pastelink.net Open in urlscan Pro
178.79.155.87  Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 38

• https://tracking.m6r.eu/impression/creative?format=script&creativeLinkId=3a409b33-9722-457b-bdd8-f183f681d04d&id=adx-auction%3A617a08a20002f8bd078382b90009ced3&adxPrice=YXoIogAB2cUHg4JlAAvGH4rEEUo351j3pZyU-g&sync=adx&target=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCOXzRogh6YcWzB-WEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa_m5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5_OG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ-_uXfPR-GGE-cPW30uxR13Pc-PsnQqLMh_ElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj-TH4vuhaqGfX9ZsjyN7_p4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ_9JlH7lh_BcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7-2x_mm8QGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3GoaFhf2aWgpRlsirYbklC4nscKw%26client%3Dca-pub-1750856239204414%26adurl%3D HTTP 302
• https://tracking.m6r.eu/impression/creative?format=script&creativeLinkId=3a409b33-9722-457b-bdd8-f183f681d04d&id=adx-auction%3A617a08a20002f8bd078382b90009ced3&adxPrice=YXoIogAB2cUHg4JlAAvGH4rEEUo351j3pZyU-g&sync=adx&target=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCOXzRogh6YcWzB-WEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa_m5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5_OG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ-_uXfPR-GGE-cPW30uxR13Pc-PsnQqLMh_ElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj-TH4vuhaqGfX9ZsjyN7_p4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ_9JlH7lh_BcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7-2x_mm8QGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3GoaFhf2aWgpRlsirYbklC4nscKw%26client%3Dca-pub-1750856239204414%26adurl%3D&checkcookies=true

Request Chain 54

• https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=0vxKNUD09mYh8gdZ-XkP4w& HTTP 302
• https://tracking.m6r.eu/sync/adxSyncDone?gdprFallback=true&google_ula=158217889,0

62 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request waai4u9e Show response pastelink.net/	18 KB 7 KB	103ms 65ms	Document text/html	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Full URL https://pastelink.net/waai4u9e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash cc4a25263768db1e3a62c34b7b595db26be97308209986b898254ce5ebeec3ae Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers server nginx date Thu, 28 Oct 2021 02:19:13 GMT content-type text/html; charset=UTF-8 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip
GET H2	200	css2 fonts.googleapis.com/	5 KB 1 KB	61ms 26ms	Stylesheet text/css	142.250.185.234 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap Requested by Host: pastelink.net URL: https://pastelink.net/waai4u9e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.234 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f10.1e100.net Software ESF / Resource Hash 2c243eeac8e9c04aaddb3a8d759ab9b535faf21f7b292e61458ee5e45cb8a02a Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 28 Oct 2021 02:19:13 GMT server ESF date Thu, 28 Oct 2021 02:19:13 GMT x-frame-options SAMEORIGIN report-to {"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cross-origin-opener-policy-report-only same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk" expires Thu, 28 Oct 2021 02:19:13 GMT
GET H2	200	styles.css pastelink.net/assets/css/	213 KB 214 KB	18ms 17ms	Stylesheet text/css	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Full URL https://pastelink.net/assets/css/styles.css?q=15 Requested by Host: pastelink.net URL: https://pastelink.net/waai4u9e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash 1786dd1d9c8276247374c106ab58b4963bfddffe0d836515f81e13a40ede3703 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/waai4u9e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:13 GMT last-modified Wed, 06 Oct 2021 13:50:37 GMT server nginx etag "615da9ad-355b2" strict-transport-security max-age=31536000; includeSubDomains content-type text/css accept-ranges bytes content-length 218546
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	63ms 18ms	Script application/javascript	69.16.175.10 HIGHWINDS2
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: pastelink.net URL: https://pastelink.net/waai4u9e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.10 Phoenix, United States, ASN33438 (HIGHWINDS2, US), Reverse DNS hwcdn.net Software nginx / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers Referer https://pastelink.net/ Origin https://pastelink.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:13 GMT content-encoding gzip last-modified Tue, 02 Mar 2021 17:27:20 GMT server nginx etag W/"603e7578-15d9d" vary Accept-Encoding x-hw 1635387553.dop237.am5.t,1635387553.cds216.am5.hn,1635387553.cds007.am5.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30875
GET H2	200	script.min.js Show response pastelink.net/assets/js/	28 KB 29 KB	17ms 17ms	Script application/javascript	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Full URL https://pastelink.net/assets/js/script.min.js?q=15 Requested by Host: pastelink.net URL: https://pastelink.net/waai4u9e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash b4170c909c4f585adb37ad7ddccb8bed126ac434248651ccc5216bffcbd5ed56 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/waai4u9e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:13 GMT last-modified Wed, 06 Oct 2021 13:37:31 GMT server nginx etag "615da69b-71b1" strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript accept-ranges bytes content-length 29105
GET H2	200	js.cookie.min.js Show response cdnjs.cloudflare.com/ajax/libs/js-cookie/latest/	2 KB 2 KB	76ms 38ms	Script application/javascript	104.16.19.94 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/js-cookie/latest/js.cookie.min.js Requested by Host: pastelink.net URL: https://pastelink.net/waai4u9e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.19.94 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4b6d244a569a8befc0b901e3dca8e82f19b188e2d3e76f7c62fce96935ed6311 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:13 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 44050 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 772 timing-allow-origin * last-modified Mon, 04 May 2020 16:11:49 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ec5-6d7" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O5sGLiL9rAs8bRDmKMq0TWDLhOzsHxH3wFWLSL3Qb%2Ba1siv%2Bx%2FO6C8SdyRbM9UYV8OBwbFWqEjTV68RODNu2Xs36Lq2Zngv%2BTX2UbQ7p6%2FTkw87WmcXmgkPdJ%2Bk93v1N4YFxXCA%2F"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6a50ad90fb99ee17-CDG expires Tue, 18 Oct 2022 02:19:13 GMT
GET H2	200	rules.js Show response cdn.adligature.com/pl/prod/	10 KB 3 KB	65ms 22ms	Script application/javascript	104.21.93.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.adligature.com/pl/prod/rules.js Requested by Host: pastelink.net URL: https://pastelink.net/waai4u9e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.93.14 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 694b72ca62c120a3609b0a98f3921815f8a2fd48bd8a45b660937f4c1678eb15 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-goog-hash crc32c=Aof8Kg==, md5=IG6ex2Vvbp/O+MAXfh1Oog== date Thu, 28 Oct 2021 02:19:13 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 600 cf-polished origSize=18373 x-guploader-uploadid ADPycdvIonLKVkD8TdwvnhJNvUfvLeiAxQaZTt7x7Y3Clu1OgpM4ivLpcoGzK_GUSjVdh55elRpKjPZ6lgiv-GdIYIk x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Thu, 30 Sep 2021 19:27:15 GMT server cloudflare etag W/"206e9ec7656f6e9fcef8c0177e1d4ea2" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DYcIJUoOGIL53v5jeeW7fXATk0Z9JP9MKJEbWEEUT6ZZRciTbd9DAJ0avzmOWluePlXi3nJ9aEnnNh9%2FbzPIMlSnuzt7SrePp1rhWmaOeu%2FNwhwFsfEyFt05JIOyL%2BsTNMPDR4w%3D"}],"group":"cf-nel","max_age":604800} x-goog-generation 1633030035918326 content-type application/javascript expires Thu, 28 Oct 2021 02:19:12 GMT cache-control public, max-age=1800, s-maxage=600, must-revalidate x-goog-stored-content-length 18373 cf-ray 6a50ad90fe9c4019-CDG cf-bgj minify
GET H2	200	api.js Show response www.google.com/recaptcha/	906 B 956 B	58ms 22ms	Script text/javascript	142.250.186.164 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js?onload=captchaLoaded Requested by Host: pastelink.net URL: https://pastelink.net/waai4u9e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.164 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f4.1e100.net Software GSE / Resource Hash 2683e754f9ddbcde587c1b1339b6c0a1b7daa683909f033fc87e9268b9a566ff Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:13 GMT content-encoding gzip x-content-type-options nosniff server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin content-security-policy frame-ancestors 'self' alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 572 x-xss-protection 1; mode=block expires Thu, 28 Oct 2021 02:19:13 GMT
GET H2	200	pastelink-logo.svg pastelink.net/assets/images/logo/	3 KB 3 KB	17ms 17ms	Image image/svg+xml	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Show image Full URL https://pastelink.net/assets/images/logo/pastelink-logo.svg Requested by Host: pastelink.net URL: https://pastelink.net/waai4u9e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash 01408f8061623faa6d2c0f015cd23483c3aa363c095e152f613ed94c87a5803d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/waai4u9e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:13 GMT last-modified Wed, 06 Oct 2021 13:37:31 GMT server nginx etag "615da69b-d3d" strict-transport-security max-age=31536000; includeSubDomains content-type image/svg+xml accept-ranges bytes content-length 3389
GET H2	200	public.png pastelink.net/assets/images/	609 B 775 B	19ms 17ms	Image image/png	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Show image Full URL https://pastelink.net/assets/images/public.png Requested by Host: pastelink.net URL: https://pastelink.net/waai4u9e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash 04bcd86676a40009fe53606bce88edf13537b712f218f9c6057e97c612513092 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/waai4u9e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:13 GMT last-modified Thu, 27 May 2021 10:51:10 GMT server nginx etag "60af799e-261" strict-transport-security max-age=31536000; includeSubDomains content-type image/png accept-ranges bytes content-length 609
GET H2	200	gtm.js Show response www.googletagmanager.com/	189 KB 65 KB	69ms 31ms	Script application/javascript	142.250.186.168 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ Requested by Host: pastelink.net URL: https://pastelink.net/waai4u9e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.168 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f8.1e100.net Software Google Tag Manager / Resource Hash b744b614642d49a792f7eb575249ec6bd398e1fe2f3e3977a08fb861f434d69d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:13 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 66148 x-xss-protection 0 last-modified Thu, 28 Oct 2021 00:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 28 Oct 2021 02:19:13 GMT
GET H2	200	advally-4.9.1.js Show response cdn.adligature.com/rules.js/	90 KB 24 KB	24ms 23ms	Script application/javascript	104.21.93.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.adligature.com/rules.js/advally-4.9.1.js Requested by Host: cdn.adligature.com URL: https://cdn.adligature.com/pl/prod/rules.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.93.14 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0529fd56af7972219982099af6886c06ef1220bbd2224d6851ee3f82bd0576e7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-goog-hash crc32c=6M2eAw==, md5=cO6GGLPX9u9tVaw36XT6yQ== date Thu, 28 Oct 2021 02:19:13 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 566 cf-polished origSize=153464 x-guploader-uploadid ADPycdv1ALyNhlMdNFBfpj-opOWzffRaJf6BLq8arP_bgf1QqDkdkepG_NWkPpEVDxradsV1xfmV89dc8AWzRNuD14E x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Thu, 30 Sep 2021 19:01:35 GMT server cloudflare etag W/"70ee8618b3d7f6ef6d55ac37e974fac9" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yuX%2BeOPZjBgqwCUy2FHCKfvPoGhzyZGghZ8NaOVbO7q2ds3665oOSydQxrwYkNU0pjqPnKwbvs%2Bm%2BNq1w%2BVx8Zfd8hisnimC7amQtVqvMw4CaWQ9%2FI3q09W3xXzTMe6dmrIl1bo%3D"}],"group":"cf-nel","max_age":604800} x-goog-generation 1633028495082015 content-type application/javascript expires Thu, 28 Oct 2021 04:09:47 GMT cache-control public, max-age=7200, s-maxage=7200, must-revalidate x-goog-stored-content-length 153464 cf-ray 6a50ad914edf4019-CDG cf-bgj minify
GET H2	200	recaptcha__de.js Show response www.gstatic.com/recaptcha/releases/YhkYx1k-yvvb8OonJPmOpoJY/	346 KB 136 KB	52ms 16ms	Script text/javascript	142.250.181.227 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/YhkYx1k-yvvb8OonJPmOpoJY/recaptcha__de.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js?onload=captchaLoaded Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.181.227 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s56-in-f3.1e100.net Software sffe / Resource Hash dda2aba38252dcb4fde2222ecdcf5806f23fc3e9400f310f0ee1927329243c78 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://pastelink.net/ Origin https://pastelink.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 00:21:08 GMT content-encoding gzip x-content-type-options nosniff age 7085 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 138388 x-xss-protection 0 last-modified Mon, 18 Oct 2021 04:02:55 GMT server sffe vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="recaptcha" expires Fri, 28 Oct 2022 00:21:08 GMT
GET H2	200	debut_light.png pastelink.net/assets/images/	4 KB 4 KB	17ms 17ms	Image image/png	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Show image Full URL https://pastelink.net/assets/images/debut_light.png Requested by Host: pastelink.net URL: https://pastelink.net/assets/css/styles.css?q=15 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash c24ccee9a35eef9e74411eac871935bdff6bcb895cce80b754b66d3e4292a3ce Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/assets/css/styles.css?q=15 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:13 GMT last-modified Thu, 27 May 2021 10:51:09 GMT server nginx etag "60af799d-10c8" strict-transport-security max-age=31536000; includeSubDomains content-type image/png accept-ranges bytes content-length 4296
GET H2	200	flag-sprite.png pastelink.net/assets/images/Sprited/	9 KB 9 KB	18ms 18ms	Image image/png	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Show image Full URL https://pastelink.net/assets/images/Sprited/flag-sprite.png?q=13 Requested by Host: pastelink.net URL: https://pastelink.net/assets/css/styles.css?q=15 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash cea32a344ff0d6b192d13bacaf72a65d139d767e8c7ff56b1179cd97897a0803 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/assets/css/styles.css?q=15 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:13 GMT last-modified Wed, 06 Oct 2021 13:37:31 GMT server nginx etag "615da69b-23bd" strict-transport-security max-age=31536000; includeSubDomains content-type image/png accept-ranges bytes content-length 9149
GET H2	200	arrow-down-blue.svg pastelink.net/assets/images/	239 B 409 B	19ms 18ms	Image image/svg+xml	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Show image Full URL https://pastelink.net/assets/images/arrow-down-blue.svg Requested by Host: pastelink.net URL: https://pastelink.net/assets/css/styles.css?q=15 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash 50a60e5e5f2e8f10a2f8685031ec9849ba8faff613139f3a402e89f25ccbbabc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/assets/css/styles.css?q=15 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:13 GMT last-modified Wed, 29 Sep 2021 15:26:32 GMT server nginx etag "615485a8-ef" strict-transport-security max-age=31536000; includeSubDomains content-type image/svg+xml accept-ranges bytes content-length 239
GET H2	200	sprites.png pastelink.net/assets/images/	4 KB 4 KB	18ms 17ms	Image image/png	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Show image Full URL https://pastelink.net/assets/images/sprites.png Requested by Host: pastelink.net URL: https://pastelink.net/assets/css/styles.css?q=15 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash 736e1679b341206c435156f566998d48ad309ec22e277c12da51973bb42671c3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/assets/css/styles.css?q=15 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:13 GMT last-modified Thu, 27 May 2021 10:51:10 GMT server nginx etag "60af799e-e11" strict-transport-security max-age=31536000; includeSubDomains content-type image/png accept-ranges bytes content-length 3601
GET H2	200	pxiEyp8kv8JHgFVrJJfecg.woff2 fonts.gstatic.com/s/poppins/v15/	8 KB 8 KB	98ms 62ms	Font font/woff2	142.250.181.227 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfecg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.181.227 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s56-in-f3.1e100.net Software sffe / Resource Hash 41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://pastelink.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 21 Oct 2021 16:15:59 GMT x-content-type-options nosniff age 554594 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 7900 x-xss-protection 0 last-modified Thu, 05 Nov 2020 22:02:01 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Fri, 21 Oct 2022 16:15:59 GMT
GET H2	200	JTURjIg1_i6t8kCHKm45_bZF3gnD_g.woff2 fonts.gstatic.com/s/montserrat/v18/	19 KB 19 KB	97ms 61ms	Font font/woff2	142.250.181.227 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_bZF3gnD_g.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.181.227 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s56-in-f3.1e100.net Software sffe / Resource Hash 61519deaa156f24ad28ae848179016c7cc741270cb7b30043c24bd30203bdaf3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://pastelink.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 21 Oct 2021 05:17:07 GMT x-content-type-options nosniff age 594126 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 19824 x-xss-protection 0 last-modified Tue, 10 Aug 2021 00:20:37 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Fri, 21 Oct 2022 05:17:07 GMT
GET H2	200	pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 fonts.gstatic.com/s/poppins/v15/	8 KB 8 KB	96ms 60ms	Font font/woff2	142.250.181.227 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.181.227 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s56-in-f3.1e100.net Software sffe / Resource Hash d7ba57e3ccc2e3b2bdf8cc9e613194b802607682bf473293c2e3e29de82c9491 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://pastelink.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 26 Oct 2021 17:53:46 GMT x-content-type-options nosniff age 116727 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 7776 x-xss-protection 0 last-modified Thu, 05 Nov 2020 22:01:55 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 26 Oct 2022 17:53:46 GMT
GET H2	200	pxiEyp8kv8JHgFVrJJnecmNE.woff2 fonts.gstatic.com/s/poppins/v15/	5 KB 5 KB	63ms 62ms	Font font/woff2	142.250.181.227 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJnecmNE.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.181.227 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s56-in-f3.1e100.net Software sffe / Resource Hash 738cb7aba1703ee4705776436452858e9832ef81847f0f646ed83949c7763c53 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://pastelink.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 27 Oct 2021 13:23:32 GMT x-content-type-options nosniff age 46541 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5504 x-xss-protection 0 last-modified Thu, 05 Nov 2020 22:01:18 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Thu, 27 Oct 2022 13:23:32 GMT
GET H/1.1	200 OK	/ Show response pro.ip-api.com/csv/	6 B 154 B	196ms 7ms	XHR text/plain	51.77.64.70 OVH
General Check archive.org Show headers Download Go to Full URL https://pro.ip-api.com/csv/?key=ZxSSLwZtxrKxQbv&fields=countryCode,region Requested by Host: cdn.adligature.com URL: https://cdn.adligature.com/rules.js/advally-4.9.1.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.77.64.70 , Germany, ASN16276 (OVH, FR), Reverse DNS de-fra-1.pro.ip-api.com Software / Resource Hash 70eed4ae4f6f16678d18c5a3ffe7fa5ce9fc9595f16dcb1b8f730284d59d7a9d Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Thu, 28 Oct 2021 02:19:13 GMT Content-Length 6 Content-Type text/plain; charset=utf-8
GET H2	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/	80 KB 27 KB	223ms 32ms	Script text/javascript	142.250.186.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: cdn.adligature.com URL: https://cdn.adligature.com/rules.js/advally-4.9.1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f2.1e100.net Software sffe / Resource Hash 211a5a343b02d9b2f3ff3369230ac2185935f204b143f57ea15643b56650b2a8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:13 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1026 / 124 of 1000 / last-modified: 1635372525" vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 27214 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Thu, 28 Oct 2021 02:19:13 GMT
GET H3	200	prebid-4.43.4.js Show response cdn.adligature.com/prebid/	444 KB 133 KB	35ms 35ms	Script application/javascript	104.21.93.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.adligature.com/prebid/prebid-4.43.4.js Requested by Host: cdn.adligature.com URL: https://cdn.adligature.com/rules.js/advally-4.9.1.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.93.14 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4acafe4daf8d989eec849bdd8c025b2cda63bd1c3a91edaea56f948d04fd98a8 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-goog-hash crc32c=msxAWQ==, md5=z5RQdZzuWEiAct3OzqDEfQ== date Thu, 28 Oct 2021 02:19:13 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 438 cf-polished origSize=454478 x-guploader-uploadid ADPycdvsIKlaNHxVnvcFCwDeyEO7zCp5Rk5IOgcJhxA1w4Wp_Mge020zeAp216jSsOj_bbgNh9NtVuXOrbI8JYpCzZY x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Thu, 30 Sep 2021 13:07:25 GMT server cloudflare etag W/"cf9450759cee58488072ddcecea0c47d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AgW8rHsO0gQcIHQVCa%2BxrLzaZcELe5bi44%2FdMeAab8PDFa%2F6MUmCcdpnVRcGidd9hIosBLcOC36JPtbUORC%2Fb6cfyzcWEMFZLdBXminuGFKILfoyfxHDDMpo1KNrKz6hGIbjV34%3D"}],"group":"cf-nel","max_age":604800} content-language en x-goog-generation 1629807426503184 content-type application/javascript expires Thu, 28 Oct 2021 02:21:55 GMT cache-control public, max-age=1800, s-maxage=600, must-revalidate x-goog-stored-content-length 454478 cf-ray 6a50ad91faa23316-CDG cf-bgj minify
GET H3	200	js Show response www.googletagmanager.com/gtag/	125 KB 48 KB	46ms 22ms	Script application/javascript	142.250.186.168 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.168 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f8.1e100.net Software Google Tag Manager / Resource Hash 1e8336c00ae7a4fa65b35ce0243b9bedd5ae17a5b225f86f89acdf197e91bcca Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:13 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 49569 x-xss-protection 0 expires Thu, 28 Oct 2021 02:19:13 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	48 KB 20 KB	140ms 14ms	Script text/javascript	142.250.186.46 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.46 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f14.1e100.net Software Golfe2 / Resource Hash fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Tue, 26 Oct 2021 23:24:02 GMT server Golfe2 age 1087 date Thu, 28 Oct 2021 02:01:06 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19747 expires Thu, 28 Oct 2021 04:01:06 GMT
POST H3	204	collect www.google-analytics.com/g/	0 17 B	46ms 23ms	Ping text/plain	142.250.186.46 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/g/collect?v=2&tid=G-S3DKHVPF03&gtm=2oear0&_p=325787796&sr=1600x1200&ul=en-us&cid=1204619577.1635387554&_s=1&dl=https%3A%2F%2Fpastelink.net%2Fwaai4u9e&dt=Moja%20Gra%20Z%20Rakiem%20-%20Fundacja%20Urszuli%20Jaworskiej%20-%20Pastelink.net&sid=1635387553&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.46 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f14.1e100.net Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://pastelink.net/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Thu, 28 Oct 2021 02:19:13 GMT server Golfe2 content-type text/plain access-control-allow-origin https://pastelink.net cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3	200	collect Show response www.google-analytics.com/j/	1 B 21 B	21ms 21ms	XHR text/plain	142.250.186.46 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j93&a=325787796&t=pageview&_s=1&dl=https%3A%2F%2Fpastelink.net%2Fwaai4u9e&ul=en-us&de=UTF-8&dt=Moja%20Gra%20Z%20Rakiem%20-%20Fundacja%20Urszuli%20Jaworskiej%20-%20Pastelink.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAAC~&jid=1202507240&gjid=1822502167&cid=1204619577.1635387554&tid=UA-55088947-2&_gid=547516389.1635387554&_r=1&gtm=2wgar055WHPWQ&z=2110909521 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.46 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f14.1e100.net Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://pastelink.net/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 28 Oct 2021 02:19:13 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://pastelink.net cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	pubads_impl_2021102101.js Show response securepubads.g.doubleclick.net/gpt/	356 KB 120 KB	44ms 21ms	Script text/javascript	142.250.186.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102101.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f2.1e100.net Software sffe / Resource Hash 7746c1c5183c0461a0296140659b9c16d75cc4b274861ff009585bc1a0fc7142 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:13 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 122596 x-xss-protection 0 last-modified Thu, 21 Oct 2021 08:35:50 GMT server sffe vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Thu, 28 Oct 2021 02:19:13 GMT
GET H3	200	ppub_config Show response securepubads.g.doubleclick.net/pagead/	70 B 97 B	49ms 25ms	XHR application/json	142.250.186.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=pastelink.net Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f2.1e100.net Software cafe / Resource Hash 39c0b8be3e2bd4ecc61b4a789ac1e94d6a6812a15499181634db22e64fe7221c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Thu, 28 Oct 2021 02:19:13 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private, max-age=3600, stale-while-revalidate=3600 cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 72 x-xss-protection 0 expires Thu, 28 Oct 2021 02:19:13 GMT
POST H3	200	collect Show response www.google-analytics.com/j/	2 B 22 B	21ms 21ms	XHR text/plain	142.250.186.46 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j93&aip=1&a=325787796&t=pageview&_s=1&dl=https%3A%2F%2Fpastelink.net%2Fwaai4u9e&ul=en-us&de=UTF-8&dt=Moja%20Gra%20Z%20Rakiem%20-%20Fundacja%20Urszuli%20Jaworskiej%20-%20Pastelink.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABAAAAAC~&jid=1995218406&gjid=963105746&cid=1204619577.1635387554&tid=UA-197326395-9&_gid=547516389.1635387554&_r=1&_slc=1&z=2053767251 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.46 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f14.1e100.net Software Golfe2 / Resource Hash a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://pastelink.net/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 28 Oct 2021 02:19:13 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://pastelink.net cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET DATA	200 OK	truncated /	346 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ebd635d843d43673dd737988e3383b01614cfca991785e481a47e7bd6b8aea17 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H2	200	integrator.js Show response adservice.google.de/adsid/	107 B 716 B	58ms 22ms	Script application/javascript	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=pastelink.net Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102101.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Thu, 28 Oct 2021 02:19:14 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 100 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	107 B 549 B	64ms 23ms	Script application/javascript	142.250.186.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=pastelink.net Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102101.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.34 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f2.1e100.net Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Thu, 28 Oct 2021 02:19:14 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	21 KB 8 KB	463ms 462ms	XHR text/plain	142.250.186.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1362675921115811&correlator=3207115677029356&output=ldjh&impl=fifs&eid=31061814%2C31063280%2C31062931&vrg=2021102101&ptt=17&sc=1&sfv=1-0-38&ecs=20211028&iu_parts=22405481091%2Cpastelink.net%2CBottom_adhesion_banner%2CTop_leaderboard%2CInline_banner%2CSidebar_MPU&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5&prev_iu_szs=728x90%2C728x90%2C728x90%2C728x90%2C728x90%2C160x600&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1635387553&dt=1635387553993&dlt=1635387553296&idt=615&frm=20&biw=1600&bih=1200&oid=2&adxs=436%2C246%2C281%2C281%2C281%2C1119&adys=1104%2C291%2C730%2C1213%2C1650%2C372&adks=3402602959%2C2883060502%2C4220404771%2C4220404772%2C4220404773%2C2108190548&ucis=1%7C2%7C3%7C4%7C5%7C6&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fpastelink.net%2Fwaai4u9e&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x-1%7C797x237%7C757x90%7C757x90%7C757x90%7C197x652&msz=728x-1%7C797x-1%7C728x-1%7C728x-1%7C728x-1%7C160x-1&ga_vid=1204619577.1635387554&ga_sid=1635387554&ga_hid=325787796&ga_fc=true&fws=516%2C4%2C4%2C4%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600&btvi=0%7C0%7C0%7C1%7C2%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102101.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f2.1e100.net Software cafe / Resource Hash ea09d9ae0109e2bd7220d5a681433bf86b0a0785d3205d2f0dfea2716f0490b5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:14 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2,-2,-2,-2,-2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 8460 x-xss-protection 0 google-lineitem-id -1,-2,-2,-2,-2,-2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -1,-2,-2,-2,-2,-2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://pastelink.net cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html Show response 548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 86B1	6 KB 4 KB	77ms 24ms	Document text/html	142.250.185.65 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102101.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.65 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f1.1e100.net Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Thu, 28 Oct 2021 02:19:14 GMT expires Fri, 28 Oct 2022 02:19:14 GMT cache-control public, immutable, max-age=31536000 last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	container.html Show response 548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9B3E	6 KB 3 KB	35ms 14ms	Document text/html	142.250.185.65 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102101.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.65 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f1.1e100.net Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Thu, 28 Oct 2021 02:19:14 GMT expires Fri, 28 Oct 2022 02:19:14 GMT last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	sodar Show response pagead2.googlesyndication.com/getconfig/	11 KB 9 KB	65ms 26ms	XHR application/json	142.250.184.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021102101&st=env Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102101.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f2.1e100.net Software cafe / Resource Hash 8d091ab0f392e2dda8e8a41ffcfb7f3cffc90db1831fe4f7f8e03a81ef16f5da Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Thu, 28 Oct 2021 02:19:14 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8542 x-xss-protection 0
GET H3	200	adview securepubads.g.doubleclick.net/pagead/ Frame 9B3E	0 0	26ms 25ms	Fetch text/html	142.250.186.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=Cf45hogh6YcWzB-WEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa_m5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE5wFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5_OG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ-_uXfPR-GGE-cPW30uxR13Pc-PsnQqLMh_ElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj-TH4vuhaqGfX9ZsjyN7_p4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ_9JlH7lh_BcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98fefd8wuupfftKe7AUfBqyRLiTgBAGABtPgp7-2x_mm8QGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAYAKAfoLAggBgAwB0BUBgBcBshccChoSFHB1Yi0xNzUwODU2MjM5MjA0NDE0GPrefA&sigh=jZUlHGymCHo&uach_m=[UACH]&cid=CAQSPwCNIrLMeEifffXuLbEDs_6Ws7RTw0UlHhzrv4JrGv29R5pIMl5brrxLJDcLoGCxPWrMqTsp4H8lwfR9skCaaBgB Requested by Host: pastelink.net URL: https://pastelink.net/waai4u9e Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f2.1e100.net Software / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H/1.1	200 OK	creative Show response tracking.m6r.eu/impression/ Frame 9B3E Redirect Chain https://tracking.m6r.eu/impression/creative?format=script&creativeLinkId=3a409b33-9722-457b-bdd8-f183f681d04d&id=adx-auction%3A617a08a20002f8bd078382b90009ced3&adxPrice=YXoIogAB2cUHg4JlAAvGH4rEEUo3... https://tracking.m6r.eu/impression/creative?format=script&creativeLinkId=3a409b33-9722-457b-bdd8-f183f681d04d&id=adx-auction%3A617a08a20002f8bd078382b90009ced3&adxPrice=YXoIogAB2cUHg4JlAAvGH4rEEUo3...	3 KB 2 KB	59ms 25ms	Script text/javascript	72.251.244.140 VOXEL-DOT-NET
General Check archive.org Show headers Download Go to Full URL https://tracking.m6r.eu/impression/creative?format=script&creativeLinkId=3a409b33-9722-457b-bdd8-f183f681d04d&id=adx-auction%3A617a08a20002f8bd078382b90009ced3&adxPrice=YXoIogAB2cUHg4JlAAvGH4rEEUo351j3pZyU-g&sync=adx&target=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCOXzRogh6YcWzB-WEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa_m5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5_OG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ-_uXfPR-GGE-cPW30uxR13Pc-PsnQqLMh_ElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj-TH4vuhaqGfX9ZsjyN7_p4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ_9JlH7lh_BcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7-2x_mm8QGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3GoaFhf2aWgpRlsirYbklC4nscKw%26client%3Dca-pub-1750856239204414%26adurl%3D&checkcookies=true Requested by Host: 548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com URL: https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol HTTP/1.1 Server 72.251.244.140 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US), Reverse DNS Software nginx / Resource Hash d466ce478aad6267abcc09d77b990f36a848ec6344dd919c3a4714557d2c7a1e Request headers Accept-Language de-DE,de;q=0.9 Referer https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 28 Oct 2021 02:19:14 GMT Content-Encoding gzip Server nginx Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Transfer-Encoding chunked Connection close Content-Type text/javascript; charset=utf-8 Redirect headers Location https://tracking.m6r.eu/impression/creative?format=script&creativeLinkId=3a409b33-9722-457b-bdd8-f183f681d04d&id=adx-auction%3A617a08a20002f8bd078382b90009ced3&adxPrice=YXoIogAB2cUHg4JlAAvGH4rEEUo351j3pZyU-g&sync=adx&target=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCOXzRogh6YcWzB-WEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa_m5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5_OG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ-_uXfPR-GGE-cPW30uxR13Pc-PsnQqLMh_ElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj-TH4vuhaqGfX9ZsjyN7_p4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ_9JlH7lh_BcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7-2x_mm8QGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3GoaFhf2aWgpRlsirYbklC4nscKw%26client%3Dca-pub-1750856239204414%26adurl%3D&checkcookies=true Date Thu, 28 Oct 2021 02:19:14 GMT Server nginx Connection close Content-Length 963 Vary Accept Content-Type text/plain; charset=utf-8
GET H2	200	window_focus_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame 9B3E	3 KB 1 KB	65ms 28ms	Script text/javascript	142.250.184.193 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/window_focus_fy2019.js Requested by Host: 548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com URL: https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.193 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f1.1e100.net Software cafe / Resource Hash 0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:05:16 GMT content-encoding gzip x-content-type-options nosniff age 838 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1426 x-xss-protection 0 server cafe etag 18061233391346882222 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Thu, 11 Nov 2021 02:05:16 GMT
GET H2	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame 9B3E	120 KB 37 KB	70ms 32ms	Script text/javascript	142.250.185.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: 548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com URL: https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s52-in-f2.1e100.net Software sffe / Resource Hash eaaa6059ef4c9ca12e78fcc03ae77ad4cbf05dc73c1fedf64b28a632868bd829 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:14 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 37344 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1635161763799786" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Thu, 28 Oct 2021 02:19:14 GMT
GET H2	200	qs_click_protection_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame 9B3E	14 KB 7 KB	53ms 16ms	Script text/javascript	142.250.184.193 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/qs_click_protection_fy2019.js Requested by Host: 548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com URL: https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.193 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f1.1e100.net Software cafe / Resource Hash 2698e1ed89c87280fe92182e5297140eda834b052703156646719cd5e90fc29a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 01:42:12 GMT content-encoding gzip x-content-type-options nosniff age 2222 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6286 x-xss-protection 0 server cafe etag 17196531676875957370 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Thu, 11 Nov 2021 01:42:12 GMT
GET H3	204	l www.google.com/ads/measurement/ Frame 9B3E	0 0	52ms 21ms	Image text/html	142.250.186.164 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaRbk3asPg1aW1Fqi3O57QEBoTuXIc5OD_MHAsxsCkgej7J2JO4hAxJ6m5nInILdDSPiifJ2ZV3HEek3AYfBUqLRGviAVg Requested by Host: 548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com URL: https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.164 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f4.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H2	200	ext.js Show response tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 9B3E	22 KB 7 KB	55ms 19ms	Script text/javascript	142.250.184.193 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js Requested by Host: 548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com URL: https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.193 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f1.1e100.net Software sffe / Resource Hash 0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 27 Oct 2021 14:26:01 GMT content-encoding gzip x-content-type-options nosniff age 42793 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7022 x-xss-protection 0 last-modified Tue, 02 Mar 2021 20:17:03 GMT server sffe vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control public, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Thu, 27 Oct 2022 14:26:01 GMT
GET H2	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	17 KB 7 KB	42ms 29ms	Script text/javascript	142.250.184.193 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102101.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.193 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f1.1e100.net Software sffe / Resource Hash a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:14 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1624308425655142" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6467 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" expires Thu, 28 Oct 2021 02:19:14 GMT
GET H3	200	runner.html Show response tpc.googlesyndication.com/sodar/sodar2/224/ Frame 93A5	12 KB 5 KB	37ms 14ms	Document text/html	142.250.184.193 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.193 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f1.1e100.net Software sffe / Resource Hash 4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-length 5029 date Wed, 27 Oct 2021 19:14:26 GMT expires Thu, 27 Oct 2022 19:14:26 GMT last-modified Wed, 02 Jun 2021 17:09:45 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 25488 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	aframe Show response www.google.com/recaptcha/api2/ Frame 24F3	783 B 534 B	23ms 23ms	Document text/html	142.250.186.164 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/aframe Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.164 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f4.1e100.net Software GSE / Resource Hash 761fcdb8fc76649627b2bfe9ea5d9cbc741c5a0ee9743973655785ea20692f30 Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-ZfDkGG2/hDtuifkv3UDHiA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ Response headers cross-origin-resource-policy cross-origin cross-origin-embedder-policy require-corp report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} expires Thu, 28 Oct 2021 02:19:14 GMT date Thu, 28 Oct 2021 02:19:14 GMT cache-control private, max-age=300 content-type text/html; charset=utf-8 content-security-policy script-src 'report-sample' 'nonce-ZfDkGG2/hDtuifkv3UDHiA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-encoding gzip x-content-type-options nosniff x-xss-protection 1; mode=block content-length 512 server GSE alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
GET DATA	200 OK	truncated / Frame 9B3E	212 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f40551880674cc6c52c6cf411ce21fbf19c0a5b6c364a27ccc5b0420b449a939 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H2	200	adition.js Show response imagesrv.adition.com/js/ Frame 1429	32 KB 8 KB	52ms 19ms	Script application/javascript	217.79.188.11 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://imagesrv.adition.com/js/adition.js Requested by Host: tracking.m6r.eu URL: https://tracking.m6r.eu/impression/creative?format=script&creativeLinkId=3a409b33-9722-457b-bdd8-f183f681d04d&id=adx-auction%3A617a08a20002f8bd078382b90009ced3&adxPrice=YXoIogAB2cUHg4JlAAvGH4rEEUo351j3pZyU-g&sync=adx&target=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCOXzRogh6YcWzB-WEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa_m5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5_OG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ-_uXfPR-GGE-cPW30uxR13Pc-PsnQqLMh_ElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj-TH4vuhaqGfX9ZsjyN7_p4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ_9JlH7lh_BcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7-2x_mm8QGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3GoaFhf2aWgpRlsirYbklC4nscKw%26client%3Dca-pub-1750856239204414%26adurl%3D Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.79.188.11 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS imagesrv.adition.com Software / Resource Hash 70e0a3b2c82384039a2e4b31c305c9ef1f72a59b585acad421c54a6101a25237 Request headers Accept-Language de-DE,de;q=0.9 Referer https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:14 GMT content-encoding br last-modified Thu, 21 Oct 2021 06:32:42 GMT etag "4043560335-br" vary Accept-Encoding content-type application/javascript access-control-allow-origin * accept-ranges bytes content-length 8355
GET H2	200	js Show response ad3.adfarm1.adition.com/ Frame 1429	2 KB 2 KB	49ms 12ms	Script application/x-javascript	217.79.188.9 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://ad3.adfarm1.adition.com/js?wp_id=4662861&gdpr=&gdpr_consent=&kid=4646472&clickurl=https://adclick.g.doubleclick.net/aclk?sa=L&ai=COXzRogh6YcWzB-WEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa_m5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5_OG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ-_uXfPR-GGE-cPW30uxR13Pc-PsnQqLMh_ElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj-TH4vuhaqGfX9ZsjyN7_p4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ_9JlH7lh_BcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7-2x_mm8QGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB&num=1&sig=AOD64_3GoaFhf2aWgpRlsirYbklC4nscKw&client=ca-pub-1750856239204414&adurl=https%3A%2F%2Ftracking.m6r.eu%2Fclick%2Fredirect%2Fslashed%2Fid%3Dadx-auction%253A617a08a20002f8bd078382b90009ced3%2Ftimestamp%3D1635387554740%2Ftarget%3D Requested by Host: tracking.m6r.eu URL: https://tracking.m6r.eu/impression/creative?format=script&creativeLinkId=3a409b33-9722-457b-bdd8-f183f681d04d&id=adx-auction%3A617a08a20002f8bd078382b90009ced3&adxPrice=YXoIogAB2cUHg4JlAAvGH4rEEUo351j3pZyU-g&sync=adx&target=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCOXzRogh6YcWzB-WEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa_m5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5_OG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ-_uXfPR-GGE-cPW30uxR13Pc-PsnQqLMh_ElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj-TH4vuhaqGfX9ZsjyN7_p4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ_9JlH7lh_BcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7-2x_mm8QGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3GoaFhf2aWgpRlsirYbklC4nscKw%26client%3Dca-pub-1750856239204414%26adurl%3D Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 217.79.188.9 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS ad3.adfarm1.adition.com Software ADITIONSERVER v1.0 / Resource Hash 00e1cd96f36d2782781306a6b407db8c407857f4900d01dae1d6880426f72e7f Request headers Accept-Language de-DE,de;q=0.9 Referer https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 04:19:14 +0200 content-encoding gzip content-type application/x-javascript server ADITIONSERVER v1.0 cache-control max-age=600 p3p policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI" expires Sat, 01 Jan 2000 00:00:00 GMT
GET H3	204	sodar pagead2.googlesyndication.com/pagead/ Frame 24F3	0 0	87ms 66ms	Image text/html	142.250.184.226 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021102101&jk=1362675921115811&rc= Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H3	200	DIeR_ChadNgTBsCXk9stWB0bjB2ydD9ZwSTjhZMF6xA.js Show response pagead2.googlesyndication.com/bg/ Frame 93A5	35 KB 13 KB	30ms 13ms	Script text/javascript	142.250.184.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/DIeR_ChadNgTBsCXk9stWB0bjB2ydD9ZwSTjhZMF6xA.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f2.1e100.net Software sffe / Resource Hash 0c8791fc285a74d81306c09793db2d581d1b8c1db2743f59c124e3859305eb10 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 27 Oct 2021 19:42:53 GMT content-encoding br x-content-type-options nosniff age 23781 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13408 x-xss-protection 0 last-modified Tue, 19 Oct 2021 13:08:00 GMT server sffe vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="botguard-scs" expires Thu, 27 Oct 2022 19:42:53 GMT
GET H2	200	banner Show response ad3.adfarm1.adition.com/ Frame 1429	6 KB 3 KB	17ms 17ms	Script text/javascript	217.79.188.9 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://ad3.adfarm1.adition.com/banner?sid=4662861&adjsver=3&fvers=&iframe=1&ref=&ro=https%3A//548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html&uao=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/89.0.4389.72%20Safari/537.36&os=17&browser=11&userid=0&kid=4646472&screen_res=6&wpt=J&clickurl=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCOXzRogh6YcWzB%2DWEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa%5Fm5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5%5FOG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ%2D%5FuXfPR%2DGGE%2DcPW30uxR13Pc%2DPsnQqLMh%5FElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj%2DTH4vuhaqGfX9ZsjyN7%5Fp4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ%5F9JlH7lh%5FBcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7%2D2x%5Fmm8QGgBiGoB6a%2DG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64%5F3GoaFhf2aWgpRlsirYbklC4nscKw%26client%3Dca%2Dpub%2D1750856239204414%26adurl%3Dhttps%3A%2F%2Ftracking.m6r.eu%2Fclick%2Fredirect%2Fslashed%2Fid%3Dadx%2Dauction%253A617a08a20002f8bd078382b90009ced3%2Ftimestamp%3D1635387554740%2Ftarget%3D Requested by Host: ad3.adfarm1.adition.com URL: https://ad3.adfarm1.adition.com/js?wp_id=4662861&gdpr=&gdpr_consent=&kid=4646472&clickurl=https://adclick.g.doubleclick.net/aclk?sa=L&ai=COXzRogh6YcWzB-WEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa_m5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5_OG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ-_uXfPR-GGE-cPW30uxR13Pc-PsnQqLMh_ElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj-TH4vuhaqGfX9ZsjyN7_p4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ_9JlH7lh_BcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7-2x_mm8QGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB&num=1&sig=AOD64_3GoaFhf2aWgpRlsirYbklC4nscKw&client=ca-pub-1750856239204414&adurl=https%3A%2F%2Ftracking.m6r.eu%2Fclick%2Fredirect%2Fslashed%2Fid%3Dadx-auction%253A617a08a20002f8bd078382b90009ced3%2Ftimestamp%3D1635387554740%2Ftarget%3D Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 217.79.188.9 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS ad3.adfarm1.adition.com Software ADITIONSERVER v1.0 / Resource Hash 73f4c7bfb688860958f546cb07b754a75143994e99f6f66d164813528e255e3e Request headers Accept-Language de-DE,de;q=0.9 Referer https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Thu, 28 Oct 2021 04:19:14 +0200 content-encoding gzip server ADITIONSERVER v1.0 p3p policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI" cache-control no-cache content-type text/javascript expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	index.html Show response imagesrv.adition.com/banners/250/00/db/47/ec/ Frame C973	2 KB 589 B	13ms 13ms	Document text/html	217.79.188.11 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://imagesrv.adition.com/banners/250/00/db/47/ec/index.html?clicktag=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCOXzRogh6YcWzB%2DWEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa%5Fm5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5%5FOG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ%2D%5FuXfPR%2DGGE%2DcPW30uxR13Pc%2DPsnQqLMh%5FElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj%2DTH4vuhaqGfX9ZsjyN7%5Fp4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ%5F9JlH7lh%5FBcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7%2D2x%5Fmm8QGgBiGoB6a%2DG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64%5F3GoaFhf2aWgpRlsirYbklC4nscKw%26client%3Dca%2Dpub%2D1750856239204414%26adurl%3Dhttps%3A%2F%2Ftracking.m6r.eu%2Fclick%2Fredirect%2Fslashed%2Fid%3Dadx%2Dauction%253A617a08a20002f8bd078382b90009ced3%2Ftimestamp%3D1635387554740%2Ftarget%3Dhttps%253A%252F%252Fad3.adfarm1.adition.com%252Fredi%253Flid%253D7023936060718646492%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7023936060717663451%2526sid%253D4662861%2526kid%253D4646472%2526bid%253D14370796%2526c%253D29498%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D Requested by Host: pastelink.net URL: https://pastelink.net/waai4u9e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.79.188.11 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS imagesrv.adition.com Software / Resource Hash b0223d98eb5ae7a686106d976380c98b4452687e7a1f328a24c7c252c7a3c173 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/ Response headers content-type text/html accept-ranges bytes etag "1341006051-br" last-modified Thu, 26 Aug 2021 12:58:24 GMT content-length 504 access-control-allow-origin * vary Accept-Encoding content-encoding br date Thu, 28 Oct 2021 02:19:14 GMT
GET H/1.1	200 OK	adxSyncDone tracking.m6r.eu/sync/ Frame 1429 Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=0vxKNUD09mYh8gdZ-XkP4w& https://tracking.m6r.eu/sync/adxSyncDone?gdprFallback=true&google_ula=158217889,0	44 B 413 B	83ms 30ms	Image image/gif	72.251.244.140 VOXEL-DOT-NET
General Check archive.org Show headers Download Go to Show image Full URL https://tracking.m6r.eu/sync/adxSyncDone?gdprFallback=true&google_ula=158217889,0 Requested by Host: 548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com URL: https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol HTTP/1.1 Server 72.251.244.140 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US), Reverse DNS Software nginx / Resource Hash 821e2efd660f6b759d561cd5cd194670e51ecebcbc06055cdcbebcd91ec94a56 Request headers Accept-Language de-DE,de;q=0.9 Referer https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 28 Oct 2021 02:19:15 GMT cache-control no-cache Server nginx Connection close Content-Type image/gif Content-Length 44 P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Redirect headers pragma no-cache date Thu, 28 Oct 2021 02:19:14 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://tracking.m6r.eu/sync/adxSyncDone?gdprFallback=true&google_ula=158217889,0 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 282 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	AditionH5_ClickTags.js Show response imagesrv.adition.com/js/ Frame C973	753 B 407 B	11ms 10ms	Script application/javascript	217.79.188.11 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://imagesrv.adition.com/js/AditionH5_ClickTags.js Requested by Host: imagesrv.adition.com URL: https://imagesrv.adition.com/banners/250/00/db/47/ec/index.html?clicktag=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCOXzRogh6YcWzB%2DWEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa%5Fm5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5%5FOG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ%2D%5FuXfPR%2DGGE%2DcPW30uxR13Pc%2DPsnQqLMh%5FElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj%2DTH4vuhaqGfX9ZsjyN7%5Fp4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ%5F9JlH7lh%5FBcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7%2D2x%5Fmm8QGgBiGoB6a%2DG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64%5F3GoaFhf2aWgpRlsirYbklC4nscKw%26client%3Dca%2Dpub%2D1750856239204414%26adurl%3Dhttps%3A%2F%2Ftracking.m6r.eu%2Fclick%2Fredirect%2Fslashed%2Fid%3Dadx%2Dauction%253A617a08a20002f8bd078382b90009ced3%2Ftimestamp%3D1635387554740%2Ftarget%3Dhttps%253A%252F%252Fad3.adfarm1.adition.com%252Fredi%253Flid%253D7023936060718646492%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7023936060717663451%2526sid%253D4662861%2526kid%253D4646472%2526bid%253D14370796%2526c%253D29498%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.79.188.11 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS imagesrv.adition.com Software / Resource Hash 5a0cecf509251de7b796c7c34ca1374bbb3fabe582e9e9394f1a1ebd9d421997 Request headers Accept-Language de-DE,de;q=0.9 Referer https://imagesrv.adition.com/banners/250/00/db/47/ec/index.html?clicktag=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCOXzRogh6YcWzB%2DWEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa%5Fm5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5%5FOG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ%2D%5FuXfPR%2DGGE%2DcPW30uxR13Pc%2DPsnQqLMh%5FElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj%2DTH4vuhaqGfX9ZsjyN7%5Fp4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ%5F9JlH7lh%5FBcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7%2D2x%5Fmm8QGgBiGoB6a%2DG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64%5F3GoaFhf2aWgpRlsirYbklC4nscKw%26client%3Dca%2Dpub%2D1750856239204414%26adurl%3Dhttps%3A%2F%2Ftracking.m6r.eu%2Fclick%2Fredirect%2Fslashed%2Fid%3Dadx%2Dauction%253A617a08a20002f8bd078382b90009ced3%2Ftimestamp%3D1635387554740%2Ftarget%3Dhttps%253A%252F%252Fad3.adfarm1.adition.com%252Fredi%253Flid%253D7023936060718646492%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7023936060717663451%2526sid%253D4662861%2526kid%253D4646472%2526bid%253D14370796%2526c%253D29498%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:14 GMT content-encoding br last-modified Thu, 20 Aug 2020 14:03:40 GMT etag "1134380014-br" vary Accept-Encoding content-type application/javascript access-control-allow-origin * accept-ranges bytes content-length 330
GET H2	200	style.css imagesrv.adition.com/banners/250/00/db/47/ec/css/ Frame C973	7 KB 1 KB	12ms 11ms	Stylesheet text/css	217.79.188.11 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://imagesrv.adition.com/banners/250/00/db/47/ec/css/style.css Requested by Host: imagesrv.adition.com URL: https://imagesrv.adition.com/banners/250/00/db/47/ec/index.html?clicktag=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCOXzRogh6YcWzB%2DWEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa%5Fm5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5%5FOG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ%2D%5FuXfPR%2DGGE%2DcPW30uxR13Pc%2DPsnQqLMh%5FElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj%2DTH4vuhaqGfX9ZsjyN7%5Fp4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ%5F9JlH7lh%5FBcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7%2D2x%5Fmm8QGgBiGoB6a%2DG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64%5F3GoaFhf2aWgpRlsirYbklC4nscKw%26client%3Dca%2Dpub%2D1750856239204414%26adurl%3Dhttps%3A%2F%2Ftracking.m6r.eu%2Fclick%2Fredirect%2Fslashed%2Fid%3Dadx%2Dauction%253A617a08a20002f8bd078382b90009ced3%2Ftimestamp%3D1635387554740%2Ftarget%3Dhttps%253A%252F%252Fad3.adfarm1.adition.com%252Fredi%253Flid%253D7023936060718646492%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7023936060717663451%2526sid%253D4662861%2526kid%253D4646472%2526bid%253D14370796%2526c%253D29498%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.79.188.11 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS imagesrv.adition.com Software / Resource Hash 9d9bd378e2d4e78eaf3f8b4bf3c1bda31c6fb5849b2f676ba580a204ec27cef4 Request headers Accept-Language de-DE,de;q=0.9 Referer https://imagesrv.adition.com/banners/250/00/db/47/ec/index.html?clicktag=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCOXzRogh6YcWzB%2DWEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa%5Fm5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5%5FOG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ%2D%5FuXfPR%2DGGE%2DcPW30uxR13Pc%2DPsnQqLMh%5FElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj%2DTH4vuhaqGfX9ZsjyN7%5Fp4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ%5F9JlH7lh%5FBcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7%2D2x%5Fmm8QGgBiGoB6a%2DG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64%5F3GoaFhf2aWgpRlsirYbklC4nscKw%26client%3Dca%2Dpub%2D1750856239204414%26adurl%3Dhttps%3A%2F%2Ftracking.m6r.eu%2Fclick%2Fredirect%2Fslashed%2Fid%3Dadx%2Dauction%253A617a08a20002f8bd078382b90009ced3%2Ftimestamp%3D1635387554740%2Ftarget%3Dhttps%253A%252F%252Fad3.adfarm1.adition.com%252Fredi%253Flid%253D7023936060718646492%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7023936060717663451%2526sid%253D4662861%2526kid%253D4646472%2526bid%253D14370796%2526c%253D29498%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:14 GMT content-encoding br last-modified Thu, 26 Aug 2021 11:17:42 GMT etag "2170826662-br" vary Accept-Encoding content-type text/css access-control-allow-origin * accept-ranges bytes content-length 1341
GET H2	200	script.js Show response imagesrv.adition.com/banners/250/00/db/47/ec/js/ Frame C973	3 KB 538 B	13ms 13ms	Script application/javascript	217.79.188.11 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://imagesrv.adition.com/banners/250/00/db/47/ec/js/script.js Requested by Host: imagesrv.adition.com URL: https://imagesrv.adition.com/banners/250/00/db/47/ec/index.html?clicktag=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCOXzRogh6YcWzB%2DWEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa%5Fm5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5%5FOG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ%2D%5FuXfPR%2DGGE%2DcPW30uxR13Pc%2DPsnQqLMh%5FElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj%2DTH4vuhaqGfX9ZsjyN7%5Fp4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ%5F9JlH7lh%5FBcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7%2D2x%5Fmm8QGgBiGoB6a%2DG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64%5F3GoaFhf2aWgpRlsirYbklC4nscKw%26client%3Dca%2Dpub%2D1750856239204414%26adurl%3Dhttps%3A%2F%2Ftracking.m6r.eu%2Fclick%2Fredirect%2Fslashed%2Fid%3Dadx%2Dauction%253A617a08a20002f8bd078382b90009ced3%2Ftimestamp%3D1635387554740%2Ftarget%3Dhttps%253A%252F%252Fad3.adfarm1.adition.com%252Fredi%253Flid%253D7023936060718646492%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7023936060717663451%2526sid%253D4662861%2526kid%253D4646472%2526bid%253D14370796%2526c%253D29498%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.79.188.11 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS imagesrv.adition.com Software / Resource Hash 39eab8ade9638c54158b16d606cbf7d53065dc5e0dc5f115e469a0d70cb504ef Request headers Accept-Language de-DE,de;q=0.9 Referer https://imagesrv.adition.com/banners/250/00/db/47/ec/index.html?clicktag=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCOXzRogh6YcWzB%2DWEjuwPn4yvwAuSmZSNXMniuudZwI23ARABIABgleKQgqAHggEXY2EtcHViLTE3NTA4NTYyMzkyMDQ0MTSgAa%5Fm5tYDyAEJqQLDsLeF2XazPuACAKgDAaoE6gFP0FCThCO4YdUi2z28JoemNt2nLQu1ZbEWgn0qWE5%5FOG8nm3qwK0lQjscyJyCIPhz1VQ5P5ZMr8DbiVIuLgZ%2D%5FuXfPR%2DGGE%2DcPW30uxR13Pc%2DPsnQqLMh%5FElNhsIY43Q8w2qf7q8EVqps7hJrTmYK7PZOj1vdJ5Okj%2DTH4vuhaqGfX9ZsjyN7%5Fp4gKCDsUvzYHR2aasjpLEIL6THnV2sL4VQ%5F9JlH7lh%5FBcMFUlTc3L6Qbl1DrAVNMrNGa6epriTcuduyABqwIpWePrK2gWArsL0bK98ecf9KiQXf7DFI61cSGHmkgGjEPMwjgBAGABtPgp7%2D2x%5Fmm8QGgBiGoB6a%2DG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64%5F3GoaFhf2aWgpRlsirYbklC4nscKw%26client%3Dca%2Dpub%2D1750856239204414%26adurl%3Dhttps%3A%2F%2Ftracking.m6r.eu%2Fclick%2Fredirect%2Fslashed%2Fid%3Dadx%2Dauction%253A617a08a20002f8bd078382b90009ced3%2Ftimestamp%3D1635387554740%2Ftarget%3Dhttps%253A%252F%252Fad3.adfarm1.adition.com%252Fredi%253Flid%253D7023936060718646492%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7023936060717663451%2526sid%253D4662861%2526kid%253D4646472%2526bid%253D14370796%2526c%253D29498%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 28 Oct 2021 02:19:14 GMT content-encoding br last-modified Thu, 26 Aug 2021 11:17:42 GMT etag "1487416765-br" vary Accept-Encoding content-type application/javascript access-control-allow-origin * accept-ranges bytes content-length 482
GET H2	200	motiv.jpg imagesrv.adition.com/banners/250/00/db/47/ec/img/ Frame C973	19 KB 19 KB	13ms 12ms	Image image/jpeg	217.79.188.11 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Show image Full URL https://imagesrv.adition.com/banners/250/00/db/47/ec/img/motiv.jpg Requested by Host: imagesrv.adition.com URL: https://imagesrv.adition.com/banners/250/00/db/47/ec/css/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.79.188.11 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS imagesrv.adition.com Software / Resource Hash e02fb5b6d5a6b52b1914c13f1abfb7532e14a64164544d419e8097627c5b389a Request headers Accept-Language de-DE,de;q=0.9 Referer https://imagesrv.adition.com/banners/250/00/db/47/ec/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers access-control-allow-origin * date Thu, 28 Oct 2021 02:19:15 GMT last-modified Mon, 03 May 2021 08:59:36 GMT accept-ranges bytes etag "2058414223" content-length 19618 content-type image/jpeg
GET H2	200	karte.jpg imagesrv.adition.com/banners/250/00/db/47/ec/img/ Frame C973	9 KB 10 KB	23ms 22ms	Image image/jpeg	217.79.188.11 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Show image Full URL https://imagesrv.adition.com/banners/250/00/db/47/ec/img/karte.jpg Requested by Host: imagesrv.adition.com URL: https://imagesrv.adition.com/banners/250/00/db/47/ec/css/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.79.188.11 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS imagesrv.adition.com Software / Resource Hash 90b79c20f217402f727b4c902085edcc993b016551c771b1432027adec7112c0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://imagesrv.adition.com/banners/250/00/db/47/ec/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers access-control-allow-origin * date Thu, 28 Oct 2021 02:19:15 GMT last-modified Thu, 26 Aug 2021 11:17:42 GMT accept-ranges bytes etag "904654743" content-length 9658 content-type image/jpeg
GET H2	200	banner.png imagesrv.adition.com/banners/250/00/db/47/ec/img/ Frame C973	15 KB 15 KB	23ms 23ms	Image image/png	217.79.188.11 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Show image Full URL https://imagesrv.adition.com/banners/250/00/db/47/ec/img/banner.png Requested by Host: imagesrv.adition.com URL: https://imagesrv.adition.com/banners/250/00/db/47/ec/css/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.79.188.11 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS imagesrv.adition.com Software / Resource Hash 846815597bb4bcad6eeb0abbf9ec071af25445da725d8b6f496092c9f2870a7d Request headers Accept-Language de-DE,de;q=0.9 Referer https://imagesrv.adition.com/banners/250/00/db/47/ec/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers access-control-allow-origin * date Thu, 28 Oct 2021 02:19:15 GMT last-modified Thu, 26 Aug 2021 11:17:42 GMT accept-ranges bytes etag "501509011" content-length 15159 content-type image/png
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/	0 20 B	23ms 23ms	Image image/gif	142.250.184.226 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021102101&jk=1362675921115811&bg=!NTalNnLNAAbUs_yW1LM7ACkAdvg8WpLhLvsjWXNqix483r_CZWKEX03hCkH8i7Iq_JOyuVgrpv71uwIAAAChUgAAAAxoAQeZAnRPt13ycuetcXo7l7G0r01aYU6V0lTsZ-wsQwRdgmXk-ODBYFfeWR8Nsm_KQ91FQ55ervLtt8IT6Bywi1B3GqRjf0PoH_nvMhsjxdVYkc809H64hDLKF2Ucc-8ALptTRdtKIG316el3cFOrLzX6sREA1XkGdt8ghthAuzo7vhSp_-TX0KQ9j6qSkBBzgtElqmPQMGSTca16v7ROCQR0OPENTIj-aWRlGqnUhKLL4_0zC27_ImT3o2Bud5YMMJE2TjZrano-nprDxC65w6BbTayOYh4PrJ9wblQbb6Ie_hkJlu6RpwCijP01jHVJRuQZyd2NOaG-IbWNNuuNngSCuD1IYRNsKrwE24-Bin9M9qS-n6UQtocr3tlUhZBAV9-A-CEj7saBn-PfEmiF1Hld9jds0cj-ZgtFrdTOXayxvKiT2S_p1KD-3-LCceYDoL8WC0yCNEAe4YcSu6Z2dwfUBndOt5bE2eDj-InjNKvczybuXx2p66zaz2pD-qZt_IdBSQf4JOUBVQqZeGPOolMh6J7xLUAOQZo8KjgCQfC8MU9MlThrIA_yAt_KuA6wlDVHuNsf4egnCE9nTYCKhw5fS8gOjUhit2DnDNaxQ_DNuentEJYXtxvaBCbfMCwIgsLf5xKHtQKfZTu-LBPuv4YcViTb1nx--wudggPXaawubUhU2HUtxDH7mATE5CH-FQllbTu1cWyoiaEUxVh1LiFzM2uU7Ft5k9s0lYzWxRd7LaWsLWekSfAekmS7Af-1_4_ejdqsKpstzNBFV6RINvUvGTC3TA5mP-CCotWU4DGR4FBXL8hYr-Hj1KbDFZM_4lY7nWDY1vBp Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Thu, 28 Oct 2021 02:19:15 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	activeview Show response pagead2.googlesyndication.com/pcs/ Frame 9B3E	42 B 64 B	49ms 25ms	Fetch image/gif	142.250.184.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuTY7gmzCRJdnUYaR4NmTdq7VB19m-9oCZGgEfko5nrPdFt8KcixZ_exV1cZ0j8f-D_TQ6_RGuDALVJCuAOMVUk&sig=Cg0ArKJSzP23iUY5_CzNEAE&id=lidar2&mcvt=1000&p=1104,436,1194,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211025&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3402602959&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1635387554487&rpt=525&isd=0&lsd=0&met=ie&wmsd=0 Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f2.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://548d5c30a12fcb1438bc01c70d79b33a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Thu, 28 Oct 2021 02:19:16 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT