www.buholegal.com Open in urlscan Pro
104.21.59.127 Public Scan

Software

sffe /

Resource Hash

9e98de602014c431f28dec4b9230ba2b2242e9a36fa9b34b00f2569707121cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1031 / 787 of 1000 / last-modified: 1635789135"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27197
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 01 Nov 2021 21:07:53 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
51 KB 92ms
51ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.buholegal.com
URL: https://www.buholegal.com/9261187/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f10.1e100.net

Software

cafe /

Resource Hash

75b1399a5199efdbed363524290b057cf386d13b8822322a5ae7e11291ccd57f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51575
x-xss-protection: 0
server: cafe
etag: 7543465498425576565
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 01 Nov 2021 21:07:53 GMT

GET
H2 200 css
fonts.googleapis.com/ 3 KB
696 B 16ms
15ms Stylesheet
text/css 142.250.185.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans

Requested by

Host: www.buholegal.com
URL: https://www.buholegal.com/buho_media/css/estilov4972.css?v=1.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c99361c0d8561c7d88a237009bac83ecc149fe6f1f91c52dde79b7841b584c40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 01 Nov 2021 20:01:25 GMT
server: ESF
date: Mon, 01 Nov 2021 21:07:53 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires: Mon, 01 Nov 2021 21:07:53 GMT

GET
H2 200 sign-widget-v1.0.0.js Show response
sandbox.mifiel.com/ 3 KB
2 KB 259ms
215ms Script
application/javascript 172.66.42.221
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sandbox.mifiel.com/sign-widget-v1.0.0.js

Requested by

Host: www.buholegal.com
URL: https://www.buholegal.com/9261187/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.42.221 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

676900f241e54a32ebf94df7f43527c29a4663b67dee85a3c6d8a4dc7a3635f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ONEIMcNjOsqNtXOmUqgMhqzAY3D%2BDpi4QY%2FKA8kvDFXmz7U83Psxmi43uWZ%2FqBJ2ovA3It1jsFFuahcht6cOeSGDHlj%2Fdbx2Y5vmuJcj39XF%2FeE70bMwDL%2BnHUSlZPcWmPAO6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
strict-transport-security: max-age=63072000
x-xss-protection: 1; mode=block
x-request-id: 375fc805-5da4-4ffa-b0f5-9e5075439d4b
x-runtime: 0.005330
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"676900f241e54a32ebf94df7f43527c2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
x-download-options: noopen
content-type: application/javascript
cache-control: max-age=0, private, must-revalidate
cf-ray: 6a7818616aa9f9d2-PRG

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 80 KB
27 KB 37ms
14ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: www.buholegal.com
URL: https://www.buholegal.com/9261187/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

sffe /

Resource Hash

9e98de602014c431f28dec4b9230ba2b2242e9a36fa9b34b00f2569707121cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1031 / 575 of 1000 / last-modified: 1635789135"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27197
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 01 Nov 2021 21:07:53 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 101 KB
39 KB 43ms
21ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-P9ZB9CL

Requested by

Host: www.buholegal.com
URL: https://www.buholegal.com/9261187/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

0e0c1811a8d4ebe4ee24a3d35a72caec78fbdeb0d15d616269d5d21bad2d8eb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39653
x-xss-protection: 0
expires: Mon, 01 Nov 2021 21:07:53 GMT

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v27/ 16 KB
17 KB 30ms
8ms Font
font/woff2 142.250.186.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v27/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f3.1e100.net

Software

sffe /

Resource Hash

cce577471c2586f3e0c2518fff84a970d33f61491fb8c629341b86f238cf07c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.buholegal.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 13:30:26 GMT
x-content-type-options: nosniff
age: 27447
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16692
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 00:32:10 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 01 Nov 2022 13:30:26 GMT

GET
H3 200 fontawesome-webfont5b62.woff2
www.buholegal.com/buho_media/fonts/ 70 KB
71 KB 339ms
339ms Font
application/octet-stream 104.21.59.127
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.buholegal.com/buho_media/fonts/fontawesome-webfont5b62.woff2?v=4.6.3
Requested by: Host: www.buholegal.com
URL: https://www.buholegal.com/buho_media/css/font-awesome.css?v=1.1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.59.127 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Request headers

Referer: https://www.buholegal.com/buho_media/css/font-awesome.css?v=1.1
Origin: https://www.buholegal.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
cf-cache-status: REVALIDATED
last-modified: Tue, 12 May 2020 15:51:26 GMT
server: cloudflare
etag: "118d8-5a5756faa67cf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RtuK%2FbqIdmosYIKHRFJ8gNXJTi4F4pGZIbImhgrr6GVWJwcYIko43r6dfU%2BRbxRDI5thMB301HNMGCK3cMeFyKP0GyjZqDh0FJx2WhTgDrjuXZe%2FUR9g2DLHJBKP4f7FK75pVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 6a7818611d825c80-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 71896

GET
H3 200 ads_moviles.html Show response
www.buholegal.com/html/ Frame 931D 707 B
859 B 350ms
350ms Document
text/html 104.21.59.127
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.buholegal.com/html/ads_moviles.html
Requested by: Host: www.buholegal.com
URL: https://www.buholegal.com/9261187/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.59.127 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 987f7fa8101670a8f1787f1153565e7f609120f3e97c51fa38e36fe1255baca7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/9261187/

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
content-type: text/html; charset=utf-8
vary: Cookie,Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=06n71G%2FWKpvoSCaJ4I5NuRVvkdAkHu5SlSRDHpNwHQXltStKqVsu986wcbGDA1wdOAepSxaVNCzMO%2BpTLdUDoocUByv1cpDUhX4X6Y7H1RWGaT4IRe29zwNgJJjoM4p2eA%2BgWA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6a7818612dbb5c80-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 u-440qyriQwlOrhSvowK_l5-fCZM.woff2
fonts.gstatic.com/s/merriweather/v25/ 20 KB
20 KB 21ms
14ms Font
font/woff2 142.250.186.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/merriweather/v25/u-440qyriQwlOrhSvowK_l5-fCZM.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Merriweather|Open+Sans|Tinos

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f3.1e100.net

Software

sffe /

Resource Hash

c435a36c4117826fc7b7b8023aaf45d65e59bcb814c8f1b1e28bea7c49318c13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.buholegal.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 16:07:23 GMT
x-content-type-options: nosniff
age: 363630
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20016
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:21:51 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 28 Oct 2022 16:07:23 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 49ms
13ms Script
text/javascript 142.250.185.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.buholegal.com
URL: https://www.buholegal.com/9261187/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 26 Oct 2021 23:24:02 GMT
server: Golfe2
age: 4039
date: Mon, 01 Nov 2021 20:00:34 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Mon, 01 Nov 2021 22:00:34 GMT

GET
H3 200 pubads_impl_2021102801.js Show response
securepubads.g.doubleclick.net/gpt/ 350 KB
118 KB 34ms
20ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102801.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d5b83174b14c8fb07a6cfc17abbc860e726a23b84f724c468049c73e1e8d7cba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 120786
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 08:34:36 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 01 Nov 2021 21:07:53 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 70 B
98 B 30ms
15ms XHR
application/json 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.buholegal.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f14.1e100.net

Software

cafe /

Resource Hash

2a74dee3c53c6f11d4f7aceb117e6b69869a6a65808adb732df662d63e234e95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 73
x-xss-protection: 0
expires: Mon, 01 Nov 2021 21:07:53 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 29ms
14ms XHR
text/plain 142.250.185.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1234230206&t=pageview&_s=1&dl=https%3A%2F%2Fwww.buholegal.com%2F9261187%2F&ul=en-us&de=UTF-8&dt=CARLOS%20GABRIEL%20JUAREZ%20TAPIA%20-%20C%C3%A9dula%20Profesional&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAAABAAAAAC~&jid=626226881&gjid=1777254922&cid=317528540.1635800873&tid=UA-43423657-1&_gid=73292432.1635800873&_r=1&_slc=1&z=661490387

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.buholegal.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.buholegal.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 67ms
25ms Script
application/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.buholegal.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 85 KB
34 KB 347ms
347ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1146973367066671&correlator=1349448160527890&output=ldjh&impl=fifs&eid=31063213%2C31063281&vrg=2021102801&ptt=17&sc=1&sfv=1-0-38&ecs=20211101&iu_parts=5994246%2CCedulas_300x600&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&cookie_enabled=1&bc=31&abxe=1&lmt=1635800873&dt=1635800873270&dlt=1635800872990&idt=261&frm=20&biw=1600&bih=1200&oid=2&adxs=30&adys=103&adks=2158746279&ucis=1&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.buholegal.com%2F9261187%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x642&msz=300x-1&ga_vid=317528540.1635800873&ga_sid=1635800873&ga_hid=1234230206&ga_fc=true&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd5643e127f9a5c0b5f02d9f8b4e4e14b4f65209164235bedeecaccb590f538b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34799
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.buholegal.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F538 6 KB
4 KB 78ms
15ms Document
text/html 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 01 Nov 2021 21:07:53 GMT
expires: Tue, 01 Nov 2022 21:07:53 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
441 B 71ms
23ms XHR
text/plain 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-43423657-1&cid=317528540.1635800873&jid=626226881&gjid=1777254922&_gid=73292432.1635800873&_u=IEBAAAAAAAAAAC~&z=356053427

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wg-in-f154.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.buholegal.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 01 Nov 2021 21:07:53 GMT
content-type: text/plain
access-control-allow-origin: https://www.buholegal.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110260101/ 269 KB
96 KB 67ms
44ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110260101/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f586908e1642b74b0aa033141d0b9cee3ab2714b2b7bb71affc654354ffc8ef6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 98729
x-xss-protection: 0
server: cafe
etag: 13090637027451372560
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 01 Nov 2021 21:07:53 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211027/r20190131/ Frame 22A9 10 KB
5 KB 31ms
8ms Document
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211027/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ba6c99545dd22a1ceac617b8abf42bd5347ea8a3c6c2baaf9e4ce98da8c2e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 01 Nov 2021 00:44:07 GMT
expires: Mon, 15 Nov 2021 00:44:07 GMT
content-type: text/html; charset=UTF-8
etag: 3095056338170221291
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4754
x-xss-protection: 0
age: 73426
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 203 B
440 B 16ms
15ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.buholegal.com&callback=_gfp_s_&client=ca-pub-6577344375831064

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110260101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6472eb5ce6bb517b7099df98cc8face0bffd60aa8bbc4cb588f2bba63971e5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 193
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 30ms
16ms Script
application/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.buholegal.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110260101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1785 436 B
235 B 253ms
238ms Document
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6577344375831064&output=html&h=50&slotname=7207804048&adk=2268747160&adf=3610118697&pi=t.ma~as.7207804048&w=320&lmt=1635800873&psa=0&format=320x50&url=https%3A%2F%2Fwww.buholegal.com%2F9261187%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635800873287&bpp=3&bdt=297&idt=115&shv=r20211027&mjsv=m202110260101&ptt=9&saldr=aa&abxe=1&correlator=2203469805193&frm=20&pv=2&ga_vid=317528540.1635800873&ga_sid=1635800873&ga_hid=1234230206&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44752094%2C31062423%2C31062937%2C31063301&oid=2&pvsid=1146973367066671&pem=121&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfnpEr%7C&abl=CF&pfx=0&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&xpc=BCRw7QqJc2&p=https%3A//www.buholegal.com&dtd=131

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110260101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dacfc335c8a1a845437f6daac42f372b9c7ac945cc00ab8e6b5ca06db4e21476

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 01 Nov 2021 21:07:53 GMT
server: cafe
content-length: 212
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 01 Nov 2021 21:07:53 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6047 0
19 B 35ms
31ms Document
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6577344375831064&output=html&adk=1812271804&adf=3025194257&lmt=1635800873&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.buholegal.com%2F9261187%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635800873300&bpp=1&bdt=311&idt=122&shv=r20211027&mjsv=m202110260101&ptt=9&saldr=aa&abxe=1&prev_fmts=320x50&nras=1&correlator=2203469805193&frm=20&pv=1&ga_vid=317528540.1635800873&ga_sid=1635800873&ga_hid=1234230206&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44752094%2C31062423%2C31062937%2C31063301&oid=2&pvsid=1146973367066671&pem=121&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=129

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110260101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 01 Nov 2021 21:07:53 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 01 Nov 2021 21:07:53 GMT
cache-control: private

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 931D 80 KB
27 KB 123ms
123ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.buholegal.com
URL: https://www.buholegal.com/html/ads_moviles.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e98de602014c431f28dec4b9230ba2b2242e9a36fa9b34b00f2569707121cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1031 / 751 of 1000 / last-modified: 1635789135"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27197
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 01 Nov 2021 21:07:53 GMT

GET
H3 200 container.html Show response
80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 641D 6 KB
3 KB 37ms
15ms Document
text/html 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 01 Nov 2021 21:07:53 GMT
expires: Tue, 01 Nov 2022 21:07:53 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 pubads_impl_2021102801.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 931D 350 KB
118 KB 16ms
16ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102801.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d5b83174b14c8fb07a6cfc17abbc860e726a23b84f724c468049c73e1e8d7cba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 120786
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 08:34:36 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 01 Nov 2021 21:07:53 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 641D 0
0 72ms
50ms Fetch
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvNEGFtxAJ51oIRBfFZMUp-uEkQC8_DQWVGwxL_D8awj4pGkAbdk21HolSASfgF_YgpJj05phmwCqNi0ViIRELLn3_trSOEn3I-uy2XHT1UXPVCygBIoAQsovXXX8AIBoH3DAlu_nNjtoe_ys-3w_ZYl_vwa1EggSJWcTbyW4McEi33He94urBvvvY_sudMb1WLKlQIH_6tMgFzq1xHH6aasNQhfed8W_BWvcLxsOl7dqOA5INHgjnXxJMxC5SZPXIb2bvyYV2lnfgODj2xg3muHekAsNXlFbZEinspSDly6F5c81xA0kQZVBQe3_zFn9IMB4dI_5mtiWAiciX9GOYK1J9Puq6R1axASQa4p76ph7ECO3xOCEHAWiDwZHb4g92wIYGuSnVJ7lWXIaehaD7XohyxuSVov5eBYBIe0RdRaCtcFLULry-iz9UhP8e4LgWSQSso2MyjKQprAtHiTGYeulr_90rx2rP_d2ycSLMMp-FSjQrbYIgbw_rXeEibBINtTejRo_rGYHNAf8psEhd6zFJRa_LKV0DAvQ7HHZFPDqiumdGgY9jxDwURM9X7mTO0JJd1cEnPrYk_cV1Zv1uIKnwDrxWw_JT9q1AcEqPsrd1AMetSGQjVngj0g6FeOV2wKqAO4J7x0BUuwIn-Bd1gMPEdrfq4xiT2UKO2ndGyhnBcYXV4JrI81DjmVqRM1_KcJ5qHg7PGhL041eZDGn6G1Min20wv7MhmYrlc5aQxVsIzWnyL6AqzxYZVeaKQiVul2JgtvQVsAmdBRX9dLn8KtgzkNirbwYLOOBX4Cudb8bYUmQX6tGZFMQcfPenrWWUb7_yopdXSJnLSOrVIfKehulJjBGzQq1wAoPEcGQoopYwZmdCMMQFIL5AxuGw1iePK_qI71pzK1ykt6HtK8a8bofRCkMReMKWkDfy3fZNvcgCtVY2-SBZDmEilz9ajdYV339YBd7icNLFk-3VBxpBV0A6Kw1jHYjIKz14PWzcSrbuq2Thd88u0IBv7lht1S2Y5cwXLFV3oruDGxKhDbAUbWfe4vbYexUAlcBRkzdz2E5jPkBTBK_waFvXZqTPvv2mxWmM0FTVfqWskAymIuYyeHsTxSlkYL6V9p4YxyUtThSA6uXwSPweXrAcBLh6zikzjTVOed2cDrcRCBcV6eiSmIA&sai=AMfl-YQUlVfEQybfqTHZihM8l54kSVtxmIgdV_Q2jwTEH8TF6gw24n4SWx-KbjRLjg_jySW-KfDkonJqdt4ONhHmZK84OuXku44tMXyR2xcC_5ka2vKAcqi6KntbuQA6EZ4BOba9sAtA2S67u1_GxcJmr1ettA&sig=Cg0ArKJSzLebDs1OC9DeEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=

Requested by

Host: www.buholegal.com
URL: https://www.buholegal.com/9261187/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 01 Nov 2021 21:07:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Mon, 01 Nov 2021 21:07:53 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 641D 106 KB
38 KB 79ms
17ms Script
text/javascript 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: www.buholegal.com
URL: https://www.buholegal.com/9261187/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/
Origin: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 14:19:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 24489
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 02 Nov 2021 14:19:44 GMT

GET
H3 200 omrhp_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20211027/r20110914/elements/html/ Frame 641D 6 KB
3 KB 17ms
17ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211027/r20110914/elements/html/omrhp_fy2019.js

Requested by

Host: 80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com
URL: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fb9268e99659f17a183de7aa0d4e27453f96c159a7ba99d6482522f8f72d1009

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 18:21:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9980
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2631
x-xss-protection: 0
server: cafe
etag: 10983085961369067521
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 Nov 2021 18:21:33 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 641D 41 KB
15 KB 38ms
14ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.buholegal.com
URL: https://www.buholegal.com/9261187/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 11:10:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35832
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 01 Nov 2022 11:10:41 GMT

GET
H2 200 m_js_controller_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/ Frame 641D 32 KB
13 KB 30ms
7ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/m_js_controller_fy2019.js

Requested by

Host: 80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com
URL: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

002662734b810835044f5f6a1d05ec0c79da815806b514b24e67240bb189875b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 20:00:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4030
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12996
x-xss-protection: 0
server: cafe
etag: 16706994958946462632
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 Nov 2021 20:00:43 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/ Frame 641D 3 KB
2 KB 37ms
14ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/window_focus_fy2019.js

Requested by

Host: 80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com
URL: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4af635698cb6488a8df86b99febedbc979c76e04f675f3a9cdc66f7b4d86aff6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 201
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1470
x-xss-protection: 0
server: cafe
etag: 9165589572046851897
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 Nov 2021 21:04:32 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/ Frame 641D 14 KB
6 KB 33ms
10ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com
URL: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7155d8dd40ece849d72213770b3a5b84467de8c6cab5c3bda3266808502cb69b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:06:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6337
x-xss-protection: 0
server: cafe
etag: 7721474052657771746
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 Nov 2021 21:06:48 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 641D 119 KB
36 KB 65ms
43ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com
URL: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

sffe /

Resource Hash

d16d61e50a6c8f915deadde160aff9a3ba942fa1eb64c058eb74a646c114e749

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37252
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1635368421117528"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 01 Nov 2021 21:07:53 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211027/r20110914/ Frame 641D 19 KB
8 KB 35ms
12ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211027/r20110914/abg_lite_fy2019.js

Requested by

Host: 80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com
URL: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9098bce32fa311e967ba3bae1f3c4763801acf08ba95c67fb477f468e42a69a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:03:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 255
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7760
x-xss-protection: 0
server: cafe
etag: 2659786357195577193
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 Nov 2021 21:03:38 GMT

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 931D 107 B
122 B 17ms
16ms Script
application/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.buholegal.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 931D 25 KB
11 KB 440ms
440ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2939022260785579&correlator=3027656212332660&output=ldjh&impl=fifs&eid=31060888%2C31062931&vrg=2021102801&ptt=17&sc=1&sfv=1-0-38&ecs=20211101&iu_parts=5994246%2CCedulas_320x50&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50&cookie=ID%3D540cec23b9f2dfe0-226ef79707cb00d8%3AT%3D1635800873%3AS%3DALNI_MaVy9A6iKMl8qcMEFacdQZEWFSDgg&cdm=www.buholegal.com&bc=31&abxe=1&lmt=1635800873&dt=1635800873712&dlt=1635800873501&idt=206&ea=0&frm=23&biw=1600&bih=1200&oid=2&adxs=-12245933&adys=-12245933&adks=230451187&ucis=c9qxnccjv0vz&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&url=https%3A%2F%2Fwww.buholegal.com%2Fhtml%2Fads_moviles.html&ref=https%3A%2F%2Fwww.buholegal.com%2F9261187%2F&top=https%3A%2F%2Fwww.buholegal.com%2F9261187%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=0x-1&ga_vid=317528540.1635800873&ga_sid=1635800874&ga_hid=38438775&ga_fc=true&fws=256&ohw=0&btvi=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7675f19f42cab28fa6634098664946a4fff97efc68e1ce774c640943a823fc1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:54 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11603
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.buholegal.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 1D05 6 KB
3 KB 29ms
15ms Document
text/html 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 01 Nov 2021 21:07:53 GMT
expires: Tue, 01 Nov 2022 21:07:53 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7669 22 KB
8 KB 43ms
17ms Document
text/html 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Mon, 01 Nov 2021 11:10:41 GMT
expires: Tue, 01 Nov 2022 11:10:41 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 35832
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 641D 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c1766904a66f2d3e2fd73c54b9dba61d23abff7cbd72a4954a6664923cdef5ab

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 931D 12 KB
9 KB 54ms
30ms XHR
application/json 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021102801&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc7dc3e38b31eb73e6801a76116581b8c4a9a8db6a10ffdd2436c84c8c03cb57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9223
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 931D 17 KB
6 KB 41ms
41ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 01 Nov 2021 21:07:53 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/ Frame F6C2 4 KB
2 KB 35ms
14ms Document
text/html 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec787009467ae99675ae0900f3eeac6218c94d965c12b69ee9fabc3b7f5b8ed8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 1567
date: Mon, 01 Nov 2021 10:53:32 GMT
expires: Tue, 02 Nov 2021 10:53:32 GMT
last-modified: Mon, 19 Apr 2021 16:55:43 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 36861
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 gdn
metrics.getrockerbox.com/track/ Frame 641D 44 B
685 B 153ms
113ms Image
image/gif 172.67.177.215
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://metrics.getrockerbox.com/track/gdn?source=been_verified&tier_one=gdn&tier_two=12790573566&tier_three=124080804871&auction_id=409960098
Requested by: Host: 80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com
URL: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.177.215 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 039a8bb6d736466063dde3c2a80d71d54456a7875cb1654263058bc69c1c042d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://80356cc31b536fd44ed8464a471d7f39.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:53 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P%2BQQhGwSTs%2FjXwW5aHjb4KMXVns3bVvptXfSWC83YGyMccw3vkJRy4RddUDzgJgkDpd%2FpMJcQnAdsT1A8QPh6fD7LP4AevEf53OUg9cuj3866dTYy6Iid83mI4%2BCdlUh8G1dbjEDQ5aAyog%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cf-ray: 6a781865dc214c80-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 sKl_vPiz0OchHmL4Vfbrj3Wozc3CsK_Jq53kDzx3_oA.js Show response
pagead2.googlesyndication.com/bg/ Frame 7669 35 KB
13 KB 17ms
17ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/sKl_vPiz0OchHmL4Vfbrj3Wozc3CsK_Jq53kDzx3_oA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b0a97fbcf8b3d0e7211e62f855f6eb8f75a8cdcdc2b0afc9ab9de40f3c77fe80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 17:57:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11399
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13525
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 18:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 01 Nov 2022 17:57:54 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 60AC 12 KB
5 KB 17ms
17ms Document
text/html 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Mon, 01 Nov 2021 20:39:39 GMT
expires: Tue, 01 Nov 2022 20:39:39 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1694
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 99B1 783 B
1 KB 70ms
29ms Document
text/html 142.250.184.228
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.228 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f4.1e100.net

Software

GSE /

Resource Hash

ac88d91e33d0e192631f0e032fa00f09f52e058944d9ecc680e9ffd8d6696730

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-RPbiuWMowSOU+S5vtzCYAQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Mon, 01 Nov 2021 21:07:53 GMT
date: Mon, 01 Nov 2021 21:07:53 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-RPbiuWMowSOU+S5vtzCYAQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 style.css
s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/styles/ Frame F6C2 3 KB
916 B 14ms
13ms Stylesheet
text/css 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/styles/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65b21d8a256537521d2724adddac3be60787f4264b443a42542a19975693cd6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 08:07:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46809
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 890
x-xss-protection: 0
last-modified: Mon, 19 Apr 2021 16:55:43 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 02 Nov 2021 08:07:44 GMT

GET
H3 200 script.js Show response
s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/scripts/ Frame F6C2 2 KB
635 B 14ms
14ms Script
text/javascript 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/scripts/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d44dd867f44722158fd47846c41a31d4d58d37d40c8e317fb9d86dcd5d4ec590

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 10:53:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36861
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 609
x-xss-protection: 0
last-modified: Mon, 19 Apr 2021 16:55:43 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 02 Nov 2021 10:53:32 GMT

GET
H3 200 logo_bv_color_gray.png
s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/images/ Frame F6C2 15 KB
15 KB 15ms
15ms Image
image/png 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/images/logo_bv_color_gray.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/styles/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6a8f5f0931704c81aa0386a31800f15b8eafed64922c450c83ddd0f8b401a03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/styles/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 10:37:51 GMT
x-content-type-options: nosniff
age: 37802
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15390
x-xss-protection: 0
last-modified: Mon, 19 Apr 2021 16:55:43 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 02 Nov 2021 10:37:51 GMT

GET
H3 200 search.png
s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/images/ Frame F6C2 514 B
538 B 14ms
14ms Image
image/png 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/images/search.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/styles/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c8eb253ff9058165db575680b7b02a051c5095ecb74688dad21f87095b9d9792

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/6440760/1618851343104/MAR-218-HTML-BV-ugly-whiteBG-300X600/styles/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 10:37:51 GMT
x-content-type-options: nosniff
age: 37802
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 514
x-xss-protection: 0
last-modified: Mon, 19 Apr 2021 16:55:43 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 02 Nov 2021 10:37:51 GMT

GET
H3 200 sKl_vPiz0OchHmL4Vfbrj3Wozc3CsK_Jq53kDzx3_oA.js Show response
pagead2.googlesyndication.com/bg/ Frame 60AC 35 KB
13 KB 16ms
16ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/sKl_vPiz0OchHmL4Vfbrj3Wozc3CsK_Jq53kDzx3_oA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b0a97fbcf8b3d0e7211e62f855f6eb8f75a8cdcdc2b0afc9ab9de40f3c77fe80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 17:57:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11399
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13525
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 18:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 01 Nov 2022 17:57:54 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 12 KB
9 KB 29ms
28ms XHR
application/json 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021102801&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4679d697a09cf0017897dda8794bdb37c40332e2f34219946c51c717ced80d89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 01 Nov 2021 21:07:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9312
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 99B1 0
0 64ms
64ms Image
text/html 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021102801&jk=2939022260785579&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: mil04s23-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7669 0
20 B 52ms
51ms Image
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Be9FkKVeAYZDiEqbD7_UP1rG3iA0AAAAAOAHgBAI&bg=!JCelJ2PNAAZzbWp4c207ACkAdvg8WglRJymli_XzU6u-1efwH-bpQY7UWObNxUiksYcFAscTN8mYRAIAAACAUgAAAA9oAQcKAB67JVGNl3BeO6x5sTugskUl7x0Ix5gGXfMdCvhCKxmZAyQAljvYhk5or1JikeXv-cG30mTneIOIFVPdh1Z29XCh5fxKJqhFbPkl_MVo3AXVlF_O-tHXgkaO5cn6O_CVnNyL8RE5JV4ksrDcx35LNyBORHdDOwYEq_fxC8mRxIbZI2iBit8kvjOghVxWZwPh9ivLVvK4J3pFuBTv0eC7u_s9GpkN2QDOESnurlY8Iyc3Fw7swoykZLE6gj0MQdRIMOzoQ-I4zD8sL0_hJsG2mYvIQoY3kbrcgoCL9tln9TLLLCXyLIVgKwHZDVnOgbDWgLsbTHLjvRSyfIo7-S2h71s0AltNxERXjS_xvPx38QtPfpfV8QnAwcVqjAVfEd-YAl32B2QTgqGMUvBQOWNb-e0CZmQWpGR31sV-BqkWE0GEl-PvmMyyx2J3vEc5Rlmpm1vGiTD6d8HLJKIwtek9AX24JV_iP6g7Fx7EWP4CZpJzRuVEIQ_stJMC21AqUO5Ho5COr_i1bvh-bFvn_X_HKBaat_VpFIEfHvqYmoeHRVmEG2zGiZeYosAA4oRifHOzN4IqqkroYHt0fYl6y5sFGn7hGqfPNjExzM97q6pahPEOYPhZ1OTSFaBsNK_3So7PkjM_b4sPw_eE5EZzV24lhMVPFQ8MjClFEj0-NOknrqt8nl7x8GDkLSVQ7jb5o6RsKn2nbxxiEA9vnT9E-iUYj7DEgR-1drsX-FvCW_33hJN9PpKmmz8NTiCW0hQmCKTahFUc8LENNkWSSatr4ksqOY6u0Q6m9NmZoXuXlwoFS_piqjffDt7J2CIjpGE0oIG0lUATgemmeERC7M35T83jByVc0g-Og5tzUbA7dp4Y56Uta2R4sBWil2pDEBXs1xFDkRMeE5TjKygYcodTq38TZoedsuVWUFplU6639NvEwU14V-LG07O3FJxJbEk6yGupD0PkUXjmVIiGeP3ykN-zgmIXqwBv0-QwWLn2rAfbtfzeDHGgiQZSnbRpfaoxxuuAV8b8jv75peaH4u2dg1GhqmuOXYdQjCbnL3mBHzXNCmUA2Y0G1jsrMjnhiqEKJN8cUESVEWcNqkT6RGwGubVJqRt3l0-Fus0

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 28ms
27ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 01 Nov 2021 21:07:54 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 35FA 12 KB
5 KB 19ms
18ms Document
text/html 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Mon, 01 Nov 2021 20:39:39 GMT
expires: Tue, 01 Nov 2022 20:39:39 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1695
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 4021 783 B
533 B 38ms
19ms Document
text/html 142.250.184.228
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.228 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f4.1e100.net

Software

GSE /

Resource Hash

0855b79c86e6278dab01f248d7d7730bea1edff43b49f317143cd71cc82c2907

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-2nWoBpycBJLrrUXeSbB90w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Mon, 01 Nov 2021 21:07:54 GMT
date: Mon, 01 Nov 2021 21:07:54 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-2nWoBpycBJLrrUXeSbB90w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 511
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 931D 0
20 B 56ms
56ms Image
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021102801&jk=2939022260785579&bg=!FxSlFFDNAAZzbWp4c207ACkAdvg8Wro1E0iNthfTMBrI-ozr6Y2INKkU2zf5OPX6X8lPuNY7m-XWvwIAAABdUgAAAAhoAQcKAKVvzGlmTmdipOI_yMa1827Wb3XrfF1F1ThDy2VjnnlqnyJeoyGIY_MV5TEEfDJsIa_5Izvy5Xb-vCXt2muuet1NXYZ8VFzVQ6IqqXQpooY88cW1H5Sb5933BrKYXDqhGJcp8yHf8q6jDAwGeKaW4Rlgn5N6VpPlJaCA9dsMA99PV5VLcJhMwIEXT8yT2AgONXEfTPrkYAiT8Lk0ye3J8JRV72Eu1I-ZAsu5Q8MkrIPSYrT1QKbsxvhjvcxBMV-c8Kga-9hDvbRf3pCcj8L094ZPqCwI5ffI32cXydeUNMT2uTDDltkZQAETjXIsOiqrGxtzx5iIiWuiVQ1fxS5TBvfEpT1LTeeG8rnJDdl40iDjgWhhPamMUCshIw6tzH4V-vxpIzs_HBOAQH06srXW8_n2aSoW_YTYZEN_PEhCones3cAey6u57Hc6Dp1btU28muJZEAjH2onrVqCz41Rz-bOpE8TWZiy9jd7cU4h51mylpu_JdeVWjrhPFNZSY9MT-b1erv5X3Z-s3LsCG3-aUD0NL3UOeRbtjhrK9JpcL1lqF4um-ffBEQfLrHnWVaRZ1rKrZLdEPeIvSEGKtNZSTmqRp1Hc9Agfh4bGZbRzwpOyB6y3AFJCXDo1GyhkxAdoF5jkzsEw7M9UG07hAtc1-OaYVqtLEkIM4J689DjqAFB4vEPx78dLC4n0yKkZ5ACAC_XqSyjJJP4f3gEJdRS52f3-TxCG_UjIBmDgZPN2GwPJgaPWla0Qd5wIICaKi9a4AWJKJhidxgJDxqMnMkjmdVAE984aiM6Vw_adUI6Nh8HogTF920eZ5Q7mzE4tCeazLxKhUswiXtiTb4YZW8j3sG701QOMHtJWwhVVVZ7SK4KKgv3a6LT7GZeQUSakCZXdcXqzpEDw4laAmuVX1St1sWIOA5ZV0XEgqSbw54yxjiRYyWxITovHkaYwaJK8y5ZULzvR3Zg-gIdVies_Fbzx6YgUbgGZM8pA3Z4qA_qBWchkHLPcCLsTENG0MMq7LdDLNfUjZTyLiNdyzMCkTvouNPEtZqFCSgdvr1_f1ue2UzcMVkeL_19rvp3_HEHMxFi6PxffmT1eitjTFe6Wq5VxjJyPJJTb2IJJHWifIS6cw5ZfFIvVR52EDHV3Rcoe-iNAqzFM1f298zS_gcUiUAJTNUdg5qTB

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sKl_vPiz0OchHmL4Vfbrj3Wozc3CsK_Jq53kDzx3_oA.js Show response
pagead2.googlesyndication.com/bg/ Frame 35FA 35 KB
13 KB 16ms
16ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/sKl_vPiz0OchHmL4Vfbrj3Wozc3CsK_Jq53kDzx3_oA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b0a97fbcf8b3d0e7211e62f855f6eb8f75a8cdcdc2b0afc9ab9de40f3c77fe80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 17:57:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11400
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13525
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 18:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 01 Nov 2022 17:57:54 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 4021 0
0 70ms
64ms Image
text/html 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021102801&jk=1146973367066671&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: mil04s23-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H3 200 container.html Show response
2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame EBAA 6 KB
3 KB 16ms
15ms Document
text/html 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 01 Nov 2021 21:07:53 GMT
expires: Tue, 01 Nov 2022 21:07:53 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 246D 624 B
297 B 18ms
18ms Document
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQ3MDeARj3r-CrATAB&v=APEucNUXknbyIqhy9Fdb4ZbqjqF6AkfrdMlzhRDoRx_H6jNXjn2MpA9LCXhxCAGVmS8Cpx0gTL6WC5Qm9sU_J40IeC-Z7EK7WA

Requested by

Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 01 Nov 2021 21:07:54 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame EBAA 12 KB
9 KB 31ms
31ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DzzqP-mnHN9tNpucl4oI0Cc2uI57mS8sM6BDmJ2pW6bRG2Y0yw_oCKfKmEVeKViGvxUMk2rDtHtzxsAbmRBPDKwUkUU-6DGEAgl4dsn9JPI-UvK0Sbjc2sfQ8S-odV4Fm3Bv3-pURAoq3mGkgIz0lDW2V7Aw&dbm_d=AKAmf-Asga6H_ljODUd517eCAPNxfHuVjiwpCQtuw4c5x3Jrochi6_G7UO3S4pv4wdviXe1q9Y72FPSfxIkhagbzaLoHxKYe_HfEJDArioNQk3VnJ9OzedvVMX_s0REBS9gDUFJ2osFYTz3b9ciL4zNVZ_zS1CD0TzNLx6EGJaq0M43joNcHIpQnYTbNMgjy67fsdGE6hPVbmYsoYKBUXrlDI7I08gf7ypoUrWm2PWs_vphETxbQ_vjCumB9yaABWh85B03jnb4VEkpxoWx1S3-O0wkKosMFoMkmZvvFhWOGT44RXFWewGpYh9Jept8LrJfdLIsIdqLKEfl0NCOGrNdQf7r7sCmHEv02jEEuLS0GM_Fp-FY12BoEvUWKCeCoHl-89dayP9To0sIKKqSTuof-E5dn7NCYBy5-yhUSQr1BFWTFnIONKprfsZN85TcNVkiOeJr-YtogkP4xFygrT_bD5pvo7lbNJGfVSrx1ioNfFJAZ2JVz0mSvm9XoZmp5G1arhUOzec1IFBsJqeWEXwyAHbzSzFKLn_QvgtYoHA2CPTwaN7QtTS0p2G7_5VNX2uSQXUEZi1s8Id1sGKG1jNOmhnSVYhMvqKLzE_bIZ648SBT0erzjQYxOXFFl2_vLaEoYy0jhQN15SHQc1CkCfxNC1o2ff_GfSeh5IHqeEp2e0hVNo4X2In1q3aB6jKwnFEEc4r361ZE14tBxb08a8rKEHoi-cUVZ42Yx0R8Fd2hK6aukz3G_1M78jFXzRHKMwWIkhW-dm2oGq0qXeDkUeAbvsYBaWoEQo6UYZLl7xtZ5z4rdnVBnvLY4Q7_abR3PHGw3KeBgTjJsqUcqVH9Saf9EhFxJat193qvdiAUrkhu-zOwT-izpzOo9UQT-gR00QcfbS3STkaFhxZNQIXMrzk97XDP52QGSVPdF0g-V6UmzGNctwCn-fAMXN94rTBmJL00ARIZHcCd0R2gS-5PgqY9NxfJSJbO02984Ampj3XUGHQ0qCceMs30ItUS7o4tS1xkXRuXsumtsuMFDczYxGEr_uOhknxuYqpxigLekgI_ThQ9ynDQ_D5UgPB8yVPfpl2TZGJMJv5duSQBikjSQoSgLQv_KwglDpHSsQAcYlgAbJ8GJgWa4fh6_MTjqwAMjgSG9owqA9hRS9ql8eSKGIEHeQez6JLeesOc7nfbU5yLUr91PoC6Ce8qA7JfYgjDidb3NCkUFkd4R8AbBlcorJgDpp_yxWh14UOl6y6kbIr_L4KYVy0gx-YwJxuxnywggDf3QYsodwxOFUdRDzF43iVTKc_l1BSXbYyJI7BgLmYHMsVZp-2pZBc7sKdwc-pXmTJP6f51DoOiM0jGFsL_TRLIbvFic0jFPTmkrK1p6IJSzmuBC8OvgPDYKjBe6jm_QiN85rtQ-dRB2wCcTpaSuzIT_e6Jtbmx_wn1ZF_Xfe01NyIMgTqE6C1BMgbmopmpEafWfMDAwn5IywnueKfQzISVPouF5YwMPwzkY88pu-lR-Q0tHOM-6erN-4n6N-gKQvrJLC-eP5hVEwPGVgHww-9_KPGYUoOjYFqsAO5LQeddXgkSObMCL_E1DBo3-Cm58yi4zNXxlVA6139lFaOqRlrLmmmFGpU76a0GxK9OyTYVKUJaFfLetSEkA4Qv8MMToaCElkHJk0agBRfyCWaE4dxZIiHRq97mBRfAZMrWXjUmiNtjX8EbAcjhLP09KJZzSfnVDRd7gtQAw07J6JjD1RIr9BSv6JyThOtT4H2m29oZudhbKW9j_JMJvzLUstyb70f1cyipGn1Ud-amBbzwomBKfzlVcXvnnPY0H1Ka_ECH8WHfXra2-erd6nhcXhKx-PWJC6kRtyYe9zmzOPetbKRfE-PFuMlFuhcpgbcSeIkfEMnMojmTSGwt9wXs31rxUcgOUgzVBxGwIbTXslDJ4OH1PB1xbPxoJEyJFMQcE2s5ovpFzSJ5MsrD7yMV_87ETmDMO7euQp71MHLYGFFL_mbF0DN6NSgIoWInGgBd_TeXmuBpuYjQGepZBzOK8vK27tOaUNY_pWqKc192EnI089IiCYe1rr_fhxlzcFdSlSxhCoxieduG0j_iIHPjSmzsFovGd-iuDy7u97P19kpWcfyxiDVXZT4PByjU3QpHNOkbkwtXivGFOej4IppRnBZL0yPf6X8nC2WTRxs4kJIsFEWzwIghTY141VoRXFOqbHMg3vzRPuQeXO8e3WXRunlpHBfWijUQ4vyWZq-9IGYIub30yLltiB8Ee3eNIGDSbCS1d5UKwh7lBqB4fnie9fbbRotLMKMhYjw72_FmQaVHwWQnk78qifN3UIcogww5WVodhUyLWeOkQ8ef_aSkmnqUMBAxRp3-6GT8H7lf1weU7MHDh-QAE2byTcPldMafq0gZsXxG0pgJdhpeGIZSUmMhOJuK2Xmq_47XFmuP9c1n40ovTTotf_e5paeoanEO7EBmd5tArikP2r4AOYFko2HrzLJGM2PwMLp_pKaql3SByv2afK-ZachGYtDyTkmQz9APknJAJWhrZR0f4dcRTTphZ26N96OMqCb_jelCgX8BGOThFHMrtXL0c6CkruEqlR8-bb7buU06J3s5qHMpzTgil9dbsPfkFKr1Si0OYW-GU3XP8UuNjdjRbKc_DGdq1bdHyn90ydiTfgqEeKLejszcyDH2V6rrowJ7spNZkcJsftUL3cV499YskSiv-b7WKlFNLXy_xVilr0YA&cid=CAASEuRo8mZAfRjSN_2i2LH_aY6v3Q&rfl=2%2Chttps%253A%252F%252Fwww.buholegal.com%242%2Chttps%253A%252F%252Fwww.buholegal.com%252F%240

Requested by

Host: www.buholegal.com
URL: https://www.buholegal.com/9261187/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05992ef06dbd43194b4a2f5b1003c2f986c4052eb03307b7d53c9247fd83df94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9519
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame EBAA 42 B
63 B 49ms
49ms Image
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BvvfImi9zi0qU9_kp0ftBGH0Z2yH1ipo_pIJFxsRD0SLVrx8Nh5MBvQN-UAyX3G8rqpzA1FgFLVHv3u-6MSaJQoBI73XaZ14o6D_96GFA4oN3Qnes

Requested by

Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/314658/55082062/xbbe/creative/ Frame EBAA 236 KB
79 KB 153ms
65ms Script
application/javascript 54.229.132.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/314658/55082062/xbbe/creative/adj?p=APEucNWb9NMxAx_GJzxYYDEYc65tVyFs5utdyetzcR-CEfbgSFHu4ac&d=CnkAoCZ_4EOMJHE5EbcoCEH0E5DuoLs4XeG-8oWt7xzQzIs79S-CDpaqhADjHN-UKNTFtD9x0sOdSwc8ZLe5b7JQ5--hz2iBM8BBi_fJrS5KR9xK_ZtV168GY2dpUstu6i1LswRUOrk8lOtqjtjRgXYCoXcEIQajQZRAErkSAKAmf-CPlC9yO_LPF0T9Hls3yYpBITbJU5H75c28IdubuoC1ydjYEyhrsATPvxKAZZOevfSwStYgc-3ViOCFVnhHkVZS4_-FK2Rha4DsbAfMh1k9lpJ0wJO9WvMazLG1XjaEGCCBshwtIiWbpWhDwsZW-0Mw7prxzpIazeZo8lgY4faJ2uvr61xVvhoOsybSpc5szwr2u2GdB-Wkbw1qHMEhR7X1IvdMPetsZ3rNO5dWhJOvcnHwrCCNqTR6nQZADU5StWowsz2X9qVJl5o603jjF4wncy6r2Jj1McjoiD8EzUNAed9kpFgbyVorgQNDEO7oLDh1BCIjnII0C9x0_N-epeysPCzSQD2GMk1q-tZ-SmcB9E5HqYZTZXFnXr4hwl2IIyOMUmlFIzQopSfet68jgjjM1Wn90MrZEh-QqoJAdzUh_LeK0VPATeNJbHUaq8JmWQTjoWTyOSqZtg045dbNH-G5Ubypn9fxV4d3PBwRSQY_pNgJ7wIzzsnyTQ4z62uNp1M-fKX3kkBQd3AY-EthMFInijXkdQPwNzTuwrOCSCoQOdyHGhKbSAMqyyiDnJYu03VIxfGRBx3rRE7iXNrOLwpAGX7Y3vTF8sPwZiSl3vml2bQcXQdt-Zb-xI2SClkEION_l5W92UKXFnn_qeMorvEj32INpKGWgmJbmZ2bbczSb5zwy6RhqWABjmqXozXVHNcD5kVBcSEv8QkOToQK4q5DdIuSsQlyacUG7Mvsl8BUcNB_XJ1_2f1gHuxFjKd_1CGLSKRcz_7DfeVmXjFFSwFLZTahZrKyYcK1TL-iF6xU6LTajlScGvOEqHgOi4Ns3neW9rRTKAvXwIbCJayADQzaiPVsI0u5ZUIbJPqdUs6ivUjFx-ZWqkrt9twPnPCiDgwb6CkLOw2FqYNErhOpUaCJm0Ez-XIu91pkEpbKDB3DQM5X-SWR_s8YbQo-XgZJLzPxOraCfTOKM2cPa2rDfENRa9uVwxPVRSU24qdarQpJxAtm6NtMDQhnDLQPBz0MSdNyby3XUZAeg_2-j6onx1MtVOw1tp1UvR-Fe0AKVpZxNtkdyHQ1LHob7OlosTsveBGf2SFTcqtfx97PEqJ9X4vxGN2lRjIPFNsM9nWY5EFw8k-VXB6e66s9px9Ad_Byqf5yiLF07k3VNaxqB-4GNfrR615FxXpuo12DbABLoBCbXQ6T9s8aWbG4y3JTXk6Px39OGZm6_YCnXfvU2eJSQKmLFUeCkiH0SZShuhTTvfbEa5-EBBg1DhkY4uto976M8vo7GKYfcz_Tx7d-5rtBLKOfJPT9VcaR7IwhH-On4IYdFUwcNft5uYpm8KbQlxddkj5-fLDMZzYWSkgdbZrggcHEACPCm1KXLiv7lX3VxwuHeOeM06Lg9uBvokFCB1RR_dW0J0hR1LP2Xk6iKH5Ois2jIXJghdy_hP1zNEnrE_U9sL4IAJf-ddBRYGQIz2kUIxyKs5WTXjSbNBWaSlNvxbrLeAdiTJBmerZwnZIz2qTrl0ckf7PZ5Mu1DyDwyBzPwCr_dyLXzSp4aPn6mMbgCyfePdGQA5_kANIzt2YO9uKUrK1sdM6FKuBZkI9XNaTzz5Cu1q3cG78yhmTvrPHWLwRF_jp7MSR4Mwgq_cncinFbxqpxKwjK3bXitmuKQlkP1cVfwxc2GbVIk4Awwqh2HS-jrVUtEee59j-ArXKtntFParkIqsdw3QWljRYU2eL-gKHs5PMUUGJXYMeNpT47G0sslmm_iy1oZc3U7f69pg3f1TlkXEKuGXhawR5jVPRZCZeFwjzKLk7DNotc-WiLMf-6gA46elEMolcUImrJ_Mv3MVpak4TwH6A0Aka8XhL97jCuo5Nk0g_oDaab6oEZmRn06RR1HW3T9OwFwysJQG3eIpy_jlheAbwK4NTy40jiNYmJHfIpY4A3kBtC9ksL-mnPVlnJnvtWa_ccKYvJwQ9OezSCtrfeOYENwEAgF_HtAIyeMKQQ6Ja58btAuevW5HPADpW_4d-agMDHIsFfqJluREbKvXSuzv70qy2D8t4TgaJflv7kRccPyjLQCBXvX8iyijls7O5CtsQ2aln34Nmvp4sb1jUoL65vvkwkDJ1rv8z_3ay_wNVdFwuMswAszIxoKF7GTJsTJJzz8cniRvq2w6TLgHi-lH1O2BeiwktHrJ7ZqrzMFyl4QGqVPnZUR9zqFpyA_a8UWKAOeelnGbClFm__HD4jQpL9BCoZL8HeNZMv9tRLpee4y4Bbym68SOlVJmCQblaLjgi7rQ7oiKYRjtjS8mTdEuj-n7hGxRRf0_q_obENn6mK1UynxyXpL9I7UQVbsPfL2YzIpMXNX0Ikz539AGhUafTBrivs7VD9UlC0SJYRuZAEPISuVItdTYqnRzHcWyIHXMRFbbqPRdMtJi9DiyQ3ehrY1PvomZIVY9eIvJnXt1oRm36aaKRbYYdBVrwCZJ4GOgeywH3ZiHNPsU2-w3QhfqKZEpmLir2o81rZCQlB1X0tvoGsRGCOaD4bqO5IwrIamx_0s0Nx18VnoC2nnEbvbdYHuQfQT3Pzm-19XixKmE6rTHDxBMFVChKQAf041jEcrLX3GSgNa5uN8oambjTAxMvUKyrw5gLSmXHbr92A-E8xH46RT17UkMKuqAjFvZCxYenHf8sm9Fr0ReSGH7ScsjoQaCQ64zNRXvwZ13NyJ95SBiKFn7b8nIrfJ-ZgWqzuLHbYeav2cBMfQwGJJgGK9vlxrRz1R9_uFJUEi5ei_pw4iTDzQgt0FGbpmyufS74XVrpu5QY_TxOLVZHOPnFtiWp3D0bL96PRmtzzG1nzQ-4AZRcJEKkF3rIv83AyaYGPrqH69qvpnRhzF0v7dWkCUzkXndWrbEjy5lvlIuDktzEmhCZdaWJ9ilCxGDYdm5rK57HFVlc75AK1cJBL5T5h3cMevduaF4rpKtHpOInMOUXlsDbTwaaaf_54fDjNif8-hW2gUi9lbv1_mOekL-FvRbK8kNWp761CPGOsdZi6MKknkfcEKBfJSbbqIxJw353YcST3V6OuYNp0tgcI3EbYHH0a3fvN46ZK78o77bp15QIpXxciBl4TsMsoDBTK2E0ubhD8baotYy9S8aAiFj1bZJ1hJN2dmy1KXMwPI_JgGhYIABIS5GjyZkB9GNI3_aLYsf9pjq_dYAE&ias_dspID=64&ias_campId=&ias_pubId=&ias_chanId=&ias_placementId=&bidurl=&ias_dealId=
Requested by: Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.132.88 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-132-88.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: fa0775f3ac3180a2a6c2c68eaa363e6dc58f6be890377b9873ef5a986039ba57

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
content-encoding: gzip
x-server-name: app20.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/ Frame EBAA 3 KB
1 KB 18ms
17ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/window_focus_fy2019.js

Requested by

Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4af635698cb6488a8df86b99febedbc979c76e04f675f3a9cdc66f7b4d86aff6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1470
x-xss-protection: 0
server: cafe
etag: 9165589572046851897
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 Nov 2021 21:04:32 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EBAA 119 KB
36 KB 27ms
27ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

sffe /

Resource Hash

d16d61e50a6c8f915deadde160aff9a3ba942fa1eb64c058eb74a646c114e749

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37252
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1635368421117528"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 01 Nov 2021 21:07:54 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/ Frame EBAA 14 KB
6 KB 17ms
17ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211027/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

cafe /

Resource Hash

7155d8dd40ece849d72213770b3a5b84467de8c6cab5c3bda3266808502cb69b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:06:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6337
x-xss-protection: 0
server: cafe
etag: 7721474052657771746
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 Nov 2021 21:06:48 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame EBAA 0
0 15ms
15ms Image
text/html 142.250.184.228
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTO8eMmyi1F6xWr9JyRg7c9c-8-a44lf4fBwBJuSqTYuMEMxFM42u8QJ-tykh4YdDdohpcgKMtWamWSbSVG6YPg6ld4EA
Requested by: Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.228 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 246D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPECvmKFLQ7z8CPusp8LYd8&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPECvmKFLQ7z8CPusp8LYd8&google_cver=1&C=1

43 B
1014 B

15ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPECvmKFLQ7z8CPusp8LYd8&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQ3MDeARj3r-CrATAB&v=APEucNUXknbyIqhy9Fdb4ZbqjqF6AkfrdMlzhRDoRx_H6jNXjn2MpA9LCXhxCAGVmS8Cpx0gTL6WC5Qm9sU_J40IeC-Z7EK7WA
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 01 Nov 2021 21:07:54 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 01 Nov 2021 21:07:54 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 01 Nov 2021 21:07:54 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPECvmKFLQ7z8CPusp8LYd8&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Mon, 01 Nov 2021 21:07:54 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 246D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YYBXKgja9phhkcmcY-tFrAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPECvmKFLQ7z8CPusp8LYd8&google_cver=1

43 B
894 B

18ms
18ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPECvmKFLQ7z8CPusp8LYd8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQ3MDeARj3r-CrATAB&v=APEucNUXknbyIqhy9Fdb4ZbqjqF6AkfrdMlzhRDoRx_H6jNXjn2MpA9LCXhxCAGVmS8Cpx0gTL6WC5Qm9sU_J40IeC-Z7EK7WA
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 01 Nov 2021 21:07:54 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 01 Nov 2021 21:07:54 GMT

Redirect headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPECvmKFLQ7z8CPusp8LYd8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 246D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGM0dE7XKV7C5iSGMpmwf-8&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEGM0dE7XKV7C5iSGMpmwf-8%26google_cver%3D1

43 B
1 KB

12ms
12ms

Image
image/gif

185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEGM0dE7XKV7C5iSGMpmwf-8%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQ3MDeARj3r-CrATAB&v=APEucNUXknbyIqhy9Fdb4ZbqjqF6AkfrdMlzhRDoRx_H6jNXjn2MpA9LCXhxCAGVmS8Cpx0gTL6WC5Qm9sU_J40IeC-Z7EK7WA

Protocol

HTTP/1.1

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 01 Nov 2021 21:07:54 GMT
X-Proxy-Origin: 216.131.114.120; 216.131.114.120; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f5c81cea-101b-4157-87ea-5d0d47561704
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 01 Nov 2021 21:07:54 GMT
X-Proxy-Origin: 216.131.114.120; 216.131.114.120; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 33bdb57a-8320-485d-a757-664f9f389415
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEGM0dE7XKV7C5iSGMpmwf-8%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 246D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDAyMjc1MzE4Mjg3OTc2MzE0NQ%3D%3D

170 B
188 B

16ms
16ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDAyMjc1MzE4Mjg3OTc2MzE0NQ%3D%3D

Requested by

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 01 Nov 2021 21:07:54 GMT
X-Proxy-Origin: 216.131.114.120; 216.131.114.120; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f7f8873f-50da-49ae-a851-5b5f95f6fa15
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDAyMjc1MzE4Mjg3OTc2MzE0NQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame EBAA 41 KB
15 KB 17ms
17ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DzzqP-mnHN9tNpucl4oI0Cc2uI57mS8sM6BDmJ2pW6bRG2Y0yw_oCKfKmEVeKViGvxUMk2rDtHtzxsAbmRBPDKwUkUU-6DGEAgl4dsn9JPI-UvK0Sbjc2sfQ8S-odV4Fm3Bv3-pURAoq3mGkgIz0lDW2V7Aw&dbm_d=AKAmf-Asga6H_ljODUd517eCAPNxfHuVjiwpCQtuw4c5x3Jrochi6_G7UO3S4pv4wdviXe1q9Y72FPSfxIkhagbzaLoHxKYe_HfEJDArioNQk3VnJ9OzedvVMX_s0REBS9gDUFJ2osFYTz3b9ciL4zNVZ_zS1CD0TzNLx6EGJaq0M43joNcHIpQnYTbNMgjy67fsdGE6hPVbmYsoYKBUXrlDI7I08gf7ypoUrWm2PWs_vphETxbQ_vjCumB9yaABWh85B03jnb4VEkpxoWx1S3-O0wkKosMFoMkmZvvFhWOGT44RXFWewGpYh9Jept8LrJfdLIsIdqLKEfl0NCOGrNdQf7r7sCmHEv02jEEuLS0GM_Fp-FY12BoEvUWKCeCoHl-89dayP9To0sIKKqSTuof-E5dn7NCYBy5-yhUSQr1BFWTFnIONKprfsZN85TcNVkiOeJr-YtogkP4xFygrT_bD5pvo7lbNJGfVSrx1ioNfFJAZ2JVz0mSvm9XoZmp5G1arhUOzec1IFBsJqeWEXwyAHbzSzFKLn_QvgtYoHA2CPTwaN7QtTS0p2G7_5VNX2uSQXUEZi1s8Id1sGKG1jNOmhnSVYhMvqKLzE_bIZ648SBT0erzjQYxOXFFl2_vLaEoYy0jhQN15SHQc1CkCfxNC1o2ff_GfSeh5IHqeEp2e0hVNo4X2In1q3aB6jKwnFEEc4r361ZE14tBxb08a8rKEHoi-cUVZ42Yx0R8Fd2hK6aukz3G_1M78jFXzRHKMwWIkhW-dm2oGq0qXeDkUeAbvsYBaWoEQo6UYZLl7xtZ5z4rdnVBnvLY4Q7_abR3PHGw3KeBgTjJsqUcqVH9Saf9EhFxJat193qvdiAUrkhu-zOwT-izpzOo9UQT-gR00QcfbS3STkaFhxZNQIXMrzk97XDP52QGSVPdF0g-V6UmzGNctwCn-fAMXN94rTBmJL00ARIZHcCd0R2gS-5PgqY9NxfJSJbO02984Ampj3XUGHQ0qCceMs30ItUS7o4tS1xkXRuXsumtsuMFDczYxGEr_uOhknxuYqpxigLekgI_ThQ9ynDQ_D5UgPB8yVPfpl2TZGJMJv5duSQBikjSQoSgLQv_KwglDpHSsQAcYlgAbJ8GJgWa4fh6_MTjqwAMjgSG9owqA9hRS9ql8eSKGIEHeQez6JLeesOc7nfbU5yLUr91PoC6Ce8qA7JfYgjDidb3NCkUFkd4R8AbBlcorJgDpp_yxWh14UOl6y6kbIr_L4KYVy0gx-YwJxuxnywggDf3QYsodwxOFUdRDzF43iVTKc_l1BSXbYyJI7BgLmYHMsVZp-2pZBc7sKdwc-pXmTJP6f51DoOiM0jGFsL_TRLIbvFic0jFPTmkrK1p6IJSzmuBC8OvgPDYKjBe6jm_QiN85rtQ-dRB2wCcTpaSuzIT_e6Jtbmx_wn1ZF_Xfe01NyIMgTqE6C1BMgbmopmpEafWfMDAwn5IywnueKfQzISVPouF5YwMPwzkY88pu-lR-Q0tHOM-6erN-4n6N-gKQvrJLC-eP5hVEwPGVgHww-9_KPGYUoOjYFqsAO5LQeddXgkSObMCL_E1DBo3-Cm58yi4zNXxlVA6139lFaOqRlrLmmmFGpU76a0GxK9OyTYVKUJaFfLetSEkA4Qv8MMToaCElkHJk0agBRfyCWaE4dxZIiHRq97mBRfAZMrWXjUmiNtjX8EbAcjhLP09KJZzSfnVDRd7gtQAw07J6JjD1RIr9BSv6JyThOtT4H2m29oZudhbKW9j_JMJvzLUstyb70f1cyipGn1Ud-amBbzwomBKfzlVcXvnnPY0H1Ka_ECH8WHfXra2-erd6nhcXhKx-PWJC6kRtyYe9zmzOPetbKRfE-PFuMlFuhcpgbcSeIkfEMnMojmTSGwt9wXs31rxUcgOUgzVBxGwIbTXslDJ4OH1PB1xbPxoJEyJFMQcE2s5ovpFzSJ5MsrD7yMV_87ETmDMO7euQp71MHLYGFFL_mbF0DN6NSgIoWInGgBd_TeXmuBpuYjQGepZBzOK8vK27tOaUNY_pWqKc192EnI089IiCYe1rr_fhxlzcFdSlSxhCoxieduG0j_iIHPjSmzsFovGd-iuDy7u97P19kpWcfyxiDVXZT4PByjU3QpHNOkbkwtXivGFOej4IppRnBZL0yPf6X8nC2WTRxs4kJIsFEWzwIghTY141VoRXFOqbHMg3vzRPuQeXO8e3WXRunlpHBfWijUQ4vyWZq-9IGYIub30yLltiB8Ee3eNIGDSbCS1d5UKwh7lBqB4fnie9fbbRotLMKMhYjw72_FmQaVHwWQnk78qifN3UIcogww5WVodhUyLWeOkQ8ef_aSkmnqUMBAxRp3-6GT8H7lf1weU7MHDh-QAE2byTcPldMafq0gZsXxG0pgJdhpeGIZSUmMhOJuK2Xmq_47XFmuP9c1n40ovTTotf_e5paeoanEO7EBmd5tArikP2r4AOYFko2HrzLJGM2PwMLp_pKaql3SByv2afK-ZachGYtDyTkmQz9APknJAJWhrZR0f4dcRTTphZ26N96OMqCb_jelCgX8BGOThFHMrtXL0c6CkruEqlR8-bb7buU06J3s5qHMpzTgil9dbsPfkFKr1Si0OYW-GU3XP8UuNjdjRbKc_DGdq1bdHyn90ydiTfgqEeKLejszcyDH2V6rrowJ7spNZkcJsftUL3cV499YskSiv-b7WKlFNLXy_xVilr0YA&cid=CAASEuRo8mZAfRjSN_2i2LH_aY6v3Q&rfl=2%2Chttps%253A%252F%252Fwww.buholegal.com%242%2Chttps%253A%252F%252Fwww.buholegal.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 11:10:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35833
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 01 Nov 2022 11:10:41 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame D83F 22 KB
8 KB 16ms
16ms Document
text/html 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Mon, 01 Nov 2021 11:10:41 GMT
expires: Tue, 01 Nov 2022 11:10:41 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 35833
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 sKl_vPiz0OchHmL4Vfbrj3Wozc3CsK_Jq53kDzx3_oA.js Show response
pagead2.googlesyndication.com/bg/ Frame D83F 35 KB
13 KB 16ms
16ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/sKl_vPiz0OchHmL4Vfbrj3Wozc3CsK_Jq53kDzx3_oA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b0a97fbcf8b3d0e7211e62f855f6eb8f75a8cdcdc2b0afc9ab9de40f3c77fe80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 17:57:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11400
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13525
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 18:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 01 Nov 2022 17:57:54 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 52ms
51ms Image
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021102801&jk=1146973367066671&bg=!tLelt_PNAAZzbWp4c207ACkAdvg8WpKXqPwCmCTq5Vr3kwd679cMmhprXJJoehprcY33AR0vy70P7QIAAABiUgAAABBoAQeZArku7zRrRjvXx-_ItW9FpVF3QwHKY_Ni_g3LszmGYOkOvL0NQivu9sDv9yxW3_y9ujHX804TyC6Otv3GQDZK2O8LTOK_j1AKMxraKqPwgOZJMZ6eBZhAJIAyEQc9vMaLny7ghaxigS8FuDU6fUaLiy0T6WqMLVpvXbuRTh7-2NPPhlObuMxQjspQNpGm-4zyxDA_ZgV--8BE4_CTVbLYR3h8FrzKOhlD32caT1-pbR-xhN3zGykZeNo5llYDcLyFf8xO4ZNtW0M3D3aWfIVxZXvuQEp8FNvsWwqupeYXf_N7wK9nQVG_aIC4ELTUlDFByl9bF1-kX8_N7zPc6SzKz6fey94IGAYrueg9WBYfC6YIKGA-4U9FIw9_jLM_AADk7riY5wfPun7FFgruwoiDEJlX8XJlUQyZd5zUkoftVLKu0tjmYXCv2q4ycmIGYW5KTQgJQiisIc_1Puh4976YPygI-rckMbmUBwDfduwvq6Aukf7SUZWHJ9M5_3TWsnct8CFlsGNXyjL2Fxfy6P9jgl5Kg8xejxyVRJUinIIEp9AV8Rp_sCJ5heDZHBfXNLpkUl4cMGCcYpLIytjlJcaQmMsq-zcFJqxrm0avRBX5E6hbjiEumNZg_O-zCBwWdIMZX0_q_0Ser8V2uB9NdrDmGs2nYOqbD4qu-ruDpt-UDX9xLMXHyIZeXliGi8r1Fc1wvlG2G0atZG6Qddklbh88nFvCsQ6opd6ul-RwdkQW5UYdxeiEKxIAGOnKeQhdS3naBvcP0rgSV0p1x9J_lbpqCRokpvWfrZ3zVyxdXzQTRiJFNR94TFsSjyYOcC0RUQ3Lu0YDSuJvvYa4kt0YwMCrfl0cUzTk6gBWGFvpfs1giSFFbQLNTuYEZdMER8BSRaA_IBDcKZpuFwyhZXiy7e9jC0lcCQvoEWx1wlcD

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.buholegal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D83F 0
20 B 52ms
52ms Image
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BPLOyKleAYYvYDcXz3wOHvqyYAQAAAAA4AeAEAg&bg=!lZalltLNAAZzbWp4c207ACkAdvg8WigQdYcQ4S1kXtYj-TysbOwdJ_vQQCmOLxd9I5H_GzJMRp3OkgIAAABUUgAAAAtoAQcKAD0CUWPFjQkiAgYojJ0iIy7FGPcQ-gVs1QnZ4POBb3Fs7RMiHgjYMQ2rJV00xQ9MovzNR3Ex2hDaq_yvKtbmmQMqQt_T88NljxBz0ZS70-a1pjSmF9SzMec-wt0shh7yKp9_bEO8ni_dccd1VMH-POP6AJeV_YukMtAOmxeHCFOUxnBcRosIFuibz0lHUiXJS3MYn5cGPT0r8Kg6rO3bLKyAf06LM9zM3jTouVlzMlOLAAG1Kobprlosq6CLchZwwrpoEYiuaIgnDkUhjVWD5Jj7e57F-E4AGVArCJy2vTAxN494ldQKlwWrKrREG4bNL7slaZXEsEr3xyPGv-ccgvXe2ZjEtmIZIWMJ1O7nlQQK3n9W_ro2gbmq02NO2D7aMGoFEbz5xs2p34Rbxm7yIFvOVg963_crTNF8k4wWNmNcVTNk7XSHO1vqz7Mli-KaE3TmvNvRFt80Oy4-KJ6R5nBH2uP9nWhOEMEewQGxib38NxKlQojxNCbeT7mZK_Lz8orSX91iUZgEkRU45k0mIOz1xMdu87tOPb5Ns8D8Hywlh-q4r9fIL0JhINgkSlSEfXJN_PPCvfF1Pzx3WsLaMFrrpJlH3smOjVlfA7RwdZwoogjJ-3N9xrCkYouZAViaphOjD3r4mj5faM2DlhoRZxiHy6Wps0-dJ6AUDplU8YCAx_EeHX9GxYuaB-6Tq5kkGuzTc-x7SPUb8y4O69X5bTEI5Apo_Diy2MtDDcBB-XNiBMPHJzVKpDeexxtrbaJh3nTUOA0unfvNJPHkxoDywrzwBBQLLDzmkLa1andmGk8_WKXUKopvFSfUaIG16-1hInEcOlcSCN8dLwHp4JY5WZC-iFGdgMdXdKkrQxU5r00UVXzwIbPLJksGS8k6IGE9pwwoDrlpO_-WOOobCBQrLWQkZLguu4asBGkbrZ21mEiwAhbKXd0OwqAlHSFoBu1zMDh4I-nT8OVO5WqIHiLJTKuddgoVGAcR8V3BfFoSklZ_c7j_OWt5eVcqT7LU_4hhpptbxF3PsWVtBdK9mD0Axa3s8HxwCIcpo1DdJ2EkKkEpAUCvyJVtkBK8G8Ay-GeHSWt_DHGTwFSDdJfJPUkVqwQkJiHFzKGpSflE50Vp1hpX3EPjbmLYl4rZoVcrVG18Ixb9wSEUAZN0AePK

Requested by

Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame EBAA
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/314658/55082062/xbbe/creative/adj?p=APEucNWb9NMxAx_GJzxYYDEYc65tVyFs5utdyetzcR-CEfbgSFHu4ac&d=CnkAoCZ_4EOMJHE5EbcoCEH0E5DuoLs4XeG-8oWt7xzQzIs79S-CDpaqhADjHN-U...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWb9NMxAx_GJzxYYDEYc65tVyFs5utdyetzcR-CEfbgSFHu4ac&d=CnkAoCZ_4EOMJHE5EbcoCEH0E5DuoLs4XeG-8oWt7xzQzIs79S-CDpaqhADjHN-UKNTFtD9x0sOdSwc8ZLe5b7JQ5...

58 KB
19 KB

65ms
50ms

Script
text/javascript

142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWb9NMxAx_GJzxYYDEYc65tVyFs5utdyetzcR-CEfbgSFHu4ac&d=CnkAoCZ_4EOMJHE5EbcoCEH0E5DuoLs4XeG-8oWt7xzQzIs79S-CDpaqhADjHN-UKNTFtD9x0sOdSwc8ZLe5b7JQ5--hz2iBM8BBi_fJrS5KR9xK_ZtV168GY2dpUstu6i1LswRUOrk8lOtqjtjRgXYCoXcEIQajQZRAErkSAKAmf-CPlC9yO_LPF0T9Hls3yYpBITbJU5H75c28IdubuoC1ydjYEyhrsATPvxKAZZOevfSwStYgc-3ViOCFVnhHkVZS4_-FK2Rha4DsbAfMh1k9lpJ0wJO9WvMazLG1XjaEGCCBshwtIiWbpWhDwsZW-0Mw7prxzpIazeZo8lgY4faJ2uvr61xVvhoOsybSpc5szwr2u2GdB-Wkbw1qHMEhR7X1IvdMPetsZ3rNO5dWhJOvcnHwrCCNqTR6nQZADU5StWowsz2X9qVJl5o603jjF4wncy6r2Jj1McjoiD8EzUNAed9kpFgbyVorgQNDEO7oLDh1BCIjnII0C9x0_N-epeysPCzSQD2GMk1q-tZ-SmcB9E5HqYZTZXFnXr4hwl2IIyOMUmlFIzQopSfet68jgjjM1Wn90MrZEh-QqoJAdzUh_LeK0VPATeNJbHUaq8JmWQTjoWTyOSqZtg045dbNH-G5Ubypn9fxV4d3PBwRSQY_pNgJ7wIzzsnyTQ4z62uNp1M-fKX3kkBQd3AY-EthMFInijXkdQPwNzTuwrOCSCoQOdyHGhKbSAMqyyiDnJYu03VIxfGRBx3rRE7iXNrOLwpAGX7Y3vTF8sPwZiSl3vml2bQcXQdt-Zb-xI2SClkEION_l5W92UKXFnn_qeMorvEj32INpKGWgmJbmZ2bbczSb5zwy6RhqWABjmqXozXVHNcD5kVBcSEv8QkOToQK4q5DdIuSsQlyacUG7Mvsl8BUcNB_XJ1_2f1gHuxFjKd_1CGLSKRcz_7DfeVmXjFFSwFLZTahZrKyYcK1TL-iF6xU6LTajlScGvOEqHgOi4Ns3neW9rRTKAvXwIbCJayADQzaiPVsI0u5ZUIbJPqdUs6ivUjFx-ZWqkrt9twPnPCiDgwb6CkLOw2FqYNErhOpUaCJm0Ez-XIu91pkEpbKDB3DQM5X-SWR_s8YbQo-XgZJLzPxOraCfTOKM2cPa2rDfENRa9uVwxPVRSU24qdarQpJxAtm6NtMDQhnDLQPBz0MSdNyby3XUZAeg_2-j6onx1MtVOw1tp1UvR-Fe0AKVpZxNtkdyHQ1LHob7OlosTsveBGf2SFTcqtfx97PEqJ9X4vxGN2lRjIPFNsM9nWY5EFw8k-VXB6e66s9px9Ad_Byqf5yiLF07k3VNaxqB-4GNfrR615FxXpuo12DbABLoBCbXQ6T9s8aWbG4y3JTXk6Px39OGZm6_YCnXfvU2eJSQKmLFUeCkiH0SZShuhTTvfbEa5-EBBg1DhkY4uto976M8vo7GKYfcz_Tx7d-5rtBLKOfJPT9VcaR7IwhH-On4IYdFUwcNft5uYpm8KbQlxddkj5-fLDMZzYWSkgdbZrggcHEACPCm1KXLiv7lX3VxwuHeOeM06Lg9uBvokFCB1RR_dW0J0hR1LP2Xk6iKH5Ois2jIXJghdy_hP1zNEnrE_U9sL4IAJf-ddBRYGQIz2kUIxyKs5WTXjSbNBWaSlNvxbrLeAdiTJBmerZwnZIz2qTrl0ckf7PZ5Mu1DyDwyBzPwCr_dyLXzSp4aPn6mMbgCyfePdGQA5_kANIzt2YO9uKUrK1sdM6FKuBZkI9XNaTzz5Cu1q3cG78yhmTvrPHWLwRF_jp7MSR4Mwgq_cncinFbxqpxKwjK3bXitmuKQlkP1cVfwxc2GbVIk4Awwqh2HS-jrVUtEee59j-ArXKtntFParkIqsdw3QWljRYU2eL-gKHs5PMUUGJXYMeNpT47G0sslmm_iy1oZc3U7f69pg3f1TlkXEKuGXhawR5jVPRZCZeFwjzKLk7DNotc-WiLMf-6gA46elEMolcUImrJ_Mv3MVpak4TwH6A0Aka8XhL97jCuo5Nk0g_oDaab6oEZmRn06RR1HW3T9OwFwysJQG3eIpy_jlheAbwK4NTy40jiNYmJHfIpY4A3kBtC9ksL-mnPVlnJnvtWa_ccKYvJwQ9OezSCtrfeOYENwEAgF_HtAIyeMKQQ6Ja58btAuevW5HPADpW_4d-agMDHIsFfqJluREbKvXSuzv70qy2D8t4TgaJflv7kRccPyjLQCBXvX8iyijls7O5CtsQ2aln34Nmvp4sb1jUoL65vvkwkDJ1rv8z_3ay_wNVdFwuMswAszIxoKF7GTJsTJJzz8cniRvq2w6TLgHi-lH1O2BeiwktHrJ7ZqrzMFyl4QGqVPnZUR9zqFpyA_a8UWKAOeelnGbClFm__HD4jQpL9BCoZL8HeNZMv9tRLpee4y4Bbym68SOlVJmCQblaLjgi7rQ7oiKYRjtjS8mTdEuj-n7hGxRRf0_q_obENn6mK1UynxyXpL9I7UQVbsPfL2YzIpMXNX0Ikz539AGhUafTBrivs7VD9UlC0SJYRuZAEPISuVItdTYqnRzHcWyIHXMRFbbqPRdMtJi9DiyQ3ehrY1PvomZIVY9eIvJnXt1oRm36aaKRbYYdBVrwCZJ4GOgeywH3ZiHNPsU2-w3QhfqKZEpmLir2o81rZCQlB1X0tvoGsRGCOaD4bqO5IwrIamx_0s0Nx18VnoC2nnEbvbdYHuQfQT3Pzm-19XixKmE6rTHDxBMFVChKQAf041jEcrLX3GSgNa5uN8oambjTAxMvUKyrw5gLSmXHbr92A-E8xH46RT17UkMKuqAjFvZCxYenHf8sm9Fr0ReSGH7ScsjoQaCQ64zNRXvwZ13NyJ95SBiKFn7b8nIrfJ-ZgWqzuLHbYeav2cBMfQwGJJgGK9vlxrRz1R9_uFJUEi5ei_pw4iTDzQgt0FGbpmyufS74XVrpu5QY_TxOLVZHOPnFtiWp3D0bL96PRmtzzG1nzQ-4AZRcJEKkF3rIv83AyaYGPrqH69qvpnRhzF0v7dWkCUzkXndWrbEjy5lvlIuDktzEmhCZdaWJ9ilCxGDYdm5rK57HFVlc75AK1cJBL5T5h3cMevduaF4rpKtHpOInMOUXlsDbTwaaaf_54fDjNif8-hW2gUi9lbv1_mOekL-FvRbK8kNWp761CPGOsdZi6MKknkfcEKBfJSbbqIxJw353YcST3V6OuYNp0tgcI3EbYHH0a3fvN46ZK78o77bp15QIpXxciBl4TsMsoDBTK2E0ubhD8baotYy9S8aAiFj1bZJ1hJN2dmy1KXMwPI_JgGhYIABIS5GjyZkB9GNI3_aLYsf9pjq_dYAE

Requested by

Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wg-in-f154.1e100.net

Software

cafe /

Resource Hash

4cb563fcf0edb348cf88ab2aeb477e1b18946811828ad696548dab747cf64fb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19475
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
x-server-name: app16.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWb9NMxAx_GJzxYYDEYc65tVyFs5utdyetzcR-CEfbgSFHu4ac&d=CnkAoCZ_4EOMJHE5EbcoCEH0E5DuoLs4XeG-8oWt7xzQzIs79S-CDpaqhADjHN-UKNTFtD9x0sOdSwc8ZLe5b7JQ5--hz2iBM8BBi_fJrS5KR9xK_ZtV168GY2dpUstu6i1LswRUOrk8lOtqjtjRgXYCoXcEIQajQZRAErkSAKAmf-CPlC9yO_LPF0T9Hls3yYpBITbJU5H75c28IdubuoC1ydjYEyhrsATPvxKAZZOevfSwStYgc-3ViOCFVnhHkVZS4_-FK2Rha4DsbAfMh1k9lpJ0wJO9WvMazLG1XjaEGCCBshwtIiWbpWhDwsZW-0Mw7prxzpIazeZo8lgY4faJ2uvr61xVvhoOsybSpc5szwr2u2GdB-Wkbw1qHMEhR7X1IvdMPetsZ3rNO5dWhJOvcnHwrCCNqTR6nQZADU5StWowsz2X9qVJl5o603jjF4wncy6r2Jj1McjoiD8EzUNAed9kpFgbyVorgQNDEO7oLDh1BCIjnII0C9x0_N-epeysPCzSQD2GMk1q-tZ-SmcB9E5HqYZTZXFnXr4hwl2IIyOMUmlFIzQopSfet68jgjjM1Wn90MrZEh-QqoJAdzUh_LeK0VPATeNJbHUaq8JmWQTjoWTyOSqZtg045dbNH-G5Ubypn9fxV4d3PBwRSQY_pNgJ7wIzzsnyTQ4z62uNp1M-fKX3kkBQd3AY-EthMFInijXkdQPwNzTuwrOCSCoQOdyHGhKbSAMqyyiDnJYu03VIxfGRBx3rRE7iXNrOLwpAGX7Y3vTF8sPwZiSl3vml2bQcXQdt-Zb-xI2SClkEION_l5W92UKXFnn_qeMorvEj32INpKGWgmJbmZ2bbczSb5zwy6RhqWABjmqXozXVHNcD5kVBcSEv8QkOToQK4q5DdIuSsQlyacUG7Mvsl8BUcNB_XJ1_2f1gHuxFjKd_1CGLSKRcz_7DfeVmXjFFSwFLZTahZrKyYcK1TL-iF6xU6LTajlScGvOEqHgOi4Ns3neW9rRTKAvXwIbCJayADQzaiPVsI0u5ZUIbJPqdUs6ivUjFx-ZWqkrt9twPnPCiDgwb6CkLOw2FqYNErhOpUaCJm0Ez-XIu91pkEpbKDB3DQM5X-SWR_s8YbQo-XgZJLzPxOraCfTOKM2cPa2rDfENRa9uVwxPVRSU24qdarQpJxAtm6NtMDQhnDLQPBz0MSdNyby3XUZAeg_2-j6onx1MtVOw1tp1UvR-Fe0AKVpZxNtkdyHQ1LHob7OlosTsveBGf2SFTcqtfx97PEqJ9X4vxGN2lRjIPFNsM9nWY5EFw8k-VXB6e66s9px9Ad_Byqf5yiLF07k3VNaxqB-4GNfrR615FxXpuo12DbABLoBCbXQ6T9s8aWbG4y3JTXk6Px39OGZm6_YCnXfvU2eJSQKmLFUeCkiH0SZShuhTTvfbEa5-EBBg1DhkY4uto976M8vo7GKYfcz_Tx7d-5rtBLKOfJPT9VcaR7IwhH-On4IYdFUwcNft5uYpm8KbQlxddkj5-fLDMZzYWSkgdbZrggcHEACPCm1KXLiv7lX3VxwuHeOeM06Lg9uBvokFCB1RR_dW0J0hR1LP2Xk6iKH5Ois2jIXJghdy_hP1zNEnrE_U9sL4IAJf-ddBRYGQIz2kUIxyKs5WTXjSbNBWaSlNvxbrLeAdiTJBmerZwnZIz2qTrl0ckf7PZ5Mu1DyDwyBzPwCr_dyLXzSp4aPn6mMbgCyfePdGQA5_kANIzt2YO9uKUrK1sdM6FKuBZkI9XNaTzz5Cu1q3cG78yhmTvrPHWLwRF_jp7MSR4Mwgq_cncinFbxqpxKwjK3bXitmuKQlkP1cVfwxc2GbVIk4Awwqh2HS-jrVUtEee59j-ArXKtntFParkIqsdw3QWljRYU2eL-gKHs5PMUUGJXYMeNpT47G0sslmm_iy1oZc3U7f69pg3f1TlkXEKuGXhawR5jVPRZCZeFwjzKLk7DNotc-WiLMf-6gA46elEMolcUImrJ_Mv3MVpak4TwH6A0Aka8XhL97jCuo5Nk0g_oDaab6oEZmRn06RR1HW3T9OwFwysJQG3eIpy_jlheAbwK4NTy40jiNYmJHfIpY4A3kBtC9ksL-mnPVlnJnvtWa_ccKYvJwQ9OezSCtrfeOYENwEAgF_HtAIyeMKQQ6Ja58btAuevW5HPADpW_4d-agMDHIsFfqJluREbKvXSuzv70qy2D8t4TgaJflv7kRccPyjLQCBXvX8iyijls7O5CtsQ2aln34Nmvp4sb1jUoL65vvkwkDJ1rv8z_3ay_wNVdFwuMswAszIxoKF7GTJsTJJzz8cniRvq2w6TLgHi-lH1O2BeiwktHrJ7ZqrzMFyl4QGqVPnZUR9zqFpyA_a8UWKAOeelnGbClFm__HD4jQpL9BCoZL8HeNZMv9tRLpee4y4Bbym68SOlVJmCQblaLjgi7rQ7oiKYRjtjS8mTdEuj-n7hGxRRf0_q_obENn6mK1UynxyXpL9I7UQVbsPfL2YzIpMXNX0Ikz539AGhUafTBrivs7VD9UlC0SJYRuZAEPISuVItdTYqnRzHcWyIHXMRFbbqPRdMtJi9DiyQ3ehrY1PvomZIVY9eIvJnXt1oRm36aaKRbYYdBVrwCZJ4GOgeywH3ZiHNPsU2-w3QhfqKZEpmLir2o81rZCQlB1X0tvoGsRGCOaD4bqO5IwrIamx_0s0Nx18VnoC2nnEbvbdYHuQfQT3Pzm-19XixKmE6rTHDxBMFVChKQAf041jEcrLX3GSgNa5uN8oambjTAxMvUKyrw5gLSmXHbr92A-E8xH46RT17UkMKuqAjFvZCxYenHf8sm9Fr0ReSGH7ScsjoQaCQ64zNRXvwZ13NyJ95SBiKFn7b8nIrfJ-ZgWqzuLHbYeav2cBMfQwGJJgGK9vlxrRz1R9_uFJUEi5ei_pw4iTDzQgt0FGbpmyufS74XVrpu5QY_TxOLVZHOPnFtiWp3D0bL96PRmtzzG1nzQ-4AZRcJEKkF3rIv83AyaYGPrqH69qvpnRhzF0v7dWkCUzkXndWrbEjy5lvlIuDktzEmhCZdaWJ9ilCxGDYdm5rK57HFVlc75AK1cJBL5T5h3cMevduaF4rpKtHpOInMOUXlsDbTwaaaf_54fDjNif8-hW2gUi9lbv1_mOekL-FvRbK8kNWp761CPGOsdZi6MKknkfcEKBfJSbbqIxJw353YcST3V6OuYNp0tgcI3EbYHH0a3fvN46ZK78o77bp15QIpXxciBl4TsMsoDBTK2E0ubhD8baotYy9S8aAiFj1bZJ1hJN2dmy1KXMwPI_JgGhYIABIS5GjyZkB9GNI3_aLYsf9pjq_dYAE
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 1A17 80 KB
21 KB 48ms
8ms Script
application/javascript 143.204.98.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-122.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 08:08:31 GMT
content-encoding: gzip
age: 2725164
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 1b73451818d2dd47a574604c0b84f692.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA50-C1
content-type: application/javascript
x-amz-cf-id: -7FPn_9KzcFEqbMCOP63IscfL9mVC7YmiSfH2d3yTWv_moTsgxXzPg==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame EBAA 43 B
215 B 322ms
101ms Image
image/gif 35.169.97.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=314658&asId=1a49a15c-af9c-b09c-d3d8-e834b8b1c395&tv=%7Bc:sKGYRm,pingTime:-3,time:40,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:0,h:0,t:17%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:40,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:i,cc:NaN.NaN.0.0,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B33~0%5D,as:%5B33~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sNy5Lpy+111%7C112*.314658-55082062%7C1121%7C1122%7C12%7C13%7C14%7C15%7C161%7C162%7C17,idMap:112*,rmeas:1,rend:0,renddet:IMG.us%7D&br=c
Requested by: Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.97.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-97-154.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
x-server-name: dt46.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame EBAA 43 B
216 B 320ms
101ms Image
image/gif 35.169.97.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=314658&asId=1a49a15c-af9c-b09c-d3d8-e834b8b1c395&tv=%7Bc:sKGYRn,pingTime:-6,time:41,type:i,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:41,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:i,cc:NaN.NaN.0.0,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B34~0%5D,as:%5B34~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sNy5Lpy+111%7C112*.314658-55082062%7C1121%7C1122%7C12%7C13%7C14%7C15%7C161%7C162%7C17,idMap:112*,rmeas:1,rend:0,renddet:IMG.us%7D&tpiLookup=ao:www.buholegal.com*%2Cwww.buholegal.com*&br=c
Requested by: Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.97.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-97-154.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
x-server-name: dt45.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame EBAA 43 B
215 B 319ms
102ms Image
image/gif 35.169.97.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=314658&asId=1a49a15c-af9c-b09c-d3d8-e834b8b1c395&tv=%7Bc:sKGYRq,pingTime:-2,time:44,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:263,beZ:265,mfA:266,cmA:268,inA:268,inZ:272,prA:272,prZ:276,si:281,poA:282,poZ:301,cmZ:301,mfZ:301,loA:304,loZ:306,ltA:307,ltZ:307%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:0,h:0,t:17%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:44,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:i,cc:NaN.NaN.0.0,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B37~0%5D,as:%5B37~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sNy5Lpy+111%7C112*.314658-55082062%7C1121%7C1122%7C12%7C13%7C14%7C15%7C161%7C162%7C17,idMap:112*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:IMG.us,sinceFw:26,readyFired:false%7D&br=c
Requested by: Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.97.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-97-154.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
x-server-name: dt01.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame EBAA 106 KB
37 KB 35ms
13ms Script
text/javascript 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: www.buholegal.com
URL: https://www.buholegal.com/9261187/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
Origin: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 14:19:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 24490
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 02 Nov 2021 14:19:44 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211027/r20110914/elements/html/ Frame EBAA 8 KB
3 KB 16ms
16ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211027/r20110914/elements/html/omrhp.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/314658/55082062/xbbe/creative/adj?p=APEucNWb9NMxAx_GJzxYYDEYc65tVyFs5utdyetzcR-CEfbgSFHu4ac&d=CnkAoCZ_4EOMJHE5EbcoCEH0E5DuoLs4XeG-8oWt7xzQzIs79S-CDpaqhADjHN-UKNTFtD9x0sOdSwc8ZLe5b7JQ5--hz2iBM8BBi_fJrS5KR9xK_ZtV168GY2dpUstu6i1LswRUOrk8lOtqjtjRgXYCoXcEIQajQZRAErkSAKAmf-CPlC9yO_LPF0T9Hls3yYpBITbJU5H75c28IdubuoC1ydjYEyhrsATPvxKAZZOevfSwStYgc-3ViOCFVnhHkVZS4_-FK2Rha4DsbAfMh1k9lpJ0wJO9WvMazLG1XjaEGCCBshwtIiWbpWhDwsZW-0Mw7prxzpIazeZo8lgY4faJ2uvr61xVvhoOsybSpc5szwr2u2GdB-Wkbw1qHMEhR7X1IvdMPetsZ3rNO5dWhJOvcnHwrCCNqTR6nQZADU5StWowsz2X9qVJl5o603jjF4wncy6r2Jj1McjoiD8EzUNAed9kpFgbyVorgQNDEO7oLDh1BCIjnII0C9x0_N-epeysPCzSQD2GMk1q-tZ-SmcB9E5HqYZTZXFnXr4hwl2IIyOMUmlFIzQopSfet68jgjjM1Wn90MrZEh-QqoJAdzUh_LeK0VPATeNJbHUaq8JmWQTjoWTyOSqZtg045dbNH-G5Ubypn9fxV4d3PBwRSQY_pNgJ7wIzzsnyTQ4z62uNp1M-fKX3kkBQd3AY-EthMFInijXkdQPwNzTuwrOCSCoQOdyHGhKbSAMqyyiDnJYu03VIxfGRBx3rRE7iXNrOLwpAGX7Y3vTF8sPwZiSl3vml2bQcXQdt-Zb-xI2SClkEION_l5W92UKXFnn_qeMorvEj32INpKGWgmJbmZ2bbczSb5zwy6RhqWABjmqXozXVHNcD5kVBcSEv8QkOToQK4q5DdIuSsQlyacUG7Mvsl8BUcNB_XJ1_2f1gHuxFjKd_1CGLSKRcz_7DfeVmXjFFSwFLZTahZrKyYcK1TL-iF6xU6LTajlScGvOEqHgOi4Ns3neW9rRTKAvXwIbCJayADQzaiPVsI0u5ZUIbJPqdUs6ivUjFx-ZWqkrt9twPnPCiDgwb6CkLOw2FqYNErhOpUaCJm0Ez-XIu91pkEpbKDB3DQM5X-SWR_s8YbQo-XgZJLzPxOraCfTOKM2cPa2rDfENRa9uVwxPVRSU24qdarQpJxAtm6NtMDQhnDLQPBz0MSdNyby3XUZAeg_2-j6onx1MtVOw1tp1UvR-Fe0AKVpZxNtkdyHQ1LHob7OlosTsveBGf2SFTcqtfx97PEqJ9X4vxGN2lRjIPFNsM9nWY5EFw8k-VXB6e66s9px9Ad_Byqf5yiLF07k3VNaxqB-4GNfrR615FxXpuo12DbABLoBCbXQ6T9s8aWbG4y3JTXk6Px39OGZm6_YCnXfvU2eJSQKmLFUeCkiH0SZShuhTTvfbEa5-EBBg1DhkY4uto976M8vo7GKYfcz_Tx7d-5rtBLKOfJPT9VcaR7IwhH-On4IYdFUwcNft5uYpm8KbQlxddkj5-fLDMZzYWSkgdbZrggcHEACPCm1KXLiv7lX3VxwuHeOeM06Lg9uBvokFCB1RR_dW0J0hR1LP2Xk6iKH5Ois2jIXJghdy_hP1zNEnrE_U9sL4IAJf-ddBRYGQIz2kUIxyKs5WTXjSbNBWaSlNvxbrLeAdiTJBmerZwnZIz2qTrl0ckf7PZ5Mu1DyDwyBzPwCr_dyLXzSp4aPn6mMbgCyfePdGQA5_kANIzt2YO9uKUrK1sdM6FKuBZkI9XNaTzz5Cu1q3cG78yhmTvrPHWLwRF_jp7MSR4Mwgq_cncinFbxqpxKwjK3bXitmuKQlkP1cVfwxc2GbVIk4Awwqh2HS-jrVUtEee59j-ArXKtntFParkIqsdw3QWljRYU2eL-gKHs5PMUUGJXYMeNpT47G0sslmm_iy1oZc3U7f69pg3f1TlkXEKuGXhawR5jVPRZCZeFwjzKLk7DNotc-WiLMf-6gA46elEMolcUImrJ_Mv3MVpak4TwH6A0Aka8XhL97jCuo5Nk0g_oDaab6oEZmRn06RR1HW3T9OwFwysJQG3eIpy_jlheAbwK4NTy40jiNYmJHfIpY4A3kBtC9ksL-mnPVlnJnvtWa_ccKYvJwQ9OezSCtrfeOYENwEAgF_HtAIyeMKQQ6Ja58btAuevW5HPADpW_4d-agMDHIsFfqJluREbKvXSuzv70qy2D8t4TgaJflv7kRccPyjLQCBXvX8iyijls7O5CtsQ2aln34Nmvp4sb1jUoL65vvkwkDJ1rv8z_3ay_wNVdFwuMswAszIxoKF7GTJsTJJzz8cniRvq2w6TLgHi-lH1O2BeiwktHrJ7ZqrzMFyl4QGqVPnZUR9zqFpyA_a8UWKAOeelnGbClFm__HD4jQpL9BCoZL8HeNZMv9tRLpee4y4Bbym68SOlVJmCQblaLjgi7rQ7oiKYRjtjS8mTdEuj-n7hGxRRf0_q_obENn6mK1UynxyXpL9I7UQVbsPfL2YzIpMXNX0Ikz539AGhUafTBrivs7VD9UlC0SJYRuZAEPISuVItdTYqnRzHcWyIHXMRFbbqPRdMtJi9DiyQ3ehrY1PvomZIVY9eIvJnXt1oRm36aaKRbYYdBVrwCZJ4GOgeywH3ZiHNPsU2-w3QhfqKZEpmLir2o81rZCQlB1X0tvoGsRGCOaD4bqO5IwrIamx_0s0Nx18VnoC2nnEbvbdYHuQfQT3Pzm-19XixKmE6rTHDxBMFVChKQAf041jEcrLX3GSgNa5uN8oambjTAxMvUKyrw5gLSmXHbr92A-E8xH46RT17UkMKuqAjFvZCxYenHf8sm9Fr0ReSGH7ScsjoQaCQ64zNRXvwZ13NyJ95SBiKFn7b8nIrfJ-ZgWqzuLHbYeav2cBMfQwGJJgGK9vlxrRz1R9_uFJUEi5ei_pw4iTDzQgt0FGbpmyufS74XVrpu5QY_TxOLVZHOPnFtiWp3D0bL96PRmtzzG1nzQ-4AZRcJEKkF3rIv83AyaYGPrqH69qvpnRhzF0v7dWkCUzkXndWrbEjy5lvlIuDktzEmhCZdaWJ9ilCxGDYdm5rK57HFVlc75AK1cJBL5T5h3cMevduaF4rpKtHpOInMOUXlsDbTwaaaf_54fDjNif8-hW2gUi9lbv1_mOekL-FvRbK8kNWp761CPGOsdZi6MKknkfcEKBfJSbbqIxJw353YcST3V6OuYNp0tgcI3EbYHH0a3fvN46ZK78o77bp15QIpXxciBl4TsMsoDBTK2E0ubhD8baotYy9S8aAiFj1bZJ1hJN2dmy1KXMwPI_JgGhYIABIS5GjyZkB9GNI3_aLYsf9pjq_dYAE&ias_dspID=64&ias_campId=&ias_pubId=&ias_chanId=&ias_placementId=&bidurl=&ias_dealId=&adsafe_url=https%3A%2F%2Fwww.buholegal.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fwww.buholegal.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html%3Fn%3D1&adsafe_type=d&adsafe_jsinfo=,id:1a49a15c-af9c-b09c-d3d8-e834b8b1c395,c:sKGYQZ,sl:outOfView,em:true,fr:false,thd:1,mn:app20ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:i,cc:NaN.NaN.0.0,piv:0,obst:0,th:0,reas:r,br:c,abv:na,an:n,oam:0,nbld:0,mtim:3,fm:sNy5Lpy+111%7C112*.314658-55082062%7C1121%7C1122%7C12%7C13%7C14%7C15%7C161%7C162%7C17,idMap:112*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:17,oid:c7dfa959-3b57-11ec-83b7-02467abe7cd0,v:19.8.258,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 20:56:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 711
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3128
x-xss-protection: 0
server: cafe
etag: 3658073882064373855
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 Nov 2021 20:56:03 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211027/r20110914/ Frame EBAA 24 KB
9 KB 17ms
17ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211027/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df660fd3ad4168b7c32eadc3b588ee90334003a7ea1af3299536be4e6697fcd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:02:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 308
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9375
x-xss-protection: 0
server: cafe
etag: 6887285106501176819
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 15 Nov 2021 21:02:46 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3A4D 1 KB
749 B 16ms
16ms Document
text/html 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 01 Nov 2021 18:26:41 GMT
expires: Tue, 02 Nov 2021 18:26:41 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 9673
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 index.html Show response
s0.2mdn.net/8893492/1622137855315/ Frame A889 4 KB
1 KB 49ms
48ms Document
text/html 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8893492/1622137855315/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8100b1a97b5b47ced63dbdc8c1ff5418d3af8db8833c848bef32781f6c47632e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 1365
date: Mon, 01 Nov 2021 21:07:54 GMT
expires: Tue, 02 Nov 2021 21:07:54 GMT
cache-control: public, max-age=86400
last-modified: Thu, 27 May 2021 17:50:55 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame EBAA 0
23 B 43ms
43ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvCxs5kUW_2VFn8UaDGZTB5R6uZJgK8xfVuZnL0pvcF2s6QricPcXCaZQ_loRXC4dX74NeGj5bdJJz34abgqEJOFfpYZd_-r-tcUUS9OkX3yt_MDsgd-RmIOQjOAmH5jXVH5MCmP5Ux1L4brajAGkNAiVA5g49mSg67H6xNJ4VBjzQ1orMrFQ7q6QxEYHOBsaU&sai=AMfl-YSQQb9xvlkqYDrr6PMxdxvUrz16DJQSCvHmiw-msSF73HxG8sA-WDd6JSvUWTN4hWK_nUwE1hHuJbVM_qGWRFxTEcphxPtLPpwLv3SdGDCYIDX3dKzHqMxj_3wb0Q&sig=Cg0ArKJSzD9lXHbU4cbjEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=47&cbvp=1&cstd=46&cisv=r20211027.50345&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: www.buholegal.com
URL: https://www.buholegal.com/9261187/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

edge-atlas-shv-01-frt3.facebook.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 01 Nov 2021 21:07:54 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 img;adv=11002245653149;ec=11002245685555;adv.a=8893492;c.a=25321014;s.a=4497788;p.a=304652915;a.a=497632023;cache=1335894416;
ad.atdmt.com/i/ Frame EBAA 43 B
941 B 150ms
109ms Image
image/gif 31.13.92.2
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.atdmt.com/i/img;adv=11002245653149;ec=11002245685555;adv.a=8893492;c.a=25321014;s.a=4497788;p.a=304652915;a.a=497632023;cache=1335894416;

Requested by

Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.92.2 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: br
x-content-type-options: nosniff
cross-origin-resource-policy: rollout
x-xss-protection: 0
pragma: no-cache
x-fb-debug: oZcpGv+WHRndpgXKwUoSfFJbwtYVrxm1FuIl9Rl1ZdGbe96l/WdED+Mz9qHKMdI4oenQxWD2laYV/GTpNFr8XA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: unsafe-none
x-frame-options: DENY
date: Mon, 01 Nov 2021 21:07:54 GMT
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 i
cdn.bizibly.com/ Frame EBAA 43 B
346 B 28ms
7ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizibly.com/i?v=8893492&a=497632023&c=151742632&s=4497788&p=304652915&m=AMsySZbIihWHSkYCznaHkFOLlvmh&n=1335894416
Requested by: Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/674C) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
last-modified: Thu, 28 Oct 2021 23:58:41 GMT
server: ECS (frb/674C)
age: 335353
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 dpixel
cms.quantserve.com/ Frame 3A4D 35 B
464 B 32ms
8ms Image
image/gif 91.228.74.189
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEOL-QnbWI-UBM-HhhB4rkrM&google_cver=1&google_push=AYg5qPKBFppvSoMb6QbaXn7srnA5ZPfEmGcMI-YGcUD39YdS-HQ0ZlnNmNCmLsFO778Bu-jtOT-hwqLAt7NsE05HtRmX-XtmVXd9

Requested by

Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.189 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3A4D
Redirect Chain

https://beacon.walmart.com/etap.gif?tap=gAds&google_gid=CAESELTeq_zw-pbcyMjndcL4Cq4&google_cver=1&google_push=AYg5qPLZXfYV0vxwsCbgb6NjwLiDsm0CkoFM231hkn9kbpuUijjsWsHCMu6_5kPErxH1K3ycaxPwGBZbQOC6snl...
https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=Vq6KcokAk9I01PhZG75xfw&tap=gAds&google_gid=CAESELTeq_zw-pbcyMjndcL4Cq4&google_cver=1&google_push=AYg5qPLZXfYV0vxwsCbgb6NjwLiDsm0CkoFM...

170 B
188 B

17ms
17ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=Vq6KcokAk9I01PhZG75xfw&tap=gAds&google_gid=CAESELTeq_zw-pbcyMjndcL4Cq4&google_cver=1&google_push=AYg5qPLZXfYV0vxwsCbgb6NjwLiDsm0CkoFM231hkn9kbpuUijjsWsHCMu6_5kPErxH1K3ycaxPwGBZbQOC6snlHUkzG_7Vh79R0

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

strict-transport-security: max-age=7884000; includeSubDomains
via: HTTP/2.0 odnd
last-modified: Wed, 13 Oct 2021 06:38:00 GMT
date: Mon, 01 Nov 2021 21:07:54 GMT
content-type: text/plain; charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=Vq6KcokAk9I01PhZG75xfw&tap=gAds&google_gid=CAESELTeq_zw-pbcyMjndcL4Cq4&google_cver=1&google_push=AYg5qPLZXfYV0vxwsCbgb6NjwLiDsm0CkoFM231hkn9kbpuUijjsWsHCMu6_5kPErxH1K3ycaxPwGBZbQOC6snlHUkzG_7Vh79R0
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
content-length: 0
x-tb: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3A4D
Redirect Chain

https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEANwd_nM8ZA2JqBpLmio2e4&google_push=AYg5qPJDCGwA7w-5hE_fWIcn3y8fWwF7NIhNePGrd8qSkKSlooEqhYZcHlD0TiEnXPeTwiBxqPTmCDhfTeu_XLOfa8QXsqL...
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AYg5qPJDCGwA7w-5hE_fWIcn3y8fWwF7NIhNePGrd8qSkKSlooEqhYZcHlD0TiEnXPeTwiBxqPTmCDhfTeu_XLOfa8QXsqLtCWKh&google_hm=MTA4MTYwOTgxOTM3MD...

170 B
188 B

19ms
18ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AYg5qPJDCGwA7w-5hE_fWIcn3y8fWwF7NIhNePGrd8qSkKSlooEqhYZcHlD0TiEnXPeTwiBxqPTmCDhfTeu_XLOfa8QXsqLtCWKh&google_hm=MTA4MTYwOTgxOTM3MDA2NjY0ODQ

Requested by

Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AYg5qPJDCGwA7w-5hE_fWIcn3y8fWwF7NIhNePGrd8qSkKSlooEqhYZcHlD0TiEnXPeTwiBxqPTmCDhfTeu_XLOfa8QXsqLtCWKh&google_hm=MTA4MTYwOTgxOTM3MDA2NjY0ODQ
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 0
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3A4D
Redirect Chain

https://odr.mookie1.com/t/v2/sync?tagid=V2_4530&src.visitorid=CAESEO2HJ2q_vMwZRGYIe7Xwe3E&google_cver=1&google_push=AYg5qPI49c0KVCHrrSBErWloJNX52a13Oc0ahMXJWJ22Um4tDFxwV1f_9Ydox-1NkKqmXqKTfheGlrjXc...
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dev_dmp&google_push=AYg5qPI49c0KVCHrrSBErWloJNX52a13Oc0ahMXJWJ22Um4tDFxwV1f_9Ydox-1NkKqmXqKTfheGlrjXczsHci0TEox0-qY2qY6O&google_hm=MTA4MTQ3NjExOD...

170 B
188 B

17ms
16ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dev_dmp&google_push=AYg5qPI49c0KVCHrrSBErWloJNX52a13Oc0ahMXJWJ22Um4tDFxwV1f_9Ydox-1NkKqmXqKTfheGlrjXczsHci0TEox0-qY2qY6O&google_hm=MTA4MTQ3NjExODc2MTU3MjIzNDk

Requested by

Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dev_dmp&google_push=AYg5qPI49c0KVCHrrSBErWloJNX52a13Oc0ahMXJWJ22Um4tDFxwV1f_9Ydox-1NkKqmXqKTfheGlrjXczsHci0TEox0-qY2qY6O&google_hm=MTA4MTQ3NjExODc2MTU3MjIzNDk
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 0
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3A4D
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESECpPq9obj_QjDfHLY-8GK28&google_cver=1&google_push=AYg5qPJ_EXZh_DQuJjE-qy7U0msse0JvdnxSkcwpmpKxAu6BJGtLzTPGbuRsJuDVsCH2HDQ69vDTha5V-7lsgJazu-PK2XT_23E7
https://rtb.openx.net/sync/dds?google_gid=CAESECpPq9obj_QjDfHLY-8GK28&google_cver=1&google_push=AYg5qPJ_EXZh_DQuJjE-qy7U0msse0JvdnxSkcwpmpKxAu6BJGtLzTPGbuRsJuDVsCH2HDQ69vDTha5V-7lsgJazu-PK2XT_23E7&...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJ_EXZh_DQuJjE-qy7U0msse0JvdnxSkcwpmpKxAu6BJGtLzTPGbuRsJuDVsCH2HDQ69vDTha5V-7lsgJazu-PK2XT_23E7&google_hm=5M7qbTw4yTcYkT5pSiAblQ==

170 B
188 B

17ms
16ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJ_EXZh_DQuJjE-qy7U0msse0JvdnxSkcwpmpKxAu6BJGtLzTPGbuRsJuDVsCH2HDQ69vDTha5V-7lsgJazu-PK2XT_23E7&google_hm=5M7qbTw4yTcYkT5pSiAblQ==

Requested by

Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJ_EXZh_DQuJjE-qy7U0msse0JvdnxSkcwpmpKxAu6BJGtLzTPGbuRsJuDVsCH2HDQ69vDTha5V-7lsgJazu-PK2XT_23E7&google_hm=5M7qbTw4yTcYkT5pSiAblQ==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: jlok39mb05e9jdqicukicb3lifksi5i0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3A4D
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8o1ddhsHRMyEeSqbofbyyw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

19ms
19ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8o1ddhsHRMyEeSqbofbyyw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLH_dUL3TA3jYevKaJAyEtcrxEkSVOYS_zx8XWHrmCCzMW4dUsqmnjIGC1DsxpFOvlK9BdH2E8YOzgvnCOl1Yl-QqrgYKA

Requested by

Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=8o1ddhsHRMyEeSqbofbyyw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLH_dUL3TA3jYevKaJAyEtcrxEkSVOYS_zx8XWHrmCCzMW4dUsqmnjIGC1DsxpFOvlK9BdH2E8YOzgvnCOl1Yl-QqrgYKA
date: Mon, 01 Nov 2021 21:07:53 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame 3A4D 0
44 B 732ms
240ms Image
text/plain 18.182.119.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESELRek5-dwaVIxbrBgOV-33k&google_cver=1&google_push=AYg5qPKGjdm-j1AaaF9bLekK0BoOnz_iY3IlnmE72ZN40LQtoSPib94ubbM8U1QXPhjT1hUOsNY-hTJJB7apVxOS5CDbdzLdgECh
Requested by: Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.182.119.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-182-119-142.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:55 GMT
server: awselb/2.0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 3A4D 0
12 B 14ms
14ms Image
text/html 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KGfArFl-S2mmaz2m6Q8WE7apc-kcsmZQH4VR3GA8m9wj6EBnKChjh90T9trOEY__MJMynn

Requested by

Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:54 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 main.css
s0.2mdn.net/8893492/1622137855315/ Frame A889 2 KB
772 B 39ms
39ms Stylesheet
text/css 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8893492/1622137855315/main.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8893492/1622137855315/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d6bd2a8616a59fb630dca288957747b2afd1c917b58aa0a84f528d821ac4f88

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/8893492/1622137855315/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 747
x-xss-protection: 0
last-modified: Thu, 27 May 2021 17:50:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 02 Nov 2021 21:07:54 GMT

GET
H3 200 gradient.jpg
s0.2mdn.net/8893492/1622137855315/img/ Frame A889 2 KB
2 KB 40ms
39ms Image
image/jpeg 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8893492/1622137855315/img/gradient.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8893492/1622137855315/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be81a54c576b9534bd4c524e0dd5c2a48d0b1ef6ac5d67d3822f0030aa1accf6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/8893492/1622137855315/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:54 GMT
x-content-type-options: nosniff
last-modified: Thu, 27 May 2021 17:50:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2506
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 02 Nov 2021 21:07:54 GMT

GET
H3 200 txt1.svg
s0.2mdn.net/8893492/1622137855315/img/ Frame A889 8 KB
2 KB 39ms
38ms Image
image/svg+xml 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8893492/1622137855315/img/txt1.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8893492/1622137855315/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c597059890557c105eda4f7372e10ae8fd1b7bd3de1f53d669e031023d36967

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/8893492/1622137855315/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2372
x-xss-protection: 0
last-modified: Thu, 27 May 2021 17:50:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 02 Nov 2021 21:07:54 GMT

GET
H3 200 txt2.svg
s0.2mdn.net/8893492/1622137855315/img/ Frame A889 5 KB
2 KB 41ms
40ms Image
image/svg+xml 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8893492/1622137855315/img/txt2.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8893492/1622137855315/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

335ad7623df0b8fdcca56127610e9a61aa27c3bfb7b23b7062b02740a26cafda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/8893492/1622137855315/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1917
x-xss-protection: 0
last-modified: Thu, 27 May 2021 17:50:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 02 Nov 2021 21:07:54 GMT

GET
H3 200 logo.png
s0.2mdn.net/8893492/1622137855315/img/ Frame A889 8 KB
8 KB 41ms
41ms Image
image/png 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8893492/1622137855315/img/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8893492/1622137855315/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bbe9810541bab9ee60900e6b772d8ce51d872191a0484855658840098e6c24fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/8893492/1622137855315/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:54 GMT
x-content-type-options: nosniff
last-modified: Thu, 27 May 2021 17:50:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7915
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 02 Nov 2021 21:07:54 GMT

GET
H3 200 cta.svg
s0.2mdn.net/8893492/1622137855315/img/ Frame A889 9 KB
4 KB 47ms
47ms Image
image/svg+xml 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8893492/1622137855315/img/cta.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8893492/1622137855315/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5f740b3f3c6f9ca4ba2943104b1eb0e19708db4a2ad3d6aea558c5507429bfbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/8893492/1622137855315/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3711
x-xss-protection: 0
last-modified: Thu, 27 May 2021 17:50:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 02 Nov 2021 21:07:54 GMT

GET
H3 200 TweenMax.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/2.0.2/ Frame A889 113 KB
34 KB 41ms
22ms Script
application/javascript 104.16.19.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/2.0.2/TweenMax.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8893492/1622137855315/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.19.94 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

009bf00d3831fb62595adb20e170ed288d8a157493fb6028b1888b05875ed8f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:54 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 4341953
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 33806
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-1c56a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eNXRJ4BoQN0kMr%2Fk%2FvwXKsacLZxNv1LopGIc%2BCcbC0zpMU1G%2BSQ0QyIATrTCypNcw9dJ2bCP%2BcOB1FPCNplZZKKiUTIqaTQYM8RA1IYPW5IYP0LIEQO9dKalpoH2E4hOLCJvMpWf"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6a78186b3b6c27bc-PRG
expires: Sat, 22 Oct 2022 21:07:54 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/8893492/1622137855315/ Frame A889 499 B
285 B 30ms
29ms Script
text/javascript 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8893492/1622137855315/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8893492/1622137855315/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

738dc13f62255286f7d427457575a9339b4e0859ed91031374bf277bb61f4741

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/8893492/1622137855315/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 21:07:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 260
x-xss-protection: 0
last-modified: Thu, 27 May 2021 17:50:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 02 Nov 2021 21:07:54 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame EBAA 0
23 B 43ms
43ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvCxs5kUW_2VFn8UaDGZTB5R6uZJgK8xfVuZnL0pvcF2s6QricPcXCaZQ_loRXC4dX74NeGj5bdJJz34abgqEJOFfpYZd_-r-tcUUS9OkX3yt_MDsgd-RmIOQjOAmH5jXVH5MCmP5Ux1L4brajAGkNAiVA5g49mSg67H6xNJ4VBjzQ1orMrFQ7q6QxEYHOBsaU&sai=AMfl-YSQQb9xvlkqYDrr6PMxdxvUrz16DJQSCvHmiw-msSF73HxG8sA-WDd6JSvUWTN4hWK_nUwE1hHuJbVM_qGWRFxTEcphxPtLPpwLv3SdGDCYIDX3dKzHqMxj_3wb0Q&sig=Cg0ArKJSzD9lXHbU4cbjEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=219&vt=11&dtpt=172&dett=3&cstd=46&cisv=r20211027.50345&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: www.buholegal.com
URL: https://www.buholegal.com/9261187/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 01 Nov 2021 21:07:54 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 dt
dt.adsafeprotected.com/ Frame EBAA 43 B
215 B 101ms
100ms Image
image/gif 35.169.97.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=314658&asId=1a49a15c-af9c-b09c-d3d8-e834b8b1c395&tv=%7Bc:sKGYWK,pingTime:-10,time:374,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85NS4wLjQ2MzguNTQgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1635800874809%7C%7C221526b4df00c94d0c298a1d0a25af89%7C%7C9ceebc4ad83ababb94d4029b4dca4e66%7C%7C45706d78a27af3eb16a47f313b933e63%7C%7Cf1ed94563546fcf69f1afd0d611d637d%7C%7C2d87761b19d1132f502e6648651b1f8e%7C%7C3b2f281c72548f327a5b7fdcb5f31876%7C%7C2b563caa0cb6fa88cdcf92ec8f00a209%7C%7C1629390669%7D
Requested by: Host: 2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com
URL: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.97.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-97-154.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2a3f10af87b769f3ad5841c5910b1f4c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Nov 2021 21:07:54 GMT
x-server-name: dt38.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 641D 42 B
64 B 50ms
50ms Fetch
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssYRjulU6M3OX0T7qS4owaf8VWQ8JLfLFjEsfPbDy5Hcly2O010P21enudd_5gUPzaee-iSCZ1C9ZdMntuZOS8NWIkDNAw9qGnpz0wXPAdyANFWif30EpsI55FcBwYCvhTWZ1Tm7N88v4k94DICzuVcKeDSNgQR5wFNLaN2cis&sai=AMfl-YSyNs6PZXIlCp7McQEZZlrYzCTucUWYzU1wrD31Faq18nyAzuxsB-mKtjPzap4YUpDGeYMB-kdBQ2R9PjUx8N2kSvN2aI040g31ADF4_4H6PCp0_PTLuK-qgs9fSds&sig=Cg0ArKJSzKeDXOekPWhfEAE&id=lidar2&mcvt=1001&p=103,30,703,330&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20211027&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2158746279&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1635800873638&rpt=385&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS