrDwgx8zZO7IbEQSGF2paWcIK5_PUt_lCIefYj8AZa3E6ssxAmAV4aoqe53Bdq_09UFzqQBGxpDmnvQD2rkKJyeVmtJTJhsGAaT3MKM892cmLIcoZ5aoanCBxSv9bSxz0kPSGEg5oXMJssNhuaN0eD1EK01_xyWp_i8Ti8FoyOP1R72y0VRfNhk7JRQiL_sFAamGR_zkK9dCsB5aj5dFO-ctsprq6vksHCIZC57granhE5-NPEEYvmDrgUNhC8JmdGvuHcefHcC3VVrBwV3R5bC-T92IY4xoaF-eWeGyACnqr6PR4qPH7YduXc0M4R5SuQjzCCABvGY94Cim_eGcqAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1DpX9kK9aHWyZ_MdexeMUG5hBmTw%26client%3Dca-pub-6933461940627641%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=485626509&pi=t.ma~as.4103433139&w=300&lmt=1648178370&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370144&bpp=1&bdt=1272&idt=145&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250%2C120x600&correlator=2127865254662&frm=20&pv=1&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1270&ady=185&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=Bp2Ol6JAn6&p=https%3A//www.edocr.com&dtd=148
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.134.249 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.305.0 /
Resource Hash: 31cb87fb43bc2ae09ccf078f33fd5836c257ac1047a6059a8f36f817c126302a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Content-Encoding: gzip
x-mm-bid-request-time: 1648178369
Last-Modified: Fri, 25 Mar 2022 03:19:29 GMT
Server: MMBD/3.305.0
x-mm-latency: 34 (0)
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
x-mm-dbg: Count
Cache-Control: no-cache
x-mm-host: cdg-router-x51, zrh-bidder-x67
Connection: close
Content-Type: application/x-javascript; charset=UTF-8
Expires: Fri, 25 Mar 2022 03:19:29 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame 0013 2 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=485626509&pi=t.ma~as.4103433139&w=300&lmt=1648178370&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370144&bpp=1&bdt=1272&idt=145&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250%2C120x600&correlator=2127865254662&frm=20&pv=1&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1270&ady=185&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=Bp2Ol6JAn6&p=https%3A//www.edocr.com&dtd=148

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 02:52:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1624
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 02:52:26 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0013 119 KB
37 KB 38ms
17ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 25 Mar 2022 03:19:30 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame 0013 15 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:08:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 632
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6407
x-xss-protection: 0
server: cafe
etag: 6055885685211612390
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 03:08:58 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 0013 0
0 50ms
50ms Fetch
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CLSVxwTQ9YpG9MaeOjuwP7NqA2AfPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi02OTMzNDYxOTQwNjI3NjQxyAEJqAMBqgSYAk_QnImxmUJ-awzIpMFc86A_hBj0HjcLs2e4c13M1lXNOqkQKrDrTMrDwgx8zZO7IbEQSGF2paWcIK5_PUt_lCIefYj8AZa3E6ssxAmAV4aoqe53Bdq_09UFzqQBGxpDmnvQD2rkKJyeVmtJTJhsGAaT3MKM892cmLIcoZ5aoanCBxSv9bSxz0kPSGEg5oXMJssNhuaN0eD1EK01_xyWp_i8Ti8FoyOP1R72y0VRfNhk7JRQiL_sFAamGR_zkK9dCsB5aj5dFO-ctsprq6vksHCIZC57granhE5-NPEEYvmDrgUNhC8JmdGvuHcefHcC3VVrRQdW1Tp-XTj7hcaaeeHRiXqSwrythKZu-krPsEy8p1ssnR3FTWmABvGY94Cim_eGcqAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBABgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTY5MzM0NjE5NDA2Mjc2NDEYAA&sigh=AhSmbemwtdU&uach_m=[UACH]&cid=CAQSGwCNIrLMVXwh1hEcsaTJKeD2ZtaV2lPbsRY0mBgB&tpd=AGWhJms8FuvIpfR81s_CDx2eJV_Xy_37Tyn4RcHPTiq9GmOziJV04t6IcUsCU7yvYWoRxEOrvHOzqzxClPCCku3uWlq-UIwr_Sdg5jU3UM6jqtOUhCP2ttPu21HlcfksUEVj3QgZw0t17AOUaRNnr5Uz4cEa3HUAUXWxdQIrq3ezZ-x_6WmU2TMyigT2iKZfDphP05mb6M3F9uavVj46mSimGjq7huLZR684ToDQDSrFLj-Vd6vUX8Bo0HQIa2bxCsm4eM2Uso4y1XncCSs29ZObzB-te3V1yR5ZhHYUzQyaP3And1JrClX6ARV_EHbx8QgqCXmxH3au_LgzV0mwAiqGnPgweHeQKKzHhp69JDpRMFvLtYoiI7GfvtOJt3r459GJzZJ4cDCCeuAGVn3JIBKy2IA7iIZ9LJ23XJ1IPw6HYBz6fcTvm_AKs-5d7Y8Y_KZ9ZYmqlxungDbYw76i4mxVEoC16t3lmMpRRlXJA5-OB3qZDWUqNH1d666ws0R0b4opbdT8Le2sB1N9yGtzQ70TmVZIDzVBPHTi66AgJ3461usJghEzr0yIjV25Yz-JDXZqwhFqjqqiWIunqTmCr3dsBuRoYK6NiD4iUukaq3dKzCoiGMWTMc8kDydNZfqIv_b9PCTN_vhNgpFTkoy3h6fRuC4wSiPFo6BK08dWzstyl3qGOjIafHgmqkYI-tGypHljSH9hn51zXX4JaB_QTSsjTAcKt1HcZf1EvrsRB3JtYihZyNHIAjWm9aFb5R46rrWn7KCVXgTwLCqcPPLyR4Qnu78tO_qLEMqOGOlLbEjhkmNIO-JOl9PuExJg5iFPV_x3lmbUrYMRP96hfj8Kcol4M9EzxCOkddZP_xIMDL_-hZEXIsvPb1eBs7R6rrHVTaSBcmiNc-Us6UPJ9h3Yp0FOIw2TkY9CqQHcNag6FguZaPozn9SXYT483A3VT6rpJuz8iucMcYQQHbynnwRnlbCCcm3Lln0vzW8aFIzSwc8sWLtR9aiVS4_tRQx1qXyMbvhtRaI7ysFyvhd0PWLapbZPwFfJKiOgxLF9CRYUc-TfKZY12YXJUW6RKM77RokhlQ5aOklVQuaO4S9-aKY

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=485626509&pi=t.ma~as.4103433139&w=300&lmt=1648178370&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370144&bpp=1&bdt=1272&idt=145&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250%2C120x600&correlator=2127865254662&frm=20&pv=1&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1270&ady=185&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=Bp2Ol6JAn6&p=https%3A//www.edocr.com&dtd=148
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Fri, 25 Mar 2022 03:19:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 25 Mar 2022 03:19:30 GMT

GET
H/1.1 200
OK 9fdzpz67c8h4 Show response
hal9000.redintelligence.net/zone/ Frame 0013 10 KB
4 KB 44ms
12ms Script
text/html 78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/9fdzpz67c8h4?subid=&gdpr=1&gdpr_consent=li&rnd=3963160807121886307&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYj00wQANe-sHg4MiFw__dg%26exch_seat%3D20035004448%26mt_aid%3D3963160807121886307%26mt_id%3D10406290%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_cid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCvPZqwTQ9YpG9MaeOjuwP7NqA2AfPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi02OTMzNDYxOTQwNjI3NjQxyAEJqAMBqgSbAk_QnImxmUJ-awzIpMFc86A_hBj0HjcLs2e4c13M1lXNOqkQKrDrTMrDwgx8zZO7IbEQSGF2paWcIK5_PUt_lCIefYj8AZa3E6ssxAmAV4aoqe53Bdq_09UFzqQBGxpDmnvQD2rkKJyeVmtJTJhsGAaT3MKM892cmLIcoZ5aoanCBxSv9bSxz0kPSGEg5oXMJssNhuaN0eD1EK01_xyWp_i8Ti8FoyOP1R72y0VRfNhk7JRQiL_sFAamGR_zkK9dCsB5aj5dFO-ctsprq6vksHCIZC57granhE5-NPEEYvmDrgUNhC8JmdGvuHcefHcC3VVrBwV3R5bC-T92IY4xoaF-eWeGyACnqr6PR4qPH7YduXc0M4R5SuQjzCCABvGY94Cim_eGcqAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_1DpX9kK9aHWyZ_MdexeMUG5hBmTw%2526client%253Dca-pub-6933461940627641%2526adurl%253D%26redirect%3D
Requested by: Host: www.edocr.com
URL: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 25cd364d1d45142a5ec41bdf88aea959bfb29d2155bfb1f084c8d96c684c5ace

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3421
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK ck-confirm
tags.mathtag.com/ Frame 0013 49 B
329 B 74ms
47ms Image
image/gif 185.29.134.249
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/ck-confirm?bid_id=3963160807121886307&node_id=512&exch_id=4
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTkdJNE16Qm1Nemd0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5NjMxNjA4MDcxMjE4ODYzMDcvMTA0MDYyOTAvMTExNDI0ODEvNC9jSGRFdmg2M3BIVnJqNXRsQzhUanM1NnluaDdOZnRLSF9kOGtuTDhSWDlnLzEvNC8wLzAvMTg1MzkyMS8wLzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMzk2MzE2MDgwNzEyMTg4NjMwNy96cmgvMC85MDk5LzMyLzk5OS8yNTgvMjAwMTphYzg6MjA6Oi8wLjAwMC8xNjQ4MTc4MzY5LzE2NDgxOTA5NjkvNC9wdWItNjkzMzQ2MTk0MDYyNzY0MS8/WlTKSblY-ZmQs1EIkKHLmvsgjx0&nodeid=512&group=zrh&auctionid=3963160807121886307&shardkey=3963160807121886307&sid=11142481&cid=10406290&bp=a_bjiibd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.139&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCvPZqwTQ9YpG9MaeOjuwP7NqA2AfPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi02OTMzNDYxOTQwNjI3NjQxyAEJqAMBqgSbAk_QnImxmUJ-awzIpMFc86A_hBj0HjcLs2e4c13M1lXNOqkQKrDrTMrDwgx8zZO7IbEQSGF2paWcIK5_PUt_lCIefYj8AZa3E6ssxAmAV4aoqe53Bdq_09UFzqQBGxpDmnvQD2rkKJyeVmtJTJhsGAaT3MKM892cmLIcoZ5aoanCBxSv9bSxz0kPSGEg5oXMJssNhuaN0eD1EK01_xyWp_i8Ti8FoyOP1R72y0VRfNhk7JRQiL_sFAamGR_zkK9dCsB5aj5dFO-ctsprq6vksHCIZC57granhE5-NPEEYvmDrgUNhC8JmdGvuHcefHcC3VVrBwV3R5bC-T92IY4xoaF-eWeGyACnqr6PR4qPH7YduXc0M4R5SuQjzCCABvGY94Cim_eGcqAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1DpX9kK9aHWyZ_MdexeMUG5hBmTw%26client%3Dca-pub-6933461940627641%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.134.249 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.305.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Server: MMBD/3.305.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: cdg-router-x90, zrh-bidder-x67
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Fri, 25 Mar 2022 03:19:29 GMT

GET
H/1.1 200
OK analytics.js Show response
s.update.mediamathtag.com/2/619621/ Frame 0013 7 KB
3 KB 188ms
30ms Script
text/javascript 34.251.154.165
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.update.mediamathtag.com/2/619621/analytics.js?dt=6196211556140246740000&pd=avt&di=https%3A//www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know&ui=4b830f38-0000-0000-0000-000000000000&ap=&ti=3963160807121886307&pv=85e8b2c4-4efc-4cab-8dce-a98bbd57d7f1&pp=pub-6933461940627641&sr=4&de=43003&si=2040408330&dm=300x250&ac=1129274&cr=10406290&ai=215543&c1=11142481&r1=2001:ac8:20::&r2=&r3=

Requested by

Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTkdJNE16Qm1Nemd0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5NjMxNjA4MDcxMjE4ODYzMDcvMTA0MDYyOTAvMTExNDI0ODEvNC9jSGRFdmg2M3BIVnJqNXRsQzhUanM1NnluaDdOZnRLSF9kOGtuTDhSWDlnLzEvNC8wLzAvMTg1MzkyMS8wLzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMzk2MzE2MDgwNzEyMTg4NjMwNy96cmgvMC85MDk5LzMyLzk5OS8yNTgvMjAwMTphYzg6MjA6Oi8wLjAwMC8xNjQ4MTc4MzY5LzE2NDgxOTA5NjkvNC9wdWItNjkzMzQ2MTk0MDYyNzY0MS8/WlTKSblY-ZmQs1EIkKHLmvsgjx0&nodeid=512&group=zrh&auctionid=3963160807121886307&shardkey=3963160807121886307&sid=11142481&cid=10406290&bp=a_bjiibd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.139&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCvPZqwTQ9YpG9MaeOjuwP7NqA2AfPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi02OTMzNDYxOTQwNjI3NjQxyAEJqAMBqgSbAk_QnImxmUJ-awzIpMFc86A_hBj0HjcLs2e4c13M1lXNOqkQKrDrTMrDwgx8zZO7IbEQSGF2paWcIK5_PUt_lCIefYj8AZa3E6ssxAmAV4aoqe53Bdq_09UFzqQBGxpDmnvQD2rkKJyeVmtJTJhsGAaT3MKM892cmLIcoZ5aoanCBxSv9bSxz0kPSGEg5oXMJssNhuaN0eD1EK01_xyWp_i8Ti8FoyOP1R72y0VRfNhk7JRQiL_sFAamGR_zkK9dCsB5aj5dFO-ctsprq6vksHCIZC57granhE5-NPEEYvmDrgUNhC8JmdGvuHcefHcC3VVrBwV3R5bC-T92IY4xoaF-eWeGyACnqr6PR4qPH7YduXc0M4R5SuQjzCCABvGY94Cim_eGcqAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1DpX9kK9aHWyZ_MdexeMUG5hBmTw%26client%3Dca-pub-6933461940627641%26adurl%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

34.251.154.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-251-154-165.eu-west-1.compute.amazonaws.com

Software

Resource Hash

6fd51e014f7ab21eec7e153ef3738206cace66412ff99623569519d5f79a6bac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Mar 2022 03:19:30 GMT
Content-Encoding: gzip
Accept-Ch: Viewport-Width, Viewport-Height, Width, DPR, RTT, ECT, Device-Memory, Downlink, Save-Data
Vary: *
Content-Type: text/javascript; charset=utf-8
Cache-Control: no-cache, no-store, must-revalidate, no-transform, private, max-age=0
Strict-Transport-Security: max-age=31536000; includeSubDomains
Timing-Allow-Origin: *
Content-Length: 3044
Expires: 0

GET
H/1.1 200
OK img
pixel.mathtag.com/event/ Frame 0013 43 B
438 B 84ms
31ms Image
image/gif 2.18.233.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=4&v2=3963160807121886307&v3=1129274&v4=11142481&v5=10406290&mt_nsync=1&no_attr=1
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTkdJNE16Qm1Nemd0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5NjMxNjA4MDcxMjE4ODYzMDcvMTA0MDYyOTAvMTExNDI0ODEvNC9jSGRFdmg2M3BIVnJqNXRsQzhUanM1NnluaDdOZnRLSF9kOGtuTDhSWDlnLzEvNC8wLzAvMTg1MzkyMS8wLzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMzk2MzE2MDgwNzEyMTg4NjMwNy96cmgvMC85MDk5LzMyLzk5OS8yNTgvMjAwMTphYzg6MjA6Oi8wLjAwMC8xNjQ4MTc4MzY5LzE2NDgxOTA5NjkvNC9wdWItNjkzMzQ2MTk0MDYyNzY0MS8/WlTKSblY-ZmQs1EIkKHLmvsgjx0&nodeid=512&group=zrh&auctionid=3963160807121886307&shardkey=3963160807121886307&sid=11142481&cid=10406290&bp=a_bjiibd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.139&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCvPZqwTQ9YpG9MaeOjuwP7NqA2AfPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi02OTMzNDYxOTQwNjI3NjQxyAEJqAMBqgSbAk_QnImxmUJ-awzIpMFc86A_hBj0HjcLs2e4c13M1lXNOqkQKrDrTMrDwgx8zZO7IbEQSGF2paWcIK5_PUt_lCIefYj8AZa3E6ssxAmAV4aoqe53Bdq_09UFzqQBGxpDmnvQD2rkKJyeVmtJTJhsGAaT3MKM892cmLIcoZ5aoanCBxSv9bSxz0kPSGEg5oXMJssNhuaN0eD1EK01_xyWp_i8Ti8FoyOP1R72y0VRfNhk7JRQiL_sFAamGR_zkK9dCsB5aj5dFO-ctsprq6vksHCIZC57granhE5-NPEEYvmDrgUNhC8JmdGvuHcefHcC3VVrBwV3R5bC-T92IY4xoaF-eWeGyACnqr6PR4qPH7YduXc0M4R5SuQjzCCABvGY94Cim_eGcqAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1DpX9kK9aHWyZ_MdexeMUG5hBmTw%26client%3Dca-pub-6933461940627641%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-201.deploy.static.akamaitechnologies.com
Software: MT3 4267 dd20a5c master cdg-pixel-x25 config:1.0.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
X-Akamai-Origin-Object-Size: 43
Server: MT3 4267 dd20a5c master cdg-pixel-x25 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 25 Mar 2022 03:19:29 GMT

GET
H/1.1 200
OK img
tags.mathtag.com/event/ Frame 0013 49 B
329 B 71ms
38ms Image
image/gif 185.29.134.249
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/event/img?type=mmImpTrack&exch=adx&bid=3963160807121886307&st=11142481&time=1648178370&nodeid=512
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTkdJNE16Qm1Nemd0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5NjMxNjA4MDcxMjE4ODYzMDcvMTA0MDYyOTAvMTExNDI0ODEvNC9jSGRFdmg2M3BIVnJqNXRsQzhUanM1NnluaDdOZnRLSF9kOGtuTDhSWDlnLzEvNC8wLzAvMTg1MzkyMS8wLzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMzk2MzE2MDgwNzEyMTg4NjMwNy96cmgvMC85MDk5LzMyLzk5OS8yNTgvMjAwMTphYzg6MjA6Oi8wLjAwMC8xNjQ4MTc4MzY5LzE2NDgxOTA5NjkvNC9wdWItNjkzMzQ2MTk0MDYyNzY0MS8/WlTKSblY-ZmQs1EIkKHLmvsgjx0&nodeid=512&group=zrh&auctionid=3963160807121886307&shardkey=3963160807121886307&sid=11142481&cid=10406290&bp=a_bjiibd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.139&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCvPZqwTQ9YpG9MaeOjuwP7NqA2AfPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi02OTMzNDYxOTQwNjI3NjQxyAEJqAMBqgSbAk_QnImxmUJ-awzIpMFc86A_hBj0HjcLs2e4c13M1lXNOqkQKrDrTMrDwgx8zZO7IbEQSGF2paWcIK5_PUt_lCIefYj8AZa3E6ssxAmAV4aoqe53Bdq_09UFzqQBGxpDmnvQD2rkKJyeVmtJTJhsGAaT3MKM892cmLIcoZ5aoanCBxSv9bSxz0kPSGEg5oXMJssNhuaN0eD1EK01_xyWp_i8Ti8FoyOP1R72y0VRfNhk7JRQiL_sFAamGR_zkK9dCsB5aj5dFO-ctsprq6vksHCIZC57granhE5-NPEEYvmDrgUNhC8JmdGvuHcefHcC3VVrBwV3R5bC-T92IY4xoaF-eWeGyACnqr6PR4qPH7YduXc0M4R5SuQjzCCABvGY94Cim_eGcqAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1DpX9kK9aHWyZ_MdexeMUG5hBmTw%26client%3Dca-pub-6933461940627641%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.134.249 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.305.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Server: MMBD/3.305.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: cdg-router-x97, zrh-bidder-x67
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Fri, 25 Mar 2022 03:19:29 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 8AD3 0
0 50ms
50ms Fetch
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cn1swwTQ9YpO4MZC63wOT37uACc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBJ4CT9A6vUZegTGaxnisZcG-ykQzRJ8Wyrm3yXW5ym6pKHA5FYVFdqYi3YvgIsobOsMXycSwNA9ZSifgpI9swjqQoT_27RZLurKjPpEhg_lglKPByhEN3-1OhtHGzMoL3fDyRVM0fZviDtZ4078Tdp4gODjg4YjBiGidelya8VDgfTRyBaVZIXU2gEyHvErmHVyOUZCVbw1r37gIiAL3-C7gx5WA9G-DPZHuIYaoVZDqq0Bi9V0oDZhcEEqgPH0lKOdRTB8oiELuaufW8AVIIpt0BdBdYOi87pWeeJK4IoJqU3kaCTX4VpAeCwX_oY3JziieM32vKLnsAmdSg5KSJYauC0-FHQRbaqCUtclxscI1Z7n2j7s_9V8IUMpabbqoeYAG8Zj3gKKb94ZyoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAGACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItNjkzMzQ2MTk0MDYyNzY0MRgA&sigh=elYmy0bFc-8&uach_m=[UACH]&cid=CAQSGwCNIrLMw44EPRRkLwwqTY-UV5oVoQ0I9KkSIBgB&tpd=AGWhJmtghFKM0S7jLM5RoNFBBTKoBTIl_Ti1qqs1Dchetdbv6JaccCc7wjiMvYN4YKq-QFXd_Zh5y9vwQEY3870hD0h63fzx6DD0cU0A1zovtAXkriE-UCM8cdwWPwmMCI4qMDU2L-uFWPOsNLxILlEgCsuYoopwry6p5_LH_xSeqBtcy1oxAl1W9487VY0YhHqoHXaiMCegTY6X8z84FePiyubRMdvbjV5DCeOLgS0tqecHRJJLvPHy768xnoOcWN3yG8CmPYrz4vTxoJ9TbwWNg97VbLqzemouJgy3l7K7QDL73bOswApsPeuHix1k2of5yOCUqF7Q2W0JkMup1_-u-w5YfRCBtc6GhOFH2xQrwWvxwaYsMnzw4I3-GesW6VYun0kZB1R_Fb2MxARBMte_oVVyWGSP3LIDKqzP5IN5l12MVR7Uahv43zz_4pEt94PlPy7iI2Vc-XbecbhZ1cRUEoYcMyu8P8g4kO827MKn4RMc779NK9GXBcZ5m6dauDubenORPMk0DcJ_mQeRxTrkyzQbAkQW4_02UWttpxpJh7OJKEHylDcsuVbYRjGg-uz9VpwUt-qqBPDsLHeOJMR6uYhcDHmmXQ5BNUpY5x4x14xGcUAukFQe3rO-dmgV9hXSO0d9H3SzO26JuL85iCqRbTCQ4Of-etr5_fORMM3sBv_hKmVVnjVEYhN8EzzHX3DSxalL4x90lczDHb_C0FRA_vbn04DGQZoNBhjeOFmgo0N1jsgfyF_6L_yG5iFQn7YJEyP01pEHCHTixXc3b1jpcX_NOX_XcvECiXGO9ZssFXFhdJJYOItd4hyvyfSx589Y_lxLJzNTzaELnIaJsD-RDs9Wu6oinBXpQp0ob-0eU9HycSEJRsR8N_EJmprLWf36awIxcsJJWdkVr7YYb8H0yVDKtYijnO0DjOVQTah6IyeF9vgWbzDY_OJbhsiQSnpUstZcm5RVi7JiH8EFjb2i6tWtXdGTWOknIsOmKdRW1XsNyOAw7GZp_EGT4X6BBq45muFdT00utr3EVYlGqFm0pPqy1ijtk3mN6cnSJHMibQyYk_zP8r_HPMFoKSYlaer-tjo9oV3bSU3_ihs

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=8628223775&adk=2306401753&adf=1981261236&pi=t.ma~as.8628223775&w=350&lmt=1648178370&psa=0&format=350x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370137&bpp=6&bdt=1266&idt=120&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&correlator=2127865254662&frm=20&pv=2&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-975&ady=474&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CaeE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ds7Y7SKCe7&p=https%3A//www.edocr.com&dtd=138
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Fri, 25 Mar 2022 03:19:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK js Show response
tags.mathtag.com/notify/ Frame 8AD3 3 KB
2 KB 73ms
51ms Script
application/x-javascript 185.29.134.249
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTkdJNE16Qm1Nemd0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5NjMxNjA4MDcxMjE4ODYyNjkvMTA0MDYyOTAvMTExNDI0ODEvNC9jSGRFdmg2M3BIVnJqNXRsQzhUanN5M0dPbEZSV0hzQWtGX0g1SE5TeHdFLzEvNC8wLzAvMTg1MzkyMS8wLzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMzk2MzE2MDgwNzEyMTg4NjI2OS96cmgvMC85MDk5LzMyLzk5OS8yNTgvMjAwMTphYzg6MjA6Oi8wLjAwMC8xNjQ4MTc4MzY5LzE2NDgxOTA5NjkvNC9wdWItNjkzMzQ2MTk0MDYyNzY0MS8/e_7973NXXM_6AoomMSrd59tTBL0&nodeid=512&group=zrh&auctionid=3963160807121886269&shardkey=3963160807121886269&sid=11142481&cid=10406290&bp=a_bjiibd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.134.180&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCr9_QwTQ9YpO4MZC63wOT37uACc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBKECT9A6vUZegTGaxnisZcG-ykQzRJ8Wyrm3yXW5ym6pKHA5FYVFdqYi3YvgIsobOsMXycSwNA9ZSifgpI9swjqQoT_27RZLurKjPpEhg_lglKPByhEN3-1OhtHGzMoL3fDyRVM0fZviDtZ4078Tdp4gODjg4YjBiGidelya8VDgfTRyBaVZIXU2gEyHvErmHVyOUZCVbw1r37gIiAL3-C7gx5WA9G-DPZHuIYaoVZDqq0Bi9V0oDZhcEEqgPH0lKOdRTB8oiELuaufW8AVIIpt0BdBdYOi87pWeeJK4IoJqU3kaCTX4VpAeCwX_oY3JziieM32vKLnsAmcQgbMAiToKDMIhVa-DKg9kqN17Dcgbf1hLT_uQD_4WfNL09Aav9O-BhYAG8Zj3gKKb94ZyoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1Rk6Xf4FVIbuBziMoMbJGaJ49gRg%26client%3Dca-pub-6933461940627641%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=8628223775&adk=2306401753&adf=1981261236&pi=t.ma~as.8628223775&w=350&lmt=1648178370&psa=0&format=350x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370137&bpp=6&bdt=1266&idt=120&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&correlator=2127865254662&frm=20&pv=2&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-975&ady=474&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CaeE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ds7Y7SKCe7&p=https%3A//www.edocr.com&dtd=138
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.134.249 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.305.0 /
Resource Hash: f99987031e482c75b0b80629df2eabc51f2d328452802c11446e601abc6fab0a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Content-Encoding: gzip
x-mm-bid-request-time: 1648178369
Last-Modified: Fri, 25 Mar 2022 03:19:29 GMT
Server: MMBD/3.305.0
x-mm-latency: 34 (0)
Content-Type: application/x-javascript; charset=UTF-8
x-mm-dbg: Count
Cache-Control: no-cache
x-mm-host: cdg-router-x93, zrh-bidder-x67
Connection: close
Expires: Fri, 25 Mar 2022 03:19:29 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame 8AD3 2 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=8628223775&adk=2306401753&adf=1981261236&pi=t.ma~as.8628223775&w=350&lmt=1648178370&psa=0&format=350x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370137&bpp=6&bdt=1266&idt=120&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&correlator=2127865254662&frm=20&pv=2&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-975&ady=474&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CaeE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ds7Y7SKCe7&p=https%3A//www.edocr.com&dtd=138

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 02:52:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1624
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 02:52:26 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8AD3 119 KB
36 KB 51ms
36ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 25 Mar 2022 03:19:30 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame 8AD3 15 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:08:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 632
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6407
x-xss-protection: 0
server: cafe
etag: 6055885685211612390
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 03:08:58 GMT

GET
H/1.1 200
OK request.php Show response
hal900020.redintelligence.net/ Frame 0013 613 B
774 B 131ms
94ms Script
application/x-javascript 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/request.php?zone=9fdzpz67c8h4&nw=20&renderingType=javascript&namespace=da0d47bde6&subid=&uid=44db0c6552ffe24d&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYj00wQANe-sHg4MiFw__dg%26exch_seat%3D20035004448%26mt_aid%3D3963160807121886307%26mt_id%3D10406290%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_cid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCvPZqwTQ9YpG9MaeOjuwP7NqA2AfPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi02OTMzNDYxOTQwNjI3NjQxyAEJqAMBqgSbAk_QnImxmUJ-awzIpMFc86A_hBj0HjcLs2e4c13M1lXNOqkQKrDrTMrDwgx8zZO7IbEQSGF2paWcIK5_PUt_lCIefYj8AZa3E6ssxAmAV4aoqe53Bdq_09UFzqQBGxpDmnvQD2rkKJyeVmtJTJhsGAaT3MKM892cmLIcoZ5aoanCBxSv9bSxz0kPSGEg5oXMJssNhuaN0eD1EK01_xyWp_i8Ti8FoyOP1R72y0VRfNhk7JRQiL_sFAamGR_zkK9dCsB5aj5dFO-ctsprq6vksHCIZC57granhE5-NPEEYvmDrgUNhC8JmdGvuHcefHcC3VVrBwV3R5bC-T92IY4xoaF-eWeGyACnqr6PR4qPH7YduXc0M4R5SuQjzCCABvGY94Cim_eGcqAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_1DpX9kK9aHWyZ_MdexeMUG5hBmTw%2526client%253Dca-pub-6933461940627641%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6933461940627641%26output%3Dhtml%26h%3D250%26slotname%3D4103433139%26adk%3D402904232%26adf%3D485626509%26pi%3Dt.ma~as.4103433139%26w%3D300%26lmt%3D1648178370%26psa%3D0%26format%3D300x250%26url%3Dhttps%253A%252F%252Fwww.edocr.com%252Fv%252F517wqd7k%252Fhortensedannelly67%252Fif-you-are-suffering-ptsd-how-to-know%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1648178370144%26bpp%3D1%26bdt%3D1272%26idt%3D145%26shv%3Dr20220323%26mjsv%3Dm202203170101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D350x250%252C120x600%26correlator%3D2127865254662%26frm%3D20%26pv%3D1%26ga_vid%3D843357066.1648178369%26ga_sid%3D1648178370%26ga_hid%3D1215387951%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D1270%26ady%3D185%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759842%252C31065735%252C31063247%252C31065653%26oid%3D2%26pvsid%3D2431937748461322%26pem%3D702%26tmod%3D2092378864%26uas%3D0%26nvt%3D1%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257Cd%257CeE%257Cp%26abl%3DXS%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D3%26uci%3Da!3%26fsb%3D1%26xpc%3DBp2Ol6JAn6%26p%3Dhttps%253A%2F%2Fwww.edocr.com%26dtd%3D148&ancestorOrigins=null&random=1606466439609&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/9fdzpz67c8h4?subid=&gdpr=1&gdpr_consent=li&rnd=3963160807121886307&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYj00wQANe-sHg4MiFw__dg%26exch_seat%3D20035004448%26mt_aid%3D3963160807121886307%26mt_id%3D10406290%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_cid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCvPZqwTQ9YpG9MaeOjuwP7NqA2AfPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi02OTMzNDYxOTQwNjI3NjQxyAEJqAMBqgSbAk_QnImxmUJ-awzIpMFc86A_hBj0HjcLs2e4c13M1lXNOqkQKrDrTMrDwgx8zZO7IbEQSGF2paWcIK5_PUt_lCIefYj8AZa3E6ssxAmAV4aoqe53Bdq_09UFzqQBGxpDmnvQD2rkKJyeVmtJTJhsGAaT3MKM892cmLIcoZ5aoanCBxSv9bSxz0kPSGEg5oXMJssNhuaN0eD1EK01_xyWp_i8Ti8FoyOP1R72y0VRfNhk7JRQiL_sFAamGR_zkK9dCsB5aj5dFO-ctsprq6vksHCIZC57granhE5-NPEEYvmDrgUNhC8JmdGvuHcefHcC3VVrBwV3R5bC-T92IY4xoaF-eWeGyACnqr6PR4qPH7YduXc0M4R5SuQjzCCABvGY94Cim_eGcqAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_1DpX9kK9aHWyZ_MdexeMUG5hBmTw%2526client%253Dca-pub-6933461940627641%2526adurl%253D%26redirect%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: 50c76d517288a7c22e66a60865e29c0ee563c7efbdc3613b6eba33b03a3f76c3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Mar 2022 03:19:30 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 26621700014050404380384011909020
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 331
Expires: Fri, 25 Mar 2022 03:19:30 +0100

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2606a2b05d00b5c7d3773c2be6971319480f6cb1875cbfe89d047c3eda13bfb

Request headers

Referer
Origin: https://www.edocr.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H/1.1 200
OK Attributes Show response
www.edocr.com/pas/Document/q/ 41 B
523 B 344ms
343ms XHR
application/json 18.213.171.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Document/q/Attributes?DocumentID=uhWiqwJET71pC7JVhy6Aqdg&DesiredPageCountConfidence=50

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.213.171.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-213-171-36.compute-1.amazonaws.com

Software

nginx / Express

Resource Hash

e6d3c35d004dc673dcfde2897afabd8910dc3d8d64fd056913316f23885983d8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accusoft-Gid: UW4Pw7KiMok0yWdTxgQYXw
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: application/json
Accusoft-Parent-Name: ViewerControl
Referer: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know
Accusoft-Parent-Pid: 0
Accusoft-Parent-Taskid: 0

Response headers

Content-Security-Policy: frame-ancestors 'none'
content-encoding: gzip
vary: Accept-Encoding
server: nginx
x-powered-by: Express
transfer-encoding: chunked
access-control-allow-methods: GET
content-type: application/json;charset=utf-8
access-control-allow-origin: *
date: Fri, 25 Mar 2022 03:19:30 GMT
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-headers: *
build-number: 2366

GET
H/1.1 200
OK 9fdzpz67c8h4 Show response
hal9000.redintelligence.net/zone/ Frame 8AD3 10 KB
4 KB 36ms
12ms Script
text/html 78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/9fdzpz67c8h4?subid=&gdpr=1&gdpr_consent=li&rnd=3963160807121886269&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYj00wQANPK0KiwwkMAikeQ%26exch_seat%3D20035004448%26mt_aid%3D3963160807121886269%26mt_id%3D10406290%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_cid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCr9_QwTQ9YpO4MZC63wOT37uACc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBKECT9A6vUZegTGaxnisZcG-ykQzRJ8Wyrm3yXW5ym6pKHA5FYVFdqYi3YvgIsobOsMXycSwNA9ZSifgpI9swjqQoT_27RZLurKjPpEhg_lglKPByhEN3-1OhtHGzMoL3fDyRVM0fZviDtZ4078Tdp4gODjg4YjBiGidelya8VDgfTRyBaVZIXU2gEyHvErmHVyOUZCVbw1r37gIiAL3-C7gx5WA9G-DPZHuIYaoVZDqq0Bi9V0oDZhcEEqgPH0lKOdRTB8oiELuaufW8AVIIpt0BdBdYOi87pWeeJK4IoJqU3kaCTX4VpAeCwX_oY3JziieM32vKLnsAmcQgbMAiToKDMIhVa-DKg9kqN17Dcgbf1hLT_uQD_4WfNL09Aav9O-BhYAG8Zj3gKKb94ZyoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_1Rk6Xf4FVIbuBziMoMbJGaJ49gRg%2526client%253Dca-pub-6933461940627641%2526adurl%253D%26redirect%3D
Requested by: Host: www.edocr.com
URL: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 8a6ab4ede09cb858d2441f13e4847da17ed2abbe394632178c94170125635b9f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3424
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK img
pixel.mathtag.com/event/ Frame 8AD3 43 B
405 B 85ms
84ms Image
image/gif 2.18.233.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=4&v2=3963160807121886269&v3=1129274&v4=11142481&v5=10406290&mt_nsync=1&no_attr=1
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTkdJNE16Qm1Nemd0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5NjMxNjA4MDcxMjE4ODYyNjkvMTA0MDYyOTAvMTExNDI0ODEvNC9jSGRFdmg2M3BIVnJqNXRsQzhUanN5M0dPbEZSV0hzQWtGX0g1SE5TeHdFLzEvNC8wLzAvMTg1MzkyMS8wLzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMzk2MzE2MDgwNzEyMTg4NjI2OS96cmgvMC85MDk5LzMyLzk5OS8yNTgvMjAwMTphYzg6MjA6Oi8wLjAwMC8xNjQ4MTc4MzY5LzE2NDgxOTA5NjkvNC9wdWItNjkzMzQ2MTk0MDYyNzY0MS8/e_7973NXXM_6AoomMSrd59tTBL0&nodeid=512&group=zrh&auctionid=3963160807121886269&shardkey=3963160807121886269&sid=11142481&cid=10406290&bp=a_bjiibd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.134.180&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCr9_QwTQ9YpO4MZC63wOT37uACc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBKECT9A6vUZegTGaxnisZcG-ykQzRJ8Wyrm3yXW5ym6pKHA5FYVFdqYi3YvgIsobOsMXycSwNA9ZSifgpI9swjqQoT_27RZLurKjPpEhg_lglKPByhEN3-1OhtHGzMoL3fDyRVM0fZviDtZ4078Tdp4gODjg4YjBiGidelya8VDgfTRyBaVZIXU2gEyHvErmHVyOUZCVbw1r37gIiAL3-C7gx5WA9G-DPZHuIYaoVZDqq0Bi9V0oDZhcEEqgPH0lKOdRTB8oiELuaufW8AVIIpt0BdBdYOi87pWeeJK4IoJqU3kaCTX4VpAeCwX_oY3JziieM32vKLnsAmcQgbMAiToKDMIhVa-DKg9kqN17Dcgbf1hLT_uQD_4WfNL09Aav9O-BhYAG8Zj3gKKb94ZyoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1Rk6Xf4FVIbuBziMoMbJGaJ49gRg%26client%3Dca-pub-6933461940627641%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-201.deploy.static.akamaitechnologies.com
Software: MT3 4267 dd20a5c master cdg-pixel-x27 config:1.0.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Server: MT3 4267 dd20a5c master cdg-pixel-x27 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 25 Mar 2022 03:19:29 GMT

GET
H/1.1 200
OK img
tags.mathtag.com/event/ Frame 8AD3 49 B
329 B 36ms
36ms Image
image/gif 185.29.134.249
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/event/img?type=mmImpTrack&exch=adx&bid=3963160807121886269&st=11142481&time=1648178370&nodeid=512
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTkdJNE16Qm1Nemd0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5NjMxNjA4MDcxMjE4ODYyNjkvMTA0MDYyOTAvMTExNDI0ODEvNC9jSGRFdmg2M3BIVnJqNXRsQzhUanN5M0dPbEZSV0hzQWtGX0g1SE5TeHdFLzEvNC8wLzAvMTg1MzkyMS8wLzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMzk2MzE2MDgwNzEyMTg4NjI2OS96cmgvMC85MDk5LzMyLzk5OS8yNTgvMjAwMTphYzg6MjA6Oi8wLjAwMC8xNjQ4MTc4MzY5LzE2NDgxOTA5NjkvNC9wdWItNjkzMzQ2MTk0MDYyNzY0MS8/e_7973NXXM_6AoomMSrd59tTBL0&nodeid=512&group=zrh&auctionid=3963160807121886269&shardkey=3963160807121886269&sid=11142481&cid=10406290&bp=a_bjiibd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.134.180&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCr9_QwTQ9YpO4MZC63wOT37uACc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBKECT9A6vUZegTGaxnisZcG-ykQzRJ8Wyrm3yXW5ym6pKHA5FYVFdqYi3YvgIsobOsMXycSwNA9ZSifgpI9swjqQoT_27RZLurKjPpEhg_lglKPByhEN3-1OhtHGzMoL3fDyRVM0fZviDtZ4078Tdp4gODjg4YjBiGidelya8VDgfTRyBaVZIXU2gEyHvErmHVyOUZCVbw1r37gIiAL3-C7gx5WA9G-DPZHuIYaoVZDqq0Bi9V0oDZhcEEqgPH0lKOdRTB8oiELuaufW8AVIIpt0BdBdYOi87pWeeJK4IoJqU3kaCTX4VpAeCwX_oY3JziieM32vKLnsAmcQgbMAiToKDMIhVa-DKg9kqN17Dcgbf1hLT_uQD_4WfNL09Aav9O-BhYAG8Zj3gKKb94ZyoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1Rk6Xf4FVIbuBziMoMbJGaJ49gRg%26client%3Dca-pub-6933461940627641%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.134.249 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.305.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Server: MMBD/3.305.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: cdg-router-x80, zrh-bidder-x67
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Fri, 25 Mar 2022 03:19:29 GMT

GET
H/1.1 200
OK js Show response
sync.mathtag.com/sync/ Frame 8AD3 1 KB
1 KB 54ms
15ms Script
text/javascript 185.29.132.245
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.mathtag.com/sync/js?sync=auto&source=bidder&mt_lim=1&type=1&synclist=4&gdpr=1&gdpr_consent=li
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTkdJNE16Qm1Nemd0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5NjMxNjA4MDcxMjE4ODYyNjkvMTA0MDYyOTAvMTExNDI0ODEvNC9jSGRFdmg2M3BIVnJqNXRsQzhUanN5M0dPbEZSV0hzQWtGX0g1SE5TeHdFLzEvNC8wLzAvMTg1MzkyMS8wLzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMzk2MzE2MDgwNzEyMTg4NjI2OS96cmgvMC85MDk5LzMyLzk5OS8yNTgvMjAwMTphYzg6MjA6Oi8wLjAwMC8xNjQ4MTc4MzY5LzE2NDgxOTA5NjkvNC9wdWItNjkzMzQ2MTk0MDYyNzY0MS8/e_7973NXXM_6AoomMSrd59tTBL0&nodeid=512&group=zrh&auctionid=3963160807121886269&shardkey=3963160807121886269&sid=11142481&cid=10406290&bp=a_bjiibd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.134.180&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCr9_QwTQ9YpO4MZC63wOT37uACc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBKECT9A6vUZegTGaxnisZcG-ykQzRJ8Wyrm3yXW5ym6pKHA5FYVFdqYi3YvgIsobOsMXycSwNA9ZSifgpI9swjqQoT_27RZLurKjPpEhg_lglKPByhEN3-1OhtHGzMoL3fDyRVM0fZviDtZ4078Tdp4gODjg4YjBiGidelya8VDgfTRyBaVZIXU2gEyHvErmHVyOUZCVbw1r37gIiAL3-C7gx5WA9G-DPZHuIYaoVZDqq0Bi9V0oDZhcEEqgPH0lKOdRTB8oiELuaufW8AVIIpt0BdBdYOi87pWeeJK4IoJqU3kaCTX4VpAeCwX_oY3JziieM32vKLnsAmcQgbMAiToKDMIhVa-DKg9kqN17Dcgbf1hLT_uQD_4WfNL09Aav9O-BhYAG8Zj3gKKb94ZyoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1Rk6Xf4FVIbuBziMoMbJGaJ49gRg%26client%3Dca-pub-6933461940627641%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MT3 4281 354de82 master zrh-pixel-x27 config:1.0.0 /
Resource Hash: 7175887b4ec767c80d43eda3f4070a6cd33fd6dfe4097657dbb6545f517b6ea5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Content-Encoding: gzip
Server: MT3 4281 354de82 master zrh-pixel-x27 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: close
Content-Type: text/javascript
Expires: Fri, 25 Mar 2022 03:19:29 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 25F4 6 KB
1 KB 41ms
17ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=3095482696&pi=t.ma~as.3952982610&w=120&lmt=1648178370&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370143&bpp=1&bdt=1271&idt=138&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250&correlator=2127865254662&frm=20&pv=1&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=tJp9awNCth&p=https%3A//www.edocr.com&dtd=143

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2cef3a9d0606aecfe2476867e61f76535b9bb5b8e9d31957cc9504cdd1e69396

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 25 Mar 2022 03:10:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 25 Mar 2022 03:19:30 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 25 Mar 2022 03:19:30 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame 25F4 2 KB
904 B 8ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 02:56:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1386
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 877
x-xss-protection: 0
server: cafe
etag: 13035868154101442325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 02:56:24 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/ Frame 25F4 19 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d072a09604e6a1fea8ef42203503771aa36b63a3c91fd1059966e26e6f5812b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 02:43:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7871
x-xss-protection: 0
server: cafe
etag: 7397949449432438406
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 02:43:11 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame 25F4 2 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 02:52:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1624
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 02:52:26 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 25F4 119 KB
36 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 25 Mar 2022 03:19:30 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame 25F4 15 KB
6 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:08:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 632
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6407
x-xss-protection: 0
server: cafe
etag: 6055885685211612390
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Apr 2022 03:08:58 GMT

GET
H2 200 c5c2d0ec538305d3144caccb9e9ba20c.js Show response
www.gstatic.com/mysidia/ Frame 25F4 28 KB
12 KB 29ms
6ms Script
text/javascript 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/c5c2d0ec538305d3144caccb9e9ba20c.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56b292bab6c777111694aa0bffda487c3108b1e83091ea8471e316272f9d1aff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 03:21:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 86290
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11812
x-xss-protection: 0
last-modified: Tue, 22 Mar 2022 03:00:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 22 Jun 2022 03:21:20 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 25F4 0
0 52ms
51ms Fetch
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CTUgzwTQ9YtanMceKrASd0Jb4DKm_zahosYubm8wPiqjryfIuEAEguO-4PmCV4pCCoAegAfzz_8cCyAEJqQLY46Xgy91nPqgDAcgDywSqBLwCT9A-xZDZyF1heovA6HxAAwd-CDegst9rOi-blUtGKNEzlo2xSPouVwt8TW5wHfQESlzurMZKO6z_08LTS4QA6jQI_n46VH05eQCs4lv2iyy0Aq6L0aY-GO12RothProdN7f_UYhFHeHz3YScItWe7QRLTMshPp67hm2PpFmaSRIc5PehBYwELC1iFpBsPGhd2_ffxAFww9l5vYnKWx4-tJFpi0FcHQrpjNoWo9s4_eVZ1naCIYfWLCGGvpR8jvLdAsFiwMIdbIaX3c7dyUsR3TZymvro5GwsA2VuYk19gUcmDveeItzUiS21kzjaJTOTcLrYRoBKGg-h5O3B2ECYlBx0KwrwgOqntQrvPGjvlMrijoaEkCYXWpDDIbBRSo-65z0BaG3s8V-yESlQAtXKntYfBitSF6we3pAivMAEmpnD-vQDoAYugAfsi4C4AagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcDEJA10ggJCIDhgBAQARgfgAoByAsB2BMDiBQD0BUBmBYBgBcBshccChoIABIUcHViLTY5MzM0NjE5NDA2Mjc2NDEYAA&sigh=lZwbiHxWK6w&uach_m=[UACH]&template_id=484

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=3095482696&pi=t.ma~as.3952982610&w=120&lmt=1648178370&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370143&bpp=1&bdt=1271&idt=138&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250&correlator=2127865254662&frm=20&pv=1&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=tJp9awNCth&p=https%3A//www.edocr.com&dtd=143
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Fri, 25 Mar 2022 03:19:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 2076313506083323656
tpc.googlesyndication.com/simgad/17206873099570650786/ Frame 25F4 64 KB
64 KB 8ms
8ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17206873099570650786/2076313506083323656

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b64067c9d665cf2adefd541b8fb58617edbfec87b79b5541f8fcbc5022004876

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 08:11:02 GMT
x-content-type-options: nosniff
age: 241708
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 65792
x-xss-protection: 0
last-modified: Tue, 22 Mar 2022 08:08:11 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 22 Mar 2023 08:11:02 GMT

GET
H3 200 1127116818736266180
tpc.googlesyndication.com/simgad/15128411237089047770/ Frame 25F4 3 KB
3 KB 7ms
6ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15128411237089047770/1127116818736266180?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97f4de4234de0c66f34a18d267569e9c1e5e43e77f616695e767ad2f8443dfe4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 05:03:49 GMT
x-content-type-options: nosniff
age: 252941
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2845
x-xss-protection: 0
last-modified: Tue, 22 Feb 2022 01:47:48 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 22 Mar 2023 05:03:49 GMT

GET
DATA 200
OK truncated
/ Frame 25F4 221 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK request_content.php Show response
hal900020.redintelligence.net/ Frame 6155 4 KB
2 KB 33ms
12ms Document
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/request_content.php?s=26621700014050404380384011909020&a=4ce7d508
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request.php?zone=9fdzpz67c8h4&nw=20&renderingType=javascript&namespace=da0d47bde6&subid=&uid=44db0c6552ffe24d&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYj00wQANe-sHg4MiFw__dg%26exch_seat%3D20035004448%26mt_aid%3D3963160807121886307%26mt_id%3D10406290%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_cid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCvPZqwTQ9YpG9MaeOjuwP7NqA2AfPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi02OTMzNDYxOTQwNjI3NjQxyAEJqAMBqgSbAk_QnImxmUJ-awzIpMFc86A_hBj0HjcLs2e4c13M1lXNOqkQKrDrTMrDwgx8zZO7IbEQSGF2paWcIK5_PUt_lCIefYj8AZa3E6ssxAmAV4aoqe53Bdq_09UFzqQBGxpDmnvQD2rkKJyeVmtJTJhsGAaT3MKM892cmLIcoZ5aoanCBxSv9bSxz0kPSGEg5oXMJssNhuaN0eD1EK01_xyWp_i8Ti8FoyOP1R72y0VRfNhk7JRQiL_sFAamGR_zkK9dCsB5aj5dFO-ctsprq6vksHCIZC57granhE5-NPEEYvmDrgUNhC8JmdGvuHcefHcC3VVrBwV3R5bC-T92IY4xoaF-eWeGyACnqr6PR4qPH7YduXc0M4R5SuQjzCCABvGY94Cim_eGcqAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_1DpX9kK9aHWyZ_MdexeMUG5hBmTw%2526client%253Dca-pub-6933461940627641%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6933461940627641%26output%3Dhtml%26h%3D250%26slotname%3D4103433139%26adk%3D402904232%26adf%3D485626509%26pi%3Dt.ma~as.4103433139%26w%3D300%26lmt%3D1648178370%26psa%3D0%26format%3D300x250%26url%3Dhttps%253A%252F%252Fwww.edocr.com%252Fv%252F517wqd7k%252Fhortensedannelly67%252Fif-you-are-suffering-ptsd-how-to-know%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1648178370144%26bpp%3D1%26bdt%3D1272%26idt%3D145%26shv%3Dr20220323%26mjsv%3Dm202203170101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D350x250%252C120x600%26correlator%3D2127865254662%26frm%3D20%26pv%3D1%26ga_vid%3D843357066.1648178369%26ga_sid%3D1648178370%26ga_hid%3D1215387951%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D1270%26ady%3D185%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759842%252C31065735%252C31063247%252C31065653%26oid%3D2%26pvsid%3D2431937748461322%26pem%3D702%26tmod%3D2092378864%26uas%3D0%26nvt%3D1%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257Cd%257CeE%257Cp%26abl%3DXS%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D3%26uci%3Da!3%26fsb%3D1%26xpc%3DBp2Ol6JAn6%26p%3Dhttps%253A%2F%2Fwww.edocr.com%26dtd%3D148&ancestorOrigins=null&random=1606466439609&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: 38026c4784fcf701f05e311b889f71bf5e289997fa012b0dd73d6a4189e3ce6a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Fri, 25 Mar 2022 03:19:30 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1525
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK request.php Show response
hal90002.redintelligence.net/ Frame 8AD3 612 B
773 B 98ms
63ms Script
application/x-javascript 46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/request.php?zone=9fdzpz67c8h4&nw=20&renderingType=javascript&namespace=9cd7db66ca&subid=&uid=dbb95a539ba899f2&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYj00wQANPK0KiwwkMAikeQ%26exch_seat%3D20035004448%26mt_aid%3D3963160807121886269%26mt_id%3D10406290%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_cid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCr9_QwTQ9YpO4MZC63wOT37uACc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBKECT9A6vUZegTGaxnisZcG-ykQzRJ8Wyrm3yXW5ym6pKHA5FYVFdqYi3YvgIsobOsMXycSwNA9ZSifgpI9swjqQoT_27RZLurKjPpEhg_lglKPByhEN3-1OhtHGzMoL3fDyRVM0fZviDtZ4078Tdp4gODjg4YjBiGidelya8VDgfTRyBaVZIXU2gEyHvErmHVyOUZCVbw1r37gIiAL3-C7gx5WA9G-DPZHuIYaoVZDqq0Bi9V0oDZhcEEqgPH0lKOdRTB8oiELuaufW8AVIIpt0BdBdYOi87pWeeJK4IoJqU3kaCTX4VpAeCwX_oY3JziieM32vKLnsAmcQgbMAiToKDMIhVa-DKg9kqN17Dcgbf1hLT_uQD_4WfNL09Aav9O-BhYAG8Zj3gKKb94ZyoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_1Rk6Xf4FVIbuBziMoMbJGaJ49gRg%2526client%253Dca-pub-6933461940627641%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6933461940627641%26output%3Dhtml%26h%3D250%26slotname%3D8628223775%26adk%3D2306401753%26adf%3D1981261236%26pi%3Dt.ma~as.8628223775%26w%3D350%26lmt%3D1648178370%26psa%3D0%26format%3D350x250%26url%3Dhttps%253A%252F%252Fwww.edocr.com%252Fv%252F517wqd7k%252Fhortensedannelly67%252Fif-you-are-suffering-ptsd-how-to-know%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1648178370137%26bpp%3D6%26bdt%3D1266%26idt%3D120%26shv%3Dr20220323%26mjsv%3Dm202203170101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26correlator%3D2127865254662%26frm%3D20%26pv%3D2%26ga_vid%3D843357066.1648178369%26ga_sid%3D1648178370%26ga_hid%3D1215387951%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D-975%26ady%3D474%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759842%252C31065735%252C31063247%252C31065653%26oid%3D2%26pvsid%3D2431937748461322%26pem%3D702%26tmod%3D2092378864%26uas%3D0%26nvt%3D1%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Dd%257C%257CaeE%257C%26abl%3DCA%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D1%26uci%3Da!1%26fsb%3D1%26xpc%3Dds7Y7SKCe7%26p%3Dhttps%253A%2F%2Fwww.edocr.com%26dtd%3D138&ancestorOrigins=null&random=3912243543423&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/9fdzpz67c8h4?subid=&gdpr=1&gdpr_consent=li&rnd=3963160807121886269&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYj00wQANPK0KiwwkMAikeQ%26exch_seat%3D20035004448%26mt_aid%3D3963160807121886269%26mt_id%3D10406290%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_cid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCr9_QwTQ9YpO4MZC63wOT37uACc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBKECT9A6vUZegTGaxnisZcG-ykQzRJ8Wyrm3yXW5ym6pKHA5FYVFdqYi3YvgIsobOsMXycSwNA9ZSifgpI9swjqQoT_27RZLurKjPpEhg_lglKPByhEN3-1OhtHGzMoL3fDyRVM0fZviDtZ4078Tdp4gODjg4YjBiGidelya8VDgfTRyBaVZIXU2gEyHvErmHVyOUZCVbw1r37gIiAL3-C7gx5WA9G-DPZHuIYaoVZDqq0Bi9V0oDZhcEEqgPH0lKOdRTB8oiELuaufW8AVIIpt0BdBdYOi87pWeeJK4IoJqU3kaCTX4VpAeCwX_oY3JziieM32vKLnsAmcQgbMAiToKDMIhVa-DKg9kqN17Dcgbf1hLT_uQD_4WfNL09Aav9O-BhYAG8Zj3gKKb94ZyoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_1Rk6Xf4FVIbuBziMoMbJGaJ49gRg%2526client%253Dca-pub-6933461940627641%2526adurl%253D%26redirect%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.47 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: c98f398eb1da71fede6ef3c68de0638d9ef1e861191ce86f1ed4938bc1fe7716

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Mar 2022 03:19:30 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 69885500011008204380384011909002
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 330
Expires: Fri, 25 Mar 2022 03:19:30 +0100

POST
H/1.1 200
OK postback Show response
s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/ Frame 0013 0
145 B 109ms
27ms XHR
text/plain 34.251.154.165
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/postback?oz_pl=1&pd=avt&r2=&sr=4&si=2040408330&dm=300x250&pv=85e8b2c4-4efc-4cab-8dce-a98bbd57d7f1&ac=1129274&cr=10406290&c1=11142481&r1=2001%3Aac8%3A20%3A%3A&dt=6196211556140246740000&ap=&ti=3963160807121886307&ci=619621&de=43003&ai=215543&r3=&di=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&ui=4b830f38-0000-0000-0000-000000000000&pp=pub-6933461940627641&_x=1
Requested by: Host: s.update.mediamathtag.com
URL: https://s.update.mediamathtag.com/2/619621/analytics.js?dt=6196211556140246740000&pd=avt&di=https%3A//www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know&ui=4b830f38-0000-0000-0000-000000000000&ap=&ti=3963160807121886307&pv=85e8b2c4-4efc-4cab-8dce-a98bbd57d7f1&pp=pub-6933461940627641&sr=4&de=43003&si=2040408330&dm=300x250&ac=1129274&cr=10406290&ai=215543&c1=11142481&r1=2001:ac8:20::&r2=&r3=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.251.154.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-154-165.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 25 Mar 2022 03:19:30 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H/1.1 200
OK main.js Show response
s.update.mediamathtag.com/2/2.52.0/ Frame 0013 156 KB
49 KB 30ms
29ms Script
text/javascript 34.251.154.165
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.update.mediamathtag.com/2/2.52.0/main.js

Requested by

Host: s.update.mediamathtag.com
URL: https://s.update.mediamathtag.com/2/619621/analytics.js?dt=6196211556140246740000&pd=avt&di=https%3A//www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know&ui=4b830f38-0000-0000-0000-000000000000&ap=&ti=3963160807121886307&pv=85e8b2c4-4efc-4cab-8dce-a98bbd57d7f1&pp=pub-6933461940627641&sr=4&de=43003&si=2040408330&dm=300x250&ac=1129274&cr=10406290&ai=215543&c1=11142481&r1=2001:ac8:20::&r2=&r3=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

34.251.154.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-251-154-165.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ebc1809c917b61781cda24334f55c7010d9bf8986b99ea3f59d049e78d491910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Content-Encoding: br
Accept-Ch: Viewport-Width, Viewport-Height, Width, DPR, RTT, ECT, Device-Memory, Downlink, Save-Data
Vary: Origin, Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: public, no-transform, immutable, max-age=999999999
Strict-Transport-Security: max-age=31536000; includeSubDomains
Timing-Allow-Origin: *
Content-Length: 49733
Expires: Sun, 30 Nov 2053 17:42:32 GMT

GET
DATA 200
OK truncated
/ Frame 0013 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8ecb036eea58eb2fab29d0e34d5cb72af23798b9cb91f670314419bb05afde61

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 25F4 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0b079edded6f39ce941497d71fa92b120de1e70da55aa004ca9290c3a38eeff7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 25F4 15 KB
16 KB 28ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 01:46:21 GMT
x-content-type-options: nosniff
age: 5589
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 25 Mar 2023 01:46:21 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 25F4 15 KB
16 KB 26ms
8ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Wed, 23 Mar 2022 17:56:19 GMT
x-content-type-options: nosniff
age: 120191
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 23 Mar 2023 17:56:19 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 25F4 15 KB
15 KB 26ms
13ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Wed, 23 Mar 2022 17:58:32 GMT
x-content-type-options: nosniff
age: 120058
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15732
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:20 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 23 Mar 2023 17:58:32 GMT

GET
H2 200 / Show response
track.adform.net/adfscript/ Frame 6155 747 B
941 B 72ms
17ms Script
text/javascript 37.157.2.239
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfscript/?bn=53795668;click=https%3A%2F%2Fhal900020.redintelligence.net%2Fc%2Fpkc1n1eost24ewx%3Ftprde%3D

Requested by

Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=26621700014050404380384011909020&a=4ce7d508

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.239 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

c14b947fe790ad749be51a4cdad89070847207f030a5270711cdaf450c1ef56e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 03:19:30 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 548
expires: -1

GET
H/1.1 200
OK viewability Show response
hal900020.redintelligence.net/ Frame 6155 0
150 B 37ms
16ms Script
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/viewability?s=26621700014050404380384011909020&a=9525bbfe&vb=m
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=26621700014050404380384011909020&a=4ce7d508
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/request_content.php?s=26621700014050404380384011909020&a=4ce7d508
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 42ms
41ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220323&jk=2431937748461322&bg=!0tGl0ZXNAAbzJazn0yU7ACkAdvg8Wik1eckt_jCsWFx29yw1twntZH8g-GhKtYQvQBVkFvusYXFNTQIAAABbUgAAAAJoAQeZAqXXEslLJOI6i03JWq-wo1JFCd5Aia00p0JWwWzJxLZKqkUhgiRhNshIB4bCWdbcviNn5u_1-T_pQ2unRh49Pz-D_w-wK0Du4zgPzUvU181csM58Onh4-vDr6cWrKdx-yNxF-9BG4l-Qu4n7RLV74Qe7Es7R9qbGIYbW1bJ9oEAnncBypJLvcWk2Ci04BsCcVWyMWU89oiXK6-HxV9RkSNjZhMySEFhyxXAPxg0YO_n7EL-pF6O-pyMARQdAH_PqoyjTv0HQwGwXGKsQPuBmXU7_yuZMUpv3UXEDbnSe2VjceTpoWrNBh7qbOqho1yqjKSOpuTGhKEWEfTidGHSzPtmui5U9nqcLpc-c0GD_EvP6ShJshQ-KAvRWyeEGFcrPcyCwBZYxd5-rGYgmF32sdEPHTAcY7yIuHyuGHsUofgGCVsm-uX_hmJW63kgJyVxaQllrb05aGb0yKe588H_NjxMMsJ256pddGblYN32y-ZTSFK2n9q0znlcISJpjMaKv6BqAoEhd-Adx1N5q9nvdHCfc0dvEbVLEC1DJ2tlJ6_lnxbM3OPs2fXbvlAc12nrxWVa73foolQNzbX6ZPRkGpA9wNHCOsd59nns48SiOtmuxuBfte1H6_GSofoTW1X37KmnjDWuv8VnpATh3XWV9cbwQqsppaY65c1hphbUF5CQoM3Xoe0pVctv3-hFCMYf26qIbOtQbXeV76vbqx8EwzItxb3girLR7jlApj-xQy3Wv9DdVDvcrOLYGTFLecrxAErPq-I7nAcbcz3guAtBpITd2zQTLnLdhz4Wd45bIjFfxXxaqIynD0Diu3fHvh6tHKveEC8YEOIdrSgk7IJNLNqtt6FqDbD0jSrIHDiO08XLtfPAZVvMdfiXBq_GnxoXHaJ0SHS68Pg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.edocr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 03:19:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK request_content.php Show response
hal90002.redintelligence.net/ Frame F012 4 KB
2 KB 37ms
14ms Document
text/html 46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/request_content.php?s=69885500011008204380384011909002&a=50b3ab83
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request.php?zone=9fdzpz67c8h4&nw=20&renderingType=javascript&namespace=9cd7db66ca&subid=&uid=dbb95a539ba899f2&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYj00wQANPK0KiwwkMAikeQ%26exch_seat%3D20035004448%26mt_aid%3D3963160807121886269%26mt_id%3D10406290%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_cid%3Dbb4e623d-34c2-4f01-89c8-cc53790d2094%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCr9_QwTQ9YpO4MZC63wOT37uACc-HjptcwIbZgsYCwI23ARABIABgleKQgqAHggEXY2EtcHViLTY5MzM0NjE5NDA2Mjc2NDHIAQmoAwGqBKECT9A6vUZegTGaxnisZcG-ykQzRJ8Wyrm3yXW5ym6pKHA5FYVFdqYi3YvgIsobOsMXycSwNA9ZSifgpI9swjqQoT_27RZLurKjPpEhg_lglKPByhEN3-1OhtHGzMoL3fDyRVM0fZviDtZ4078Tdp4gODjg4YjBiGidelya8VDgfTRyBaVZIXU2gEyHvErmHVyOUZCVbw1r37gIiAL3-C7gx5WA9G-DPZHuIYaoVZDqq0Bi9V0oDZhcEEqgPH0lKOdRTB8oiELuaufW8AVIIpt0BdBdYOi87pWeeJK4IoJqU3kaCTX4VpAeCwX_oY3JziieM32vKLnsAmcQgbMAiToKDMIhVa-DKg9kqN17Dcgbf1hLT_uQD_4WfNL09Aav9O-BhYAG8Zj3gKKb94ZyoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_1Rk6Xf4FVIbuBziMoMbJGaJ49gRg%2526client%253Dca-pub-6933461940627641%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6933461940627641%26output%3Dhtml%26h%3D250%26slotname%3D8628223775%26adk%3D2306401753%26adf%3D1981261236%26pi%3Dt.ma~as.8628223775%26w%3D350%26lmt%3D1648178370%26psa%3D0%26format%3D350x250%26url%3Dhttps%253A%252F%252Fwww.edocr.com%252Fv%252F517wqd7k%252Fhortensedannelly67%252Fif-you-are-suffering-ptsd-how-to-know%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1648178370137%26bpp%3D6%26bdt%3D1266%26idt%3D120%26shv%3Dr20220323%26mjsv%3Dm202203170101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26correlator%3D2127865254662%26frm%3D20%26pv%3D2%26ga_vid%3D843357066.1648178369%26ga_sid%3D1648178370%26ga_hid%3D1215387951%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D-975%26ady%3D474%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759842%252C31065735%252C31063247%252C31065653%26oid%3D2%26pvsid%3D2431937748461322%26pem%3D702%26tmod%3D2092378864%26uas%3D0%26nvt%3D1%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Dd%257C%257CaeE%257C%26abl%3DCA%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D1%26uci%3Da!1%26fsb%3D1%26xpc%3Dds7Y7SKCe7%26p%3Dhttps%253A%2F%2Fwww.edocr.com%26dtd%3D138&ancestorOrigins=null&random=3912243543423&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.47 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 11cf30cc7421258aaed33d3e5f55f4a3113e3545fc56d80d97d3e9f26f29340c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Fri, 25 Mar 2022 03:19:30 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1522
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK iframe Show response
sync.mathtag.com/sync/ Frame 555A 652 B
765 B 40ms
16ms Document
text/html 185.29.132.245
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.mathtag.com/sync/iframe?mt_uuid=bb4e623d-34c2-4f01-89c8-cc53790d2094&no_iframe=1&synclist=4&mt_lim=1&type=1&gdpr=1&gdpr_consent=li&source=bidder
Requested by: Host: sync.mathtag.com
URL: https://sync.mathtag.com/sync/js?sync=auto&source=bidder&mt_lim=1&type=1&synclist=4&gdpr=1&gdpr_consent=li
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MT3 4281 354de82 master zrh-pixel-x24 config:1.0.0 /
Resource Hash: 4c5325edabfb7a618fea7fb98d21d0940c941d4533c4e337923515685808a056

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Content-Type: text/html
Connection: close
Access-Control-Allow-Origin: *
Server: MT3 4281 354de82 master zrh-pixel-x24 config:1.0.0
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Expires: Fri, 25 Mar 2022 03:19:29 GMT
Content-Encoding: gzip

GET
DATA 200
OK truncated
/ Frame 8AD3 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d603defe54dfe7c92cd890e4f93a2e551e8b09f2c80ed871809fdae912dfdb5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK img
sync.mathtag.com/misc/ Frame 8AD3 43 B
549 B 40ms
15ms Image
image/gif 185.29.132.245
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.mathtag.com/misc/img?mm_bnc&gdpr=1&gdpr_consent=li&bcdv=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=8628223775&adk=2306401753&adf=1981261236&pi=t.ma~as.8628223775&w=350&lmt=1648178370&psa=0&format=350x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370137&bpp=6&bdt=1266&idt=120&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&correlator=2127865254662&frm=20&pv=2&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-975&ady=474&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CaeE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ds7Y7SKCe7&p=https%3A//www.edocr.com&dtd=138
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MT3 4281 354de82 master zrh-pixel-x1 config:1.0.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Server: MT3 4281 354de82 master zrh-pixel-x1 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 43
Expires: Fri, 25 Mar 2022 03:19:29 GMT

GET
H3 200 XFpjqGQyXlGhrIMtqUZEtOx9ZrcGJnYAFO97-LZexEg.js Show response
pagead2.googlesyndication.com/bg/ Frame E0E5 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XFpjqGQyXlGhrIMtqUZEtOx9ZrcGJnYAFO97-LZexEg.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c5a63a864325e51a1ac832da94644b4ec7d66b70626760014ef7bf8b65ec448

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 01:41:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5867
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13744
x-xss-protection: 0
last-modified: Tue, 22 Mar 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Mar 2023 01:41:43 GMT

GET
H2 200 / Show response
track.adform.net/adfscript/ Frame F012 740 B
855 B 18ms
18ms Script
text/javascript 37.157.2.239
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfscript/?bn=53795661;click=https%3A%2F%2Fhal90002.redintelligence.net%2Fc%2Fpjquwmguk6tl3as%3Ftprde%3D

Requested by

Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=69885500011008204380384011909002&a=50b3ab83

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.239 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

6782215ea228a5c0371b214feeb549d547dede26f1bf46836814a7fbabb2bb11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 03:19:30 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 541
expires: -1

POST
H/1.1 200
OK postback Show response
s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/ Frame 0013 0
145 B 28ms
27ms XHR
text/plain 34.251.154.165
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/postback?oz_pl=1&pd=avt&r2=&sr=4&si=2040408330&dm=300x250&pv=85e8b2c4-4efc-4cab-8dce-a98bbd57d7f1&ac=1129274&cr=10406290&c1=11142481&r1=2001%3Aac8%3A20%3A%3A&dt=6196211556140246740000&ap=&ti=3963160807121886307&ci=619621&de=43003&ai=215543&r3=&di=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&ui=4b830f38-0000-0000-0000-000000000000&pp=pub-6933461940627641&_x=1
Requested by: Host: s.update.mediamathtag.com
URL: https://s.update.mediamathtag.com/2/619621/analytics.js?dt=6196211556140246740000&pd=avt&di=https%3A//www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know&ui=4b830f38-0000-0000-0000-000000000000&ap=&ti=3963160807121886307&pv=85e8b2c4-4efc-4cab-8dce-a98bbd57d7f1&pp=pub-6933461940627641&sr=4&de=43003&si=2040408330&dm=300x250&ac=1129274&cr=10406290&ai=215543&c1=11142481&r1=2001:ac8:20::&r2=&r3=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.251.154.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-154-165.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 25 Mar 2022 03:19:30 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H/1.1 200
OK viewability Show response
hal90002.redintelligence.net/ Frame F012 0
150 B 38ms
16ms Script
text/html 46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/viewability?s=69885500011008204380384011909002&a=45c98571&vb=m
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=69885500011008204380384011909002&a=50b3ab83
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.47 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/request_content.php?s=69885500011008204380384011909002&a=50b3ab83
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 bootstrap.js Show response
s1.adform.net/stoat/626/s1.adform.net/ Frame 6155 33 KB
16 KB 88ms
18ms Script
text/javascript 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Requested by: Host: track.adform.net
URL: https://track.adform.net/adfscript/?bn=53795668;click=https%3A%2F%2Fhal900020.redintelligence.net%2Fc%2Fpkc1n1eost24ewx%3Ftprde%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 3d0bf782b47dcd079eedf6bb34ecb0742c114a4e4b90e37a58a412482101b475

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:30 GMT
content-encoding: gzip
last-modified: Thu, 10 Feb 2022 15:16:56 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Sat, 26 Mar 2022 06:59:33 GMT

GET
H2 200 bootstrap.js Show response
s1.adform.net/stoat/626/s1.adform.net/ Frame F012 33 KB
16 KB 111ms
42ms Script
text/javascript 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Requested by: Host: track.adform.net
URL: https://track.adform.net/adfscript/?bn=53795661;click=https%3A%2F%2Fhal90002.redintelligence.net%2Fc%2Fpjquwmguk6tl3as%3Ftprde%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 3d0bf782b47dcd079eedf6bb34ecb0742c114a4e4b90e37a58a412482101b475

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:30 GMT
content-encoding: gzip
last-modified: Thu, 10 Feb 2022 15:16:56 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Sat, 26 Mar 2022 06:59:33 GMT

GET
H/1.1 200
OK img
sync.mathtag.com/misc/ Frame 555A 43 B
550 B 16ms
16ms Image
image/gif 185.29.132.245
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.mathtag.com/misc/img?mm_bnc&gdpr=1&gdpr_consent=li&bcdv=0
Requested by: Host: sync.mathtag.com
URL: https://sync.mathtag.com/sync/iframe?mt_uuid=bb4e623d-34c2-4f01-89c8-cc53790d2094&no_iframe=1&synclist=4&mt_lim=1&type=1&gdpr=1&gdpr_consent=li&source=bidder
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MT3 4281 354de82 master zrh-pixel-x24 config:1.0.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sync.mathtag.com/sync/iframe?mt_uuid=bb4e623d-34c2-4f01-89c8-cc53790d2094&no_iframe=1&synclist=4&mt_lim=1&type=1&gdpr=1&gdpr_consent=li&source=bidder
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Server: MT3 4281 354de82 master zrh-pixel-x24 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 43
Expires: Fri, 25 Mar 2022 03:19:29 GMT

POST
H/1.1 200
OK postback Show response
s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/ Frame 0013 0
145 B 28ms
28ms XHR
text/plain 34.251.154.165
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/postback?pd=avt&r2=&sr=4&si=2040408330&dm=300x250&pv=85e8b2c4-4efc-4cab-8dce-a98bbd57d7f1&ac=1129274&cr=10406290&c1=11142481&r1=2001%3Aac8%3A20%3A%3A&dt=6196211556140246740000&ap=&ti=3963160807121886307&ci=619621&de=43003&ai=215543&r3=&di=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&ui=4b830f38-0000-0000-0000-000000000000&pp=pub-6933461940627641&sid=ASm7b-wJEAFOoIJA&oz_sc=50add0b80789c688d0134a86&oz_df=1648178371170&oz_l=1189&cv=3
Requested by: Host: s.update.mediamathtag.com
URL: https://s.update.mediamathtag.com/2/2.52.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.251.154.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-154-165.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 25 Mar 2022 03:19:30 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H/1.1 200
OK 1 Show response
www.edocr.com/pas/Page/q/ 20 KB
11 KB 399ms
398ms XHR
image/svg+xml 18.213.171.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Page/q/1?DocumentID=uhWiqwJET71pC7JVhy6Aqdg&Scale=1&ContentType=svgb

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.213.171.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-213-171-36.compute-1.amazonaws.com

Software

nginx / Express

Resource Hash

cc584b5aa6d48c1db1877e0652bfe18beae92103f3a105d8a184215ba0d8867e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accusoft-Parent-Name: ViewerControl
Referer: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know
Accusoft-Gid: qZYvH1L6HcRGkfc5G9aY0Q
Accept-Language: de-DE,de;q=0.9
Accusoft-Parent-Pid: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accusoft-Parent-Taskid: 0

Response headers

accusoft-data-encrypted: false
content-encoding: gzip
vary: Accept-Encoding
server: nginx
x-powered-by: Express
transfer-encoding: chunked
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
date: Fri, 25 Mar 2022 03:19:31 GMT
Content-Security-Policy: frame-ancestors 'none'
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-headers: *
build-number: 2366

GET
BLOB 200
OK f7fa57d2-63fb-4901-b6d6-3616acac38bf
https://googleads.g.doubleclick.net/ Frame D22B 185 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://googleads.g.doubleclick.net/f7fa57d2-63fb-4901-b6d6-3616acac38bf
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=250&slotname=4103433139&adk=402904232&adf=485626509&pi=t.ma~as.4103433139&w=300&lmt=1648178370&psa=0&format=300x250&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370144&bpp=1&bdt=1272&idt=145&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250%2C120x600&correlator=2127865254662&frm=20&pv=1&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1270&ady=185&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=Bp2Ol6JAn6&p=https%3A//www.edocr.com&dtd=148
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 848fe19ed492948709b881f504ce2eb6274baa694606ca88eb9b2990a2460caf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Length: 185
Content-Type: application/javascript

GET
H2 200 / Show response
track.adform.net/adfserve/ Frame 6155 4 KB
2 KB 19ms
19ms Script
text/javascript 37.157.2.239
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfserve/?CC=1&bn=53795668;click=https%3A%2F%2Fhal900020.redintelligence.net%2Fc%2Fpkc1n1eost24ewx%3Ftprde%3D;js=1;adfxid=1x;10992;set=en-US|en-US|1600X1200|0|300|250|24|8|3|7|1|;cmpgdpr=;cmpgdprconsent=;fd=0|0&CREFURL=https%3A%2F%2Fwww.edocr.com

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.239 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

32cff97624483ccfa9d3229fb95dbfd1818abfe2fcd4ee49e559b74c7a3dd821

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 03:19:30 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 1991
expires: -1

POST
H/1.1 200
OK postback Show response
s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/ Frame 0013 0
145 B 28ms
28ms XHR
text/plain 34.251.154.165
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/postback?pd=avt&r2=&sr=4&si=2040408330&dm=300x250&pv=85e8b2c4-4efc-4cab-8dce-a98bbd57d7f1&ac=1129274&cr=10406290&c1=11142481&r1=2001%3Aac8%3A20%3A%3A&dt=6196211556140246740000&ap=&ti=3963160807121886307&ci=619621&de=43003&ai=215543&r3=&di=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&ui=4b830f38-0000-0000-0000-000000000000&pp=pub-6933461940627641&sid=ASm7b-wJEAFOoIJA&oz_sc=50add0b80789c688d0134a86&oz_df=1648178371333&oz_l=5471&cv=3
Requested by: Host: s.update.mediamathtag.com
URL: https://s.update.mediamathtag.com/2/2.52.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.251.154.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-154-165.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 25 Mar 2022 03:19:30 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H2 200 / Show response
track.adform.net/adfserve/ Frame F012 4 KB
2 KB 19ms
19ms Script
text/javascript 37.157.2.239
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfserve/?bn=53795661;click=https%3A%2F%2Fhal90002.redintelligence.net%2Fc%2Fpjquwmguk6tl3as%3Ftprde%3D;js=1;adfxid=1x;8239;set=en-US|en-US|1600X1200|0|300|250|24|8|3|7|1|;cmpgdpr=;cmpgdprconsent=;fd=0|0&CREFURL=https%3A%2F%2Fwww.edocr.com

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.239 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

9c9aeeb6d9c96160febe5833e3aed03a81d844f8f63387a12ddb69f283036b75

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 03:19:30 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 1987
expires: -1

GET
DATA 200
OK truncated
/ Frame 6155 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK addDoubleBorder.js Show response
cdn.contentspread.net/24i/tools/js/ Frame 6155 851 B
1 KB 67ms
11ms Script
application/javascript 85.114.131.235
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.contentspread.net/24i/tools/js/addDoubleBorder.js
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=26621700014050404380384011909020&a=4ce7d508
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 85.114.131.235 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: srv21039.dus4.fastwebserver.de
Software: nginx /
Resource Hash: abaa484421865309a7781e540844f1b5260ed131080f8dd9f083d8f18beea107

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Last-Modified: Tue, 03 May 2016 20:54:50 GMT
Server: nginx
ETag: "5729101a-353"
Content-Type: application/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 851

GET
DATA 200
OK truncated
/ Frame F012 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK addDoubleBorder.js Show response
cdn.contentspread.net/24i/tools/js/ Frame F012 851 B
1 KB 57ms
13ms Script
application/javascript 85.114.131.235
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.contentspread.net/24i/tools/js/addDoubleBorder.js
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=69885500011008204380384011909002&a=50b3ab83
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 85.114.131.235 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: srv21039.dus4.fastwebserver.de
Software: nginx /
Resource Hash: abaa484421865309a7781e540844f1b5260ed131080f8dd9f083d8f18beea107

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:30 GMT
Last-Modified: Tue, 03 May 2016 20:54:50 GMT
Server: nginx
ETag: "5729101a-353"
Content-Type: application/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 851

GET
H2 200 Standard Show response
s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/ Frame 6155 90 KB
39 KB 29ms
26ms Script
text/javascript 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: f7e06ae449bdd4ebece6e26cdb36840f7cb19f28b57bbb6b8647a54535557d3f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:30 GMT
content-encoding: gzip
last-modified: Thu, 10 Feb 2022 15:16:56 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Sat, 26 Mar 2022 07:00:10 GMT

GET
H2 200 Standard Show response
s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/ Frame F012 90 KB
39 KB 28ms
27ms Script
text/javascript 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: f7e06ae449bdd4ebece6e26cdb36840f7cb19f28b57bbb6b8647a54535557d3f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:30 GMT
content-encoding: gzip
last-modified: Thu, 10 Feb 2022 15:16:56 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Sat, 26 Mar 2022 07:00:10 GMT

POST
H2 200 /
track.adform.net/csimpr/ Frame 6155 35 B
478 B 19ms
18ms Ping
image/gif 37.157.2.239
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/csimpr/?bn=53795668&csi=8XMFwG2kcTksb5ujhHpHUjyT4NauxBpTmoGpSmqCskPrygPkIxxfk8zXzlwX3VIIYpIwyeOIJN5bpfO2VxTyqN6vWmW1dlSa0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.239 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://hal900020.redintelligence.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 03:19:31 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://hal900020.redintelligence.net
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 10998793.js Show response
s1.adform.net/Banners/Elements/Files/160090/10998793/ Frame 8836 110 KB
24 KB 20ms
20ms Script
application/x-javascript 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998793/10998793.js?ADFassetID=10998793&bv=258

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

2f98ec8aa62f7d8d0ab3cbc9ffed158243bf948877af92bb5f1618139cfc638a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:30 GMT
content-encoding: gzip
last-modified: Fri, 11 Mar 2022 09:43:55 GMT
server: nginx
etag: W/"622b19db-1b7b5"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: application/x-javascript

POST
H2 200 /
track.adform.net/csimpr/ Frame F012 35 B
477 B 29ms
28ms Ping
image/gif 37.157.2.239
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/csimpr/?bn=53795661&csi=rhoChsa61AkZKrS_varfKeIEZCYPio2smoGpSmqCskPrygPkIxxfk7ENPHRzeAG7V-Ok72Jn11JUoQ2LVk7hLd6vWmW1dlSa0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.239 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://hal90002.redintelligence.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 03:19:31 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://hal90002.redintelligence.net
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

POST
H/1.1 200
OK postback Show response
s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/ Frame 0013 0
145 B 28ms
28ms XHR
text/plain 34.251.154.165
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/postback?pd=avt&r2=&sr=4&si=2040408330&dm=300x250&pv=85e8b2c4-4efc-4cab-8dce-a98bbd57d7f1&ac=1129274&cr=10406290&c1=11142481&r1=2001%3Aac8%3A20%3A%3A&dt=6196211556140246740000&ap=&ti=3963160807121886307&ci=619621&de=43003&ai=215543&r3=&di=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&ui=4b830f38-0000-0000-0000-000000000000&pp=pub-6933461940627641&sid=ASm7b-wJEAFOoIJA&oz_sc=50add0b80789c688d0134a86&oz_df=1648178371533&oz_l=5891&cv=3
Requested by: Host: s.update.mediamathtag.com
URL: https://s.update.mediamathtag.com/2/2.52.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.251.154.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-154-165.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 25 Mar 2022 03:19:31 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H2 200 10998804.js Show response
s1.adform.net/Banners/Elements/Files/160090/10998804/ Frame BB5C 110 KB
23 KB 20ms
20ms Script
application/x-javascript 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998804/10998804.js?ADFassetID=10998804&bv=258

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8bbff151893ffea06fd518f6f3a33f55d89dae54f22bc9bd86df525b4f783d69

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:30 GMT
content-encoding: gzip
last-modified: Fri, 11 Mar 2022 09:44:05 GMT
server: nginx
etag: W/"622b19e5-1b75f"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: application/x-javascript

GET
H2 200 Adform.DHTML.js Show response
s1.adform.net/banners/scripts/rmb/ Frame 8836 30 KB
13 KB 24ms
24ms Script
application/x-javascript 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js?bv=626
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: bea63616949c80ff0dfdbb1e8547f1585882fc691483317b06441688e3e5f14a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:30 GMT
content-encoding: gzip
last-modified: Fri, 14 May 2021 12:35:21 GMT
server: nginx
etag: W/"609e6e89-76d9"
x-cache-status: HIT
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: application/x-javascript

GET
H2 200 Enabler.js Show response
s0.2mdn.net/ads/studio/ Frame 8836 134 KB
46 KB 33ms
6ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/Enabler.js

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3705d0878203cc0b2525dcb0f874d85cc6b881d1fca1869191da4e599c768241

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:15:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 216
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46435
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:47:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 25 Mar 2022 03:30:55 GMT

GET
H2 200 Adform.DHTML.js Show response
s1.adform.net/banners/scripts/rmb/ Frame BB5C 30 KB
13 KB 23ms
22ms Script
application/x-javascript 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js?bv=626
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: bea63616949c80ff0dfdbb1e8547f1585882fc691483317b06441688e3e5f14a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:31 GMT
content-encoding: gzip
last-modified: Fri, 14 May 2021 12:35:21 GMT
server: nginx
etag: W/"609e6e89-76d9"
x-cache-status: HIT
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: application/x-javascript

GET
H2 200 Enabler.js Show response
s0.2mdn.net/ads/studio/ Frame BB5C 134 KB
45 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:811::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/Enabler.js

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3705d0878203cc0b2525dcb0f874d85cc6b881d1fca1869191da4e599c768241

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:15:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 216
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46435
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:47:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 25 Mar 2022 03:30:55 GMT

POST
H/1.1 200
OK postback Show response
s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/ Frame 0013 0
145 B 27ms
27ms XHR
text/plain 34.251.154.165
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/postback?pd=avt&r2=&sr=4&si=2040408330&dm=300x250&pv=85e8b2c4-4efc-4cab-8dce-a98bbd57d7f1&ac=1129274&cr=10406290&c1=11142481&r1=2001%3Aac8%3A20%3A%3A&dt=6196211556140246740000&ap=&ti=3963160807121886307&ci=619621&de=43003&ai=215543&r3=&di=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&ui=4b830f38-0000-0000-0000-000000000000&pp=pub-6933461940627641&sid=ASm7b-wJEAFOoIJA&oz_sc=50add0b80789c688d0134a86&oz_df=1648178371692&oz_l=73&cv=3
Requested by: Host: s.update.mediamathtag.com
URL: https://s.update.mediamathtag.com/2/2.52.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.251.154.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-154-165.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 25 Mar 2022 03:19:31 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H/1.1 200
OK Text Show response
www.edocr.com/pas/Document/q/0-0/ 117 KB
24 KB 395ms
395ms XHR
application/json 18.213.171.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Document/q/0-0/Text?DocumentID=uhWiqwJET71pC7JVhy6Aqdg

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.213.171.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-213-171-36.compute-1.amazonaws.com

Software

nginx / Express

Resource Hash

d9187af978cdf09b2f3b386b6c3623d78e571ef481331a9c51e52587ee529d1e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accusoft-Parent-Name: ViewerControl
Accusoft-Gid: y0NrztGH92F6Qzes2RvSIw
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
accept: application/json
Referer: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know
Accusoft-Parent-Pid: 0
Accusoft-Parent-Taskid: 0

Response headers

accusoft-data-encrypted: false
content-encoding: gzip
vary: Accept-Encoding
server: nginx
x-powered-by: Express
transfer-encoding: chunked
access-control-allow-methods: GET
content-type: application/json;charset=utf-8
access-control-allow-origin: *
date: Fri, 25 Mar 2022 03:19:31 GMT
Content-Security-Policy: frame-ancestors 'none'
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-headers: *
build-number: 2366

POST
H/1.1 200
OK postback Show response
s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/ Frame 0013 0
145 B 28ms
27ms XHR
text/plain 34.251.154.165
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/postback?pd=avt&r2=&sr=4&si=2040408330&dm=300x250&pv=85e8b2c4-4efc-4cab-8dce-a98bbd57d7f1&ac=1129274&cr=10406290&c1=11142481&r1=2001%3Aac8%3A20%3A%3A&dt=6196211556140246740000&ap=&ti=3963160807121886307&ci=619621&de=43003&ai=215543&r3=&di=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&ui=4b830f38-0000-0000-0000-000000000000&pp=pub-6933461940627641&sid=ASm7b-wJEAFOoIJA&oz_sc=50add0b80789c688d0134a86&oz_df=1648178371915&oz_l=409&cv=3
Requested by: Host: s.update.mediamathtag.com
URL: https://s.update.mediamathtag.com/2/2.52.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.251.154.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-154-165.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 25 Mar 2022 03:19:31 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
BLOB 200
OK a044be3d-b36b-415e-a7eb-b650dd3e661d
https://googleads.g.doubleclick.net/ Frame 0013 772 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://googleads.g.doubleclick.net/a044be3d-b36b-415e-a7eb-b650dd3e661d
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 566b9670644559b5460f2b0e0f217709742edb5f53197b537e48c208fc698853

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Length: 772

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 0013 42 B
64 B 40ms
39ms Fetch
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvY1o-JSOveILzb-hkYj4oEHBlD-tOmgHLl029kMbi_jJynZu0PVZ13TufKvVjfyA6oGD235WDR4HSglXORUVkwzA&sig=Cg0ArKJSzGoxa6yVEyw5EAE&id=lidar2&mcvt=1014&p=0,0,250,300&mtos=1014,1014,1014,1014,1014&tos=1014,0,0,0,0&v=20220323&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=402904232&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1648178370293&rpt=710&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 03:19:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK postback Show response
s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/ Frame 0013 0
145 B 28ms
28ms XHR
text/plain 34.251.154.165
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/postback?pd=avt&r2=&sr=4&si=2040408330&dm=300x250&pv=85e8b2c4-4efc-4cab-8dce-a98bbd57d7f1&ac=1129274&cr=10406290&c1=11142481&r1=2001%3Aac8%3A20%3A%3A&dt=6196211556140246740000&ap=&ti=3963160807121886307&ci=619621&de=43003&ai=215543&r3=&di=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&ui=4b830f38-0000-0000-0000-000000000000&pp=pub-6933461940627641&sid=ASm7b-wJEAFOoIJA&oz_sc=50add0b80789c688d0134a86&oz_df=1648178372072&oz_l=2040&cv=3
Requested by: Host: s.update.mediamathtag.com
URL: https://s.update.mediamathtag.com/2/2.52.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.251.154.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-154-165.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 25 Mar 2022 03:19:31 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 25F4 0
0 45ms
43ms Fetch
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C-AAdwTQ9YtanMceKrASd0Jb4DKm_zahosYubm8wPiqjryfIuEAEguO-4PmCV4pCCoAegAfzz_8cCyAEJqQLY46Xgy91nPqgDAaoEvAJP0D7FkNnIXWF6i8DofEADB34IN6Cy32s6L5uVS0Yo0TOWjbFI-i5XC3xNbnAd9ARKXO6sxko7rP_TwtNLhADqNAj-fjpUfTl5AKziW_aLLLQCrovRpj4Y7XZGi2E-uh03t_9RiEUd4fPdhJwi1Z7tBEtMyyE-nruGbY-kWZpJEhzk96EFjAQsLWIWkGw8aF3b99_EAXDD2Xm9icpbHj60kWmLQVwdCumM2haj2zj95VnWdoIhh9YsIYa-lHyO8t0CwWLAwh1shpfdzt3JSxHdNnKa-ujkbCwDZW5iTX2BRyYO954i3NSJLbWTONolM5NwuthGgEoaD6Hk7cHYQJiUHHQrCvCA6qe1Cu88aO-UyuKOhoSQJhdakMMhsFFKj7rnPQFobezxX7IRKVAC1cqe1h8GK1IXrB7ekCK8wASamcP69AOgBi6AB-yLgLgBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwMQkDXSCAkIgOGAEBABGB-ACgHICwHYEwOIFAPQFQGYFgGAFwGyFxwKGggAEhRwdWItNjkzMzQ2MTk0MDYyNzY0MRgA&sigh=--aN-ydhK2Q&vt=1&template_id=484&uach_m=[UACH]&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6933461940627641&output=html&h=600&slotname=3952982610&adk=937441900&adf=3095482696&pi=t.ma~as.3952982610&w=120&lmt=1648178370&psa=0&format=120x600&url=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648178370143&bpp=1&bdt=1271&idt=138&shv=r20220323&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x250&correlator=2127865254662&frm=20&pv=1&ga_vid=843357066.1648178369&ga_sid=1648178370&ga_hid=1215387951&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=25&ady=295&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31065735%2C31063247%2C31065653&oid=2&pvsid=2431937748461322&pem=702&tmod=2092378864&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cd%7CeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=tJp9awNCth&p=https%3A//www.edocr.com&dtd=143
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Fri, 25 Mar 2022 03:19:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 25F4 42 B
64 B 45ms
43ms Fetch
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst27WAAdriYVpY7EgcQ2fUgr9h616JWhOODM6AxMUOt1hj8xTSS6OQTjhOdsS_1pbheX8npteaqJCOs8nLsLAm0PPi-S38FlSr8lOBLGaoKSUlL6d7_1Q&sai=AMfl-YQsWKOJj4VuER92VJge6JxvoT8bblRPbitNanujTMD-aX1a506LDwvimIllYGBnX6Fi-JlFYNqPrheM&sig=Cg0ArKJSzMaZRo-3PrPKEAE&id=lidar2&mcvt=1002&p=0,0,600,120&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20220323&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=937441900&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&pay=1&rst=1648178370287&rpt=817&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 03:19:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900020.redintelligence.net/ Frame 6155 0
150 B 40ms
16ms Script
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/viewability?s=26621700014050404380384011909020&a=9525bbfe&vb=v
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=26621700014050404380384011909020&a=4ce7d508
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/request_content.php?s=26621700014050404380384011909020&a=4ce7d508
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Date: Fri, 25 Mar 2022 03:19:31 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

POST
H/1.1 200
OK postback Show response
s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/ Frame 0013 0
145 B 28ms
27ms XHR
text/plain 34.251.154.165
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.update.mediamathtag.com/2/2.52.0/619621/ASm7b-wJEAFOoIJA/postback?pd=avt&r2=&sr=4&si=2040408330&dm=300x250&pv=85e8b2c4-4efc-4cab-8dce-a98bbd57d7f1&ac=1129274&cr=10406290&c1=11142481&r1=2001%3Aac8%3A20%3A%3A&dt=6196211556140246740000&ap=&ti=3963160807121886307&ci=619621&de=43003&ai=215543&r3=&di=https%3A%2F%2Fwww.edocr.com%2Fv%2F517wqd7k%2Fhortensedannelly67%2Fif-you-are-suffering-ptsd-how-to-know&ui=4b830f38-0000-0000-0000-000000000000&pp=pub-6933461940627641&sid=ASm7b-wJEAFOoIJA&oz_sc=50add0b80789c688d0134a86&oz_df=1648178372227&oz_l=1571&cv=3
Requested by: Host: s.update.mediamathtag.com
URL: https://s.update.mediamathtag.com/2/2.52.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.251.154.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-154-165.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 25 Mar 2022 03:19:31 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c39b8da49b4b191f00365068d8401cc38c6747b58dbb1a7f5aab9601504e201f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK Text Show response
www.edocr.com/pas/Document/q/1-1/ 59 KB
13 KB 381ms
380ms XHR
application/json 18.213.171.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.edocr.com/pas/Document/q/1-1/Text?DocumentID=uhWiqwJET71pC7JVhy6Aqdg

Requested by

Host: www.edocr.com
URL: https://www.edocr.com/v/static/bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.213.171.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-213-171-36.compute-1.amazonaws.com

Software

nginx / Express

Resource Hash

b1a64fc40244852fa2c3898b7e91db5249975eb6d9c1667744215a43d213f548

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'

Request headers

Accusoft-Parent-Name: ViewerControl
Accusoft-Gid: 5VKOj2joAa2SiGiFyyWOEA
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
accept: application/json
Referer: https://www.edocr.com/v/517wqd7k/hortensedannelly67/if-you-are-suffering-ptsd-how-to-know
Accusoft-Parent-Pid: 0
Accusoft-Parent-Taskid: 0

Response headers

accusoft-data-encrypted: false
content-encoding: gzip
vary: Accept-Encoding
server: nginx
x-powered-by: Express
transfer-encoding: chunked
access-control-allow-methods: GET
content-type: application/json;charset=utf-8
access-control-allow-origin: *
date: Fri, 25 Mar 2022 03:19:32 GMT
Content-Security-Policy: frame-ancestors 'none'
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-headers: *
build-number: 2366

POST
H2 200 /
track.adform.net/serving/unload/ Frame 6155 35 B
478 B 18ms
18ms Ping
image/gif 37.157.2.239
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/serving/unload/?version=15&unload=6594634340124408730@@53795668,3840691473227840332,100|1200|0|0|0|0|0|0|0||47|1|||||1|0|0|WWHNNCURTlNcPlakbYq96SmecC03OaGQOgUZNEFUj6xBqpFM1QWiWPL_QlhaeLlf0|||11||0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.239 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://hal900020.redintelligence.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 25 Mar 2022 03:19:32 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://hal900020.redintelligence.net
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 cta2.png
s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/ Frame 8836 6 KB
6 KB 19ms
18ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/cta2.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

29a178ef3c1626a36a779437fce7a4ba20700a3b0c2de7d53bb5b55e96de9d31

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:43:55 GMT
server: nginx
etag: "622b19db-160e"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 5646

GET
H2 200 yellowtext.png
s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/ Frame 8836 11 KB
11 KB 21ms
19ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/yellowtext.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

f38c956fa96cd63879beffebc59279330f355eafe1e4999c6e468b25bf438f58

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:43:55 GMT
server: nginx
etag: "622b19db-2c08"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 11272

GET
H2 200 cta.png
s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/ Frame 8836 7 KB
7 KB 22ms
20ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/cta.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

2b140e04ea6d77d88727d37541252e2b42615867662e10d92391c6fea260d658

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:43:56 GMT
server: nginx
etag: "622b19dc-1a7f"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 6783

GET
H2 200 t.png
s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/ Frame 8836 9 KB
9 KB 23ms
21ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/t.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

3dd36dd268b8808f417be3accbc555d75348d1e33816a4a89578a19e30913b64

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:43:55 GMT
server: nginx
etag: "622b19db-23c9"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 9161

GET
H2 200 badges.png
s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/ Frame 8836 5 KB
5 KB 24ms
22ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/badges.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

358f9f3b2b106fb501d90f45f0cee352d9ee239ed019ff52d348eb90cd18b13c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:43:56 GMT
server: nginx
etag: "622b19dc-1495"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 5269

GET
H2 200 text_1.png
s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/ Frame 8836 6 KB
6 KB 24ms
22ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/text_1.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

cd4546cfc562b8dfb834b74e46ccd0f78bf0ab7ee91ff7dc715c4e0208cb640c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:43:55 GMT
server: nginx
etag: "622b19db-186b"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 6251

GET
H2 200 logo2.png
s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/ Frame 8836 8 KB
8 KB 26ms
24ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/logo2.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

d8d36539ac6036f468847f787e5c828257cafa51ce81b2c6765ea0f1d233a68a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:43:55 GMT
server: nginx
etag: "622b19db-1f0a"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 7946

GET
H2 200 pic.jpg
s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/ Frame 8836 22 KB
22 KB 28ms
26ms Image
image/jpeg 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/pic.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

d2d39c0ad41b427d5d263bf147a9608f486cf912cefae3a8878de63cc4cd2ad6

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:43:56 GMT
server: nginx
etag: "622b19dc-5662"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/jpeg
content-length: 22114

GET
H2 200 logo1.png
s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/ Frame 8836 12 KB
13 KB 30ms
29ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/logo1.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

568b692a7c14a8ba776f6ddcb4dd8682f2666fe4cf129dbbffb792f177b993db

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:43:55 GMT
server: nginx
etag: "622b19db-3148"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 12616

GET
H2 200 bg.jpg
s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/ Frame 8836 5 KB
5 KB 31ms
30ms Image
image/jpeg 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998793/bvpath_258/bg.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

6e69e3a7f3872a16efcd9e704ec4bbd0d813fcbd21b4ae212657d81dac4018f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:43:55 GMT
server: nginx
etag: "622b19db-129f"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/jpeg
content-length: 4767

GET
H2 200 cta2.png
s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/ Frame BB5C 6 KB
6 KB 20ms
19ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/cta2.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

29a178ef3c1626a36a779437fce7a4ba20700a3b0c2de7d53bb5b55e96de9d31

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:44:05 GMT
server: nginx
etag: "622b19e5-160e"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 5646

GET
H2 200 yellowtext.png
s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/ Frame BB5C 11 KB
11 KB 22ms
19ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/yellowtext.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

945daae9af025fb96df733fb40025a3d326d9ec3538bdee1c0a0524156e14531

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:44:03 GMT
server: nginx
etag: "622b19e3-2b81"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 11137

GET
H2 200 cta.png
s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/ Frame BB5C 7 KB
7 KB 23ms
20ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/cta.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

2b140e04ea6d77d88727d37541252e2b42615867662e10d92391c6fea260d658

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:44:03 GMT
server: nginx
etag: "622b19e3-1a7f"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 6783

GET
H2 200 t.png
s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/ Frame BB5C 9 KB
9 KB 24ms
21ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/t.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

3dd36dd268b8808f417be3accbc555d75348d1e33816a4a89578a19e30913b64

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:44:03 GMT
server: nginx
etag: "622b19e3-23c9"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 9161

GET
H2 200 badges.png
s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/ Frame BB5C 5 KB
5 KB 25ms
22ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/badges.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

358f9f3b2b106fb501d90f45f0cee352d9ee239ed019ff52d348eb90cd18b13c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:44:05 GMT
server: nginx
etag: "622b19e5-1495"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 5269

GET
H2 200 text.png
s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/ Frame BB5C 6 KB
6 KB 25ms
23ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/text.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

cd4546cfc562b8dfb834b74e46ccd0f78bf0ab7ee91ff7dc715c4e0208cb640c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:44:05 GMT
server: nginx
etag: "622b19e5-186b"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 6251

GET
H2 200 logo2.png
s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/ Frame BB5C 8 KB
8 KB 26ms
24ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/logo2.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

d8d36539ac6036f468847f787e5c828257cafa51ce81b2c6765ea0f1d233a68a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:44:03 GMT
server: nginx
etag: "622b19e3-1f0a"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 7946

GET
H2 200 pic.jpg
s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/ Frame BB5C 13 KB
13 KB 28ms
26ms Image
image/jpeg 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/pic.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

abf08c8cfd310b5370c90079b1cb2141b138d2099a296acb1955523c21451aa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:44:03 GMT
server: nginx
etag: "622b19e3-3285"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/jpeg
content-length: 12933

GET
H2 200 logo1.png
s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/ Frame BB5C 12 KB
13 KB 32ms
30ms Image
image/png 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/logo1.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

568b692a7c14a8ba776f6ddcb4dd8682f2666fe4cf129dbbffb792f177b993db

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:44:03 GMT
server: nginx
etag: "622b19e3-3148"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 12616

GET
H2 200 bg.jpg
s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/ Frame BB5C 32 KB
32 KB 32ms
31ms Image
image/jpeg 37.157.6.235
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998804/bvpath_258/bg.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

67deb6c0fc80f955168aeb2ea239d699ca43e0095b897c3a87c540622148b47c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 03:19:33 GMT
last-modified: Fri, 11 Mar 2022 09:44:03 GMT
server: nginx
etag: "622b19e3-7f92"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/jpeg
content-length: 32658

Verdicts & Comments Add Verdict or Comment

59 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.edocr.com/	1970-01-20 19:20:50	Name: _ga Value: GA1.2.843357066.1648178369
.edocr.com/	1970-01-20 01:51:04	Name: _gid Value: GA1.2.1845348439.1648178369
.edocr.com/	1970-01-20 01:49:38	Name: _gat Value: 1
.edocr.com/	1970-01-20 11:11:14	Name: __gads Value: ID=3c7541436798ee67-22b7a4dd64cd008a:T=1648178369:RT=1648178369:S=ALNI_MatIwFHhHL_A7Q8yUstLQNayGzfzQ
.doubleclick.net/	1970-01-20 11:11:14	Name: IDE Value: AHWqTUn_TWqtl8NDOcoUjMFAkZinO0wK5xTbLM5gdssStFPJgG3k1SSXa8clz9obWms
.mathtag.com/	1970-01-20 10:35:14	Name: uuid Value: bb4e623d-34c2-4f01-89c8-cc53790d2094
.doubleclick.net/	1970-01-20 01:49:39	Name: test_cookie Value: CheckForPermission
.adform.net/	1970-01-20 02:34:13	Name: C Value: 1
.mathtag.com/	1970-01-20 02:32:50	Name: mt_misc Value: mt_bt:1
.adform.net/	1970-01-20 03:15:58	Name: uid Value: 4261087921574507195
.adform.net/	1970-01-20 01:59:39	Name: TPC Value: 1648178370856

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
worker	error	URL: blob:https://googleads.g.doubleclick.net/f7fa57d2-63fb-4901-b6d6-3616acac38bf Message: Mixed Content: The page at 'blob:https://googleads.g.doubleclick.net/f7fa57d2-63fb-4901-b6d6-3616acac38bf' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'chrome-extension://eppiocemhmnlbhjplcgkofciiegomcon/content/safecheck-notification/notification-iframe/index.html'. This request has been blocked; the content must be served over HTTPS.
worker	error	URL: blob:https://googleads.g.doubleclick.net/f7fa57d2-63fb-4901-b6d6-3616acac38bf Message: Mixed Content: The page at 'blob:https://googleads.g.doubleclick.net/f7fa57d2-63fb-4901-b6d6-3616acac38bf' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'chrome-extension://cplklnmnlbnpmjogncfgfijoopmnlemp/skin/logo24.png'. This request has been blocked; the content must be served over HTTPS.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'none'

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
cdn.contentspread.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
hal9000.redintelligence.net
hal90002.redintelligence.net
hal900020.redintelligence.net
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.mathtag.com
s.update.mediamathtag.com
s0.2mdn.net
s1.adform.net
sync.mathtag.com
tags.mathtag.com
tpc.googlesyndication.com
track.adform.net
www.edocr.com
www.google-analytics.com
www.google.com
www.googletagservices.com
www.gstatic.com
142.250.185.194
178.63.52.121
18.213.171.36
185.29.132.245
185.29.134.249
2.18.233.201
2a00:1450:4001:800::2003
2a00:1450:4001:808::2002
2a00:1450:4001:80f::2002
2a00:1450:4001:810::200e
2a00:1450:4001:811::2006
2a00:1450:4001:827::2004
2a00:1450:4001:828::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2001
2a00:1450:4001:82f::200a
2a00:1450:4001:830::2003
2a00:1450:4001:831::2002
34.251.154.165
37.157.2.239
37.157.6.235
46.4.10.47
78.46.23.46
85.114.131.235
0b079edded6f39ce941497d71fa92b120de1e70da55aa004ca9290c3a38eeff7
0ce5fc08d0f617e71e1d61bcd79fc7cc1855f4221945b0c09ac774685fe7f52c
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
11cf30cc7421258aaed33d3e5f55f4a3113e3545fc56d80d97d3e9f26f29340c
1854c21f36f4fd7c4632eff7b9153f4cdcbbfc7061e45dc60c7a362a4dedf5e1
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
25cd364d1d45142a5ec41bdf88aea959bfb29d2155bfb1f084c8d96c684c5ace
29a178ef3c1626a36a779437fce7a4ba20700a3b0c2de7d53bb5b55e96de9d31
2b140e04ea6d77d88727d37541252e2b42615867662e10d92391c6fea260d658
2cef3a9d0606aecfe2476867e61f76535b9bb5b8e9d31957cc9504cdd1e69396
2f98ec8aa62f7d8d0ab3cbc9ffed158243bf948877af92bb5f1618139cfc638a
30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff
31cb87fb43bc2ae09ccf078f33fd5836c257ac1047a6059a8f36f817c126302a
32cff97624483ccfa9d3229fb95dbfd1818abfe2fcd4ee49e559b74c7a3dd821
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
358f9f3b2b106fb501d90f45f0cee352d9ee239ed019ff52d348eb90cd18b13c
3705d0878203cc0b2525dcb0f874d85cc6b881d1fca1869191da4e599c768241
38026c4784fcf701f05e311b889f71bf5e289997fa012b0dd73d6a4189e3ce6a
3d0bf782b47dcd079eedf6bb34ecb0742c114a4e4b90e37a58a412482101b475
3dd36dd268b8808f417be3accbc555d75348d1e33816a4a89578a19e30913b64
40915d40f709750eb1f1e0d1b091e27d51ae05e61783cb35829b041d683c62e0
4bf8bb400ae37758a4e865919e301d3796d65f66f8df33b5a5642aaace4cc772
4c5325edabfb7a618fea7fb98d21d0940c941d4533c4e337923515685808a056
50c76d517288a7c22e66a60865e29c0ee563c7efbdc3613b6eba33b03a3f76c3
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
566b9670644559b5460f2b0e0f217709742edb5f53197b537e48c208fc698853
568b692a7c14a8ba776f6ddcb4dd8682f2666fe4cf129dbbffb792f177b993db
56b292bab6c777111694aa0bffda487c3108b1e83091ea8471e316272f9d1aff
5c5a63a864325e51a1ac832da94644b4ec7d66b70626760014ef7bf8b65ec448
613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
65e4e63638e9c69fe634cc25b595b20afe3e704f5eb8adf36a551e3c23a12ecf
6782215ea228a5c0371b214feeb549d547dede26f1bf46836814a7fbabb2bb11
67deb6c0fc80f955168aeb2ea239d699ca43e0095b897c3a87c540622148b47c
68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f
6e69e3a7f3872a16efcd9e704ec4bbd0d813fcbd21b4ae212657d81dac4018f7
6fd51e014f7ab21eec7e153ef3738206cace66412ff99623569519d5f79a6bac
7175887b4ec767c80d43eda3f4070a6cd33fd6dfe4097657dbb6545f517b6ea5
719b27dfe323e678599d8cf5bebb2744095764a444f9b6bff461e312478a5dd2
7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb
806db4e3ac98ee961038785629e89aff582d148133549902f5c88abf17ddb819
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8477bd11f6b4cce1a91280b37b8c959c7b0870e89cd9484ffbb86221d1132283
848fe19ed492948709b881f504ce2eb6274baa694606ca88eb9b2990a2460caf
8a6ab4ede09cb858d2441f13e4847da17ed2abbe394632178c94170125635b9f
8bbff151893ffea06fd518f6f3a33f55d89dae54f22bc9bd86df525b4f783d69
8ecb036eea58eb2fab29d0e34d5cb72af23798b9cb91f670314419bb05afde61
945daae9af025fb96df733fb40025a3d326d9ec3538bdee1c0a0524156e14531
97f4de4234de0c66f34a18d267569e9c1e5e43e77f616695e767ad2f8443dfe4
9c9aeeb6d9c96160febe5833e3aed03a81d844f8f63387a12ddb69f283036b75
9d603defe54dfe7c92cd890e4f93a2e551e8b09f2c80ed871809fdae912dfdb5
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
abaa484421865309a7781e540844f1b5260ed131080f8dd9f083d8f18beea107
abf08c8cfd310b5370c90079b1cb2141b138d2099a296acb1955523c21451aa3
abf8d2aeb03cb656b26c7a29725740627171bfcacb28a6642e4dae2fbc055714
aed4513db8174254e7423acc676d4cd8f33ccfd3c52551c56750f714e0535f49
af5593bd91f52e2007a2073ba805484295d58267e88dd0a48fc6f570ba5af597
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1a64fc40244852fa2c3898b7e91db5249975eb6d9c1667744215a43d213f548
b1ba9fa4ad8fdf667f000a62ef0aebcd3b169d9e70a0e7079072471016139c68
b2606a2b05d00b5c7d3773c2be6971319480f6cb1875cbfe89d047c3eda13bfb
b64067c9d665cf2adefd541b8fb58617edbfec87b79b5541f8fcbc5022004876
b8657baaa6b95a17c934001c3338f3cdff05bf8ce67ffe25c3b7ab53cd580241
be8d2506984b22a5aa9f9fcd671777dbedb2839e038c1d6cdd63652f0a931924
bea63616949c80ff0dfdbb1e8547f1585882fc691483317b06441688e3e5f14a
c14b947fe790ad749be51a4cdad89070847207f030a5270711cdaf450c1ef56e
c39b8da49b4b191f00365068d8401cc38c6747b58dbb1a7f5aab9601504e201f
c98f398eb1da71fede6ef3c68de0638d9ef1e861191ce86f1ed4938bc1fe7716
cace9a9a69b280eb43fca1fe5c83740ddc85bc769c5c5de08d46540f612c22b5
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cc584b5aa6d48c1db1877e0652bfe18beae92103f3a105d8a184215ba0d8867e
cd4546cfc562b8dfb834b74e46ccd0f78bf0ab7ee91ff7dc715c4e0208cb640c
cf90ceac479865c66da64bac9449a2917e0654a13dc3870f9ad7fb460b0299e4
d072a09604e6a1fea8ef42203503771aa36b63a3c91fd1059966e26e6f5812b3
d2d39c0ad41b427d5d263bf147a9608f486cf912cefae3a8878de63cc4cd2ad6
d8d36539ac6036f468847f787e5c828257cafa51ce81b2c6765ea0f1d233a68a
d9187af978cdf09b2f3b386b6c3623d78e571ef481331a9c51e52587ee529d1e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6d3c35d004dc673dcfde2897afabd8910dc3d8d64fd056913316f23885983d8
ebc1809c917b61781cda24334f55c7010d9bf8986b99ea3f59d049e78d491910
ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f38c956fa96cd63879beffebc59279330f355eafe1e4999c6e468b25bf438f58
f7e06ae449bdd4ebece6e26cdb36840f7cb19f28b57bbb6b8647a54535557d3f
f99987031e482c75b0b80629df2eabc51f2d328452802c11446e601abc6fab0a

www.edocr.com Open in urlscan Pro 18.213.171.36 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

131 Requests

97 %HTTPS

50 %IPv6

16 Domains

24 Subdomains

25 IPs

5 Countries

1775 kBTransfer

4903 kBSize

11 Cookies

0 Outgoing links

Redirected requests

131 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.edocr.com Open in urlscan Pro
18.213.171.36 Public Scan

Screenshot
Live screenshot

Full Image

131
Requests

97 %
HTTPS

50 %
IPv6

16
Domains

24
Subdomains

25
IPs

5
Countries

1775 kB
Transfer

4903 kB
Size

11
Cookies

131 HTTP transactions
7 data transactions