qr-adv.com Open in urlscan Pro
2606:4700:3031::ac43:dd6a Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://clck.ru/TkvXU
Effective URL:
http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Submission: On March 17 via manual (March 17th 2021, 10:41:58 am UTC) from RU

Summary HTTP 128 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 20 IPs in 3 countries across 16 domains to perform 128 HTTP transactions. The main IP is 2606:4700:3031::ac43:dd6a, located in United States and belongs to CLOUDFLARENET, US. The main domain is qr-adv.com.

This is the only time qr-adv.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a02:6b8::221 2a02:6b8::221	13238 (YANDEX) (YANDEX)
1 1	2a02:6b8::232 2a02:6b8::232	13238 (YANDEX) (YANDEX)
39	2606:4700:303... 2606:4700:3031::ac43:dd6a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
13	104.75.88.112 104.75.88.112	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:802::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
1	184.30.21.162 184.30.21.162	16625 (AKAMAI-AS) (AKAMAI-AS)
1	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
14	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
26	2a00:1450:400... 2a00:1450:4001:809::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
2 2	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
1	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4008:801::2003	15169 (GOOGLE) (GOOGLE)
128	20

1 2a02:6b8::221 (Moscow, Russian Federation) 1 redirects

ASN13238 (YANDEX, RU)

clck.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6b8::232 (Moscow, Russian Federation) 1 redirects

ASN13238 (YANDEX, RU)

sba.yandex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 2606:4700:3031::ac43:dd6a (United States)

ASN13335 (CLOUDFLARENET, US)

qr-adv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 104.75.88.112 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-88-112.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api-public.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:802::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

themes.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.21.162 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-21-162.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4008:801::2003 (United States)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
39	qr-adv.com qr-adv.com	262 KB
35	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	392 KB
16	doubleclick.net googleads.g.doubleclick.net securepubads.g.doubleclick.net	99 KB
12	addthis.com s7.addthis.com api-public.addthis.com	126 KB
8	gstatic.com www.gstatic.com fonts.gstatic.com csi.gstatic.com	139 KB
5	googletagservices.com www.googletagservices.com	163 KB
4	google.com 3 redirects adservice.google.com www.google.com	963 B
3	googleapis.com fonts.googleapis.com	31 KB
3	googleusercontent.com themes.googleusercontent.com	67 KB
2	google-analytics.com www.google-analytics.com	19 KB
1	google.de adservice.google.de	799 B
1	googleadservices.com partner.googleadservices.com	638 B
1	addthisedge.com v1.addthisedge.com	207 B
1	moatads.com z.moatads.com	1 KB
1	yandex.net 1 redirects sba.yandex.net	370 B
1	clck.ru 1 redirects clck.ru	465 B
128	16

	Domain	Requested by
39	qr-adv.com	qr-adv.com
26	tpc.googlesyndication.com	googleads.g.doubleclick.net tpc.googlesyndication.com pagead2.googlesyndication.com
15	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
9	api-public.addthis.com	s7.addthis.com
9	pagead2.googlesyndication.com	qr-adv.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
6	fonts.gstatic.com	fonts.googleapis.com
5	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
3	www.google.com	3 redirects
3	fonts.googleapis.com	googleads.g.doubleclick.net tpc.googlesyndication.com
3	themes.googleusercontent.com	qr-adv.com
3	s7.addthis.com	qr-adv.com s7.addthis.com
2	www.google-analytics.com	qr-adv.com www.google-analytics.com
1	csi.gstatic.com	securepubads.g.doubleclick.net
1	securepubads.g.doubleclick.net	googleads.g.doubleclick.net
1	www.gstatic.com	googleads.g.doubleclick.net
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	v1.addthisedge.com	s7.addthis.com
1	z.moatads.com	s7.addthis.com
1	sba.yandex.net	1 redirects
1	clck.ru	1 redirects
128	22

This site contains links to these domains. Also see Links.

Domain
www.phishtank.com
developers.google.com

Subject Issuer	Validity	Valid
odc-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2021-01-10` - `2021-04-07`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-01-21` - `2022-01-25`	a year	crt.sh
*.googleadservices.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.google.de GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh

This page contains 13 frames:

Primary Page: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Frame ID: 409B34B3463557D301C2765749B5A925
Requests: 68 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210315/r20190131/zrt_lookup.html
Frame ID: F9F705A96078033FE3523451CFF019FB
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&adk=1812271804&adf=3025194257&lmt=1615977698&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&ea=0&flash=0&pra=5&wgl=1&dt=1615977698497&bpp=18&bdt=499&idt=150&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7822349220138&frm=20&pv=2&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=23&ifi=1&uci=a!1&fsb=1&dtd=175
Frame ID: A9B4B21B772C1B7BA09415C8440382D6
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1141840447&adf=2835730391&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698515&bpp=5&bdt=517&idt=171&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=95&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=2&uci=a!2&fsb=1&xpc=aGmV6JSJPe&p=http%3A//qr-adv.com&dtd=183
Frame ID: 4ADB31BBF6C993E7BAABE59F4619911B
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=15&slotname=4986485233&adk=3515876115&adf=4072864089&pi=t.ma~as.4986485233&w=468&lmt=1615977698&psa=0&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698574&bpp=8&bdt=576&idt=129&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=215&ady=2591&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=VEtcudphcd&p=http%3A//qr-adv.com&dtd=134
Frame ID: F01C061BB315204E64EF1D7ECB6F56B9
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=250&slotname=6463218437&adk=356343848&adf=3415630641&pi=t.ma~as.6463218437&w=300&lmt=1615977698&psa=0&format=300x250&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698604&bpp=1&bdt=606&idt=115&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1015&ady=375&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=4&uci=a!4&fsb=1&xpc=Zg40y7XZTp&p=http%3A//qr-adv.com&dtd=119
Frame ID: 8F8B192EBF714646BFCC3BF5DE5AF5E7
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121
Frame ID: 8C6D0224F2CE410574BB22267C588BD6
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 4A0DE815C9B3B61FEA58B0135A7DD2CA
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/index.html
Frame ID: F808C56B0D81C1EDEBF20350AB946851
Requests: 16 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/KT7npM2pC4VPAEc6AEIcwWkjK4LR7Yu_WhYO7ltjsYQ.js
Frame ID: 491034893473759C354C1ED551AE8756
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 868E22A5B57FCCCB6C5329FAD87693CB
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 20F025F0B8C271A31F2438E5E728904C
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Frame ID: 74A7955F483F1B5D1F48A99F86792F91
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://clck.ru/TkvXU HTTP 302
https://sba.yandex.net/redirect?url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C... HTTP 302
http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

128
Requests

66 %
HTTPS

83 %
IPv6

16
Domains

22
Subdomains

20
IPs

3
Countries

1302 kB
Transfer

3414 kB
Size

11
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.phishtank.com/
Title: PhishTank

Search URL Search Domain Scan URL

URL: https://developers.google.com/safe-browsing/
Title: Google Safe Browsing

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://clck.ru/TkvXU HTTP 302
https://sba.yandex.net/redirect?url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&client=clck&sign=d8efde3e7ee1a7b7d33b66273439022c HTTP 302
http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 36

http://www.google-analytics.com/analytics.js HTTP 307
https://www.google-analytics.com/analytics.js

Request Chain 96

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 107

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 109

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

128 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request

Cookie set index.html Show response
qr-adv.com/
Redirect Chain

https://clck.ru/TkvXU
https://sba.yandex.net/redirect?url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&client=clck&sign...
http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1

93 KB
16 KB

222ms
205ms

Document
text/html

2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.3.10-1ubuntu3.8
Resource Hash: 4de1d9179fcdb8fea93a9aeee6d17f5b1e1d26042f7ba795cbd91db1b382aea4

Request headers

Host: qr-adv.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:37 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dbba4d4c2a52d20f1f8f3c11c32bb199b1615977697; expires=Fri, 16-Apr-21 10:41:37 GMT; path=/; domain=.qr-adv.com; HttpOnly; SameSite=Lax shorturl=6863pmb0vfs0dbfjlqs9o1th31; path=/
X-Powered-By: PHP/5.3.10-1ubuntu3.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
CF-Cache-Status: DYNAMIC
cf-request-id: 08e15fea0800004ab6850c9000000001
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Nu1QvwgZv75gcQW9z0e7rjFj5AGYpn8rZQbkiEul%2B%2Fa%2B1CfTIDzBVqwbsGYcwH8O6bVuH3hDgGeXpYMnNMob9iZTohiIZlrO6sfwgT8Mo31NF0psPR5N"}],"max_age":604800}
NEL: {"max_age":604800,"report_to":"cf-nel"}
Server: cloudflare
CF-RAY: 63159c233fad4ab6-FRA
Content-Encoding: gzip
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

Content-Length: 439
Content-Type: text/html; charset=utf-8
Date: Wed, 17 Mar 2021 10:41:37 GMT
Location: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Strict-Transport-Security: max-age=3600; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK bootstrap.css
qr-adv.com/themes/v3/styles/css/ 127 KB
18 KB 99ms
95ms Stylesheet
text/css 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/styles/css/bootstrap.css
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb74e0857a515bba7514be5880db482d5e2f32047b5b27bed2b8d064e731b094

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 18127
cf-request-id: 08e15fead900004ab6850d9000000001
Last-Modified: Thu, 17 Oct 2013 22:11:53 GMT
Server: cloudflare
ETag: "121424-1fcce-4e8f71aec6472"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=MIa0WAk4OLjv4onIU4ZafbjFn5GYiBYgrz8Y51dEohTBoIAkvbSiDBjJ86IIsvRHkLMfVmuUXEPk24H%2FArbkawYvKq8kan9eQAWNdqYsRvxKcE0WLeUd"}],"max_age":604800}
Content-Type: text/css
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c248a094ab6-FRA

GET
H/1.1 200
OK bootstrap-responsive.css
qr-adv.com/themes/v3/styles/css/ 15 KB
4 KB 112ms
103ms Stylesheet
text/css 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/styles/css/bootstrap-responsive.css
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9bf9bcbd42d52fbb94b6468ecaa7b038c6f5b8a76d807960a214e61e84166e9

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 2855
cf-request-id: 08e15feadd00004e437c348000000001
Last-Modified: Thu, 17 Oct 2013 22:11:50 GMT
Server: cloudflare
ETag: "121423-3b9f-4e8f71abd5592"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=rGWNP2vCMeEHkEUDAKwAkFSXRAlf%2FtJRxrgifbxjBz5MtcTvjWRNvktFno2lIkXWktrw7pHNLf0hG3Qq%2BbAfZ1SwwKz0CBs0HXiYXtyGuq2vscr87fDF"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c249b214e43-FRA

GET
H/1.1 200
OK wide_layout.css
qr-adv.com/themes/v3/styles/css/ 7 KB
2 KB 113ms
104ms Stylesheet
text/css 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/styles/css/wide_layout.css
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30b84b640093e4fa8ef37d461d0f495a73695c2c03eaa1a9297d3884ef226c7f

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 1564
cf-request-id: 08e15feadd00002bce6937b000000001
Last-Modified: Thu, 17 Oct 2013 22:12:04 GMT
Server: cloudflare
ETag: "121461-1c09-4e8f71b9323f2"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=07uMCw53yn04qTlgLpBI3yqklSllY1mfgqBnA5F6A0fJXTHjsgM%2BjIiKxuFiE7PALFDCvEeJ%2FjLS73t1Rm%2FTtotu23IY0IMlMMKeAyTH%2BVpzmwknjOPf"}],"max_age":604800}
Content-Type: text/css
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c249f9d2bce-FRA

GET
H/1.1 200
OK docs.css
qr-adv.com/themes/v3/styles/css/ 54 KB
10 KB 112ms
102ms Stylesheet
text/css 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/styles/css/docs.css
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 803292ceec966b37ca72127b471f8c8e24bdd49d11d4f72202250dd7c6986919

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 9781
cf-request-id: 08e15feade00004e984594b000000001
Last-Modified: Thu, 17 Oct 2013 22:11:55 GMT
Server: cloudflare
ETag: "121449-d98b-4e8f71b172d92"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Qz83K3kHGEZG%2F2Wxb3S3GzUCEY3x4YKGKnSx2%2Fm0gSKeCg8aJ10Kp5OxURXl5nW1ZEKAa5tscOB8q3SjZa9AWGmkwbxM64KUOqABJyYjEf5cglUcWFER"}],"max_age":604800}
Content-Type: text/css
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c249ede4e98-FRA

GET
H/1.1 200
OK options.css
qr-adv.com/themes/v3/styles/css/ 11 KB
3 KB 142ms
132ms Stylesheet
text/css 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/styles/css/options.css
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 196be374b361fd98656bd697bfbd25407a224d04a6d0976410447b5e165dd938

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 1947
cf-request-id: 08e15feae100004e55640b0000000001
Last-Modified: Thu, 17 Oct 2013 22:12:00 GMT
Server: cloudflare
ETag: "12145c-2c42-4e8f71b6136b2"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6QtWHy3VppiKz7QdK7J4Mw7pnP3Om4AwnBgx2FT%2FDvoLSyzlJYTPmcwQzQpLnyxBhBtzUfGsh48S7vh3oQsqKKbpZZXA1UO6od0m6Sl3Gub2S3V7EPz2"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c249ec34e55-FRA

GET
H/1.1 200
OK builder.css
qr-adv.com/themes/v3/styles/css/ 28 KB
6 KB 113ms
103ms Stylesheet
text/css 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/styles/css/builder.css
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c8ddfad20e38be0c8d5ec9682e4fc923caa79e973651db3a9ae7b0d8c0537e0

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 4875
cf-request-id: 08e15feade00002bf6300c1000000001
Last-Modified: Thu, 17 Oct 2013 22:11:54 GMT
Server: cloudflare
ETag: "12143f-7051-4e8f71b01a1f2"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XYw11O6hRcheFF82d%2FhbUhu6Q%2BQ0cQp1bRJpiw4rO1d5xOQYyW5cclqkq%2Fkx9SDDvp%2FBYYiMgeV5Na88tKoCRM99Hkj80RnuVQavxwRwptxE8we2PXNj"}],"max_age":604800}
Content-Type: text/css
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c249c782bf6-FRA

GET
H/1.1 200
OK screen.css
qr-adv.com/themes/v3/styles/ 39 KB
8 KB 199ms
100ms Stylesheet
text/css 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/styles/screen.css
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7a19841dbc05d4c521b5ae3a6fc7f89bf49ea726e6483b5ccbb9b0291940b89f

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 7167
cf-request-id: 08e15feb3800004ab65604a000000001
Last-Modified: Thu, 17 Oct 2013 22:12:05 GMT
Server: cloudflare
ETag: "121462-9a2d-4e8f71ba4a852"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Hjfz7UkTGGJ8ddtlnkRQ6kM206ybkRpqjuZw1jnT8kCDZEu%2Fwlbz8lk8Nh01nXt%2BoZpVakxI4LIGBnoNdUqwSEyCANC1DqsGztjlWYSeBXBI7LHFiPwp"}],"max_age":604800}
Content-Type: text/css
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c252ada4ab6-FRA

GET
H/1.1 200
OK fonts.css
qr-adv.com/themes/v3/styles/css/ 3 KB
1 KB 207ms
95ms Stylesheet
text/css 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/styles/css/fonts.css
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b628dbcc44582120e5ab4cefc1883680193d16192d78bb809b1c044cc742c49f

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 580
cf-request-id: 08e15feb4500004e43622ca000000001
Last-Modified: Thu, 17 Oct 2013 22:11:56 GMT
Server: cloudflare
ETag: "12144a-af6-4e8f71b1b34d2"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=c2X4eHTOn6HBLaqe14tKJHLNU7b5XtaJSBYltXInFnvY%2Fx4O%2FoxIaKqbUyl0SCh7bCrXyTc1MXfeh%2FnurW9cOCnAScBmg4GobavHNdKPSFa1pbpPHpkL"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c253be54e43-FRA

GET
H/1.1 200
OK orange.css
qr-adv.com/themes/v3/styles/css/layouts/ 1 KB
1 KB 212ms
100ms Stylesheet
text/css 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/styles/css/layouts/orange.css
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db3278692c721622a3d0329dabcece810924f7479abb624604231bf121ebc98d

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 385
cf-request-id: 08e15feb4700002bced12f9000000001
Last-Modified: Thu, 17 Oct 2013 22:11:59 GMT
Server: cloudflare
ETag: "121458-5ba-4e8f71b4d7032"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=EKIkf4tIcKBbe0ZQKY2MZtqz35w7%2BmYKIjiepL0JR%2BuavaFm60E1wAmsw3eqYjqbdmcZT4Myy1LKXpvXPJjBBKB52zrvbktXcKzhNO8UQbqR%2FSvCSNta"}],"max_age":604800}
Content-Type: text/css
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c25387e2bce-FRA

GET
H/1.1 200
OK adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 140 KB
50 KB 31ms
25ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1

Protocol

HTTP/1.1

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3b048e6d83d332e30a02f95aa0bfb5169e9f1a99b91945d6de5c45f2be1ebf46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Timing-Allow-Origin: *
Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 10690917498029883437
Vary: Accept-Encoding, Origin
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Content-Type: text/javascript; charset=UTF-8
Content-Length: 50253
X-XSS-Protection: 0
Expires: Wed, 17 Mar 2021 10:41:38 GMT

GET
H/1.1 200
OK jquery.min.js Show response
qr-adv.com/themes/v3/js/ 262 KB
79 KB 211ms
98ms Script
application/javascript 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/js/jquery.min.js
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"report_to":"cf-nel","max_age":604800}
Transfer-Encoding: chunked
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e15feb4700004e98f8b21000000001
Last-Modified: Thu, 17 Oct 2013 22:11:32 GMT
Server: cloudflare
ETag: "121405-4185d-4e8f719b3f412"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=eMNq5qtHvuH2mUfz0%2Fe3XuY30GRnfa8QP6DCWw3Dg1qw%2FLbgqWEMzKUE6K7YA1bDSgWG63a%2BcKQW6JL%2BG3gklCn3jw7r%2B444Y0Hm47b%2BCyF%2F0omUgaF8"}],"max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=14400
CF-RAY: 63159c253fe04e98-FRA

GET
H/1.1 200
OK jquery-ui-1.10.2.custom.min.js Show response
qr-adv.com/themes/v3/js/ 39 KB
13 KB 207ms
94ms Script
application/javascript 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/js/jquery-ui-1.10.2.custom.min.js
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df4432172533296e1270a70a80d47d6e388ea75fed18bf975e0840405ee23294

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 12439
cf-request-id: 08e15feb4700002bf6dd0e4000000001
Last-Modified: Thu, 17 Oct 2013 22:11:24 GMT
Server: cloudflare
ETag: "121402-9d95-4e8f7193780b2"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=d%2BkN3uJ5voXjlFXpKJtxg%2BT8fFEY8AanHneh6odvwpyUFbgNj2FKGN7x%2B7aQyKAFZzXln4Y7aU%2BexvRSMAfsQHR%2F1MS3aaMU7RJWIljZSGoBjDb9yOcD"}],"max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c253d2a2bf6-FRA

GET
H/1.1 200
OK jquery.tweet.js Show response
qr-adv.com/themes/v3/js/theme/ 12 KB
5 KB 234ms
94ms Script
application/javascript 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/js/theme/jquery.tweet.js
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0bd297a38fb7b928e03194e67397a73d76f90379207c12e5b8e73f123c4d529a

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 4167
cf-request-id: 08e15feb6500004e553f2e6000000001
Last-Modified: Thu, 17 Oct 2013 22:11:46 GMT
Server: cloudflare
ETag: "121419-301e-4e8f71a8e0831"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=L485qNfGpgLScGCHvF6prJA13ejc1XdLbZWKMLP0s47gpiqHlFQ4qUyHYFyub2XXlCT6VH%2FJLzVXxGYmO3ERsJ1EpOkxR3peRRrMDPOPuNuilJ6s%2FIoN"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c256fd84e55-FRA

GET
H/1.1 200
OK bootstrap.min.js Show response
qr-adv.com/themes/v3/js/theme/ 31 KB
8 KB 297ms
99ms Script
application/javascript 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/js/theme/bootstrap.min.js
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d37880e1cebd4f4df68e26475d8fcf50e43c7e83921e3c69627797f1861afe3b

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 7840
cf-request-id: 08e15feb9f00004ab656054000000001
Last-Modified: Thu, 17 Oct 2013 22:11:33 GMT
Server: cloudflare
ETag: "121408-7b71-4e8f719c7d9d1"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Z8q5qdO6k2qHDI7xzCJksiwS4FiF43mZYIwXGDIIDG84rEn9NFM1cSO2cXWzD4q%2FTuMGeZhI7FxGIBTRQEnHFrxaFxc%2FstquKlly7hzvT4RW%2BXiyRnyo"}],"max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c25cc1f4ab6-FRA

GET
H/1.1 200
OK jquery.easing.1.3.js Show response
qr-adv.com/themes/v3/js/theme/ 8 KB
3 KB 301ms
93ms Script
application/javascript 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/js/theme/jquery.easing.1.3.js
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 1986
cf-request-id: 08e15feba700004e4388a4b000000001
Last-Modified: Thu, 17 Oct 2013 22:11:38 GMT
Server: cloudflare
ETag: "121411-1fa1-4e8f71a0a8051"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=MmaFYOfn%2Fts7bCIaVU3eD0%2BxgqxV7dlaCjkWu2hp6MfSwu0aBOg4dSdBeLVsXRkllN1DXAE8O%2FYpNQIo3c5H74HNyG635Eb6TDA0aHNsbAOkzOXyqMiK"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c25dcc54e43-FRA

GET
H/1.1 200
OK jflickrfeed.min.js Show response
qr-adv.com/themes/v3/js/theme/ 2 KB
2 KB 309ms
102ms Script
application/javascript 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/js/theme/jflickrfeed.min.js
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7331e568d44900f570f233a6cc0022a6a8f272f6fdabcae6ddc2092fe1c00c1a

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 816
cf-request-id: 08e15feba700002bf6428d4000000001
Last-Modified: Thu, 17 Oct 2013 22:11:35 GMT
Server: cloudflare
ETag: "12140e-6c3-4e8f719dd4632"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4%2FeItCPlEejikLr4WS06H4IYijVX8K0soXO4wn3QVbP9jAdWfoHcRPZ%2BdH0JeSpx0ruwSzjHhHXDWVJCYy6T3%2F5Rww%2BLEgItjnYwlqQYqHjPUyN1TFJm"}],"max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c25dde62bf6-FRA

GET
H/1.1 200
OK testimonialrotator.js Show response
qr-adv.com/themes/v3/js/theme/ 934 B
1 KB 308ms
97ms Script
application/javascript 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/js/theme/testimonialrotator.js
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9d05793ddacf41d51a255e9ea719278d6f910885cf3a6895fb8658613996059

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 441
cf-request-id: 08e15febab00002bce5c8e9000000001
Last-Modified: Thu, 17 Oct 2013 22:11:48 GMT
Server: cloudflare
ETag: "12141e-3a6-4e8f71aa4ad11"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=DfOu1AfhwFVS00D6DEAQ4KWzervnTorOsjQthm2yenA1CzLTfJkv9n0wrDVzw4nuENK5UlyGv7yvS%2BjhtcVE2cfV1cGayhZRhUlUrsh4j5sbKOsJiDGT"}],"max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c25d9362bce-FRA

GET
H/1.1 200
OK jquery.waitforimages.js Show response
qr-adv.com/themes/v3/js/theme/ 1 KB
2 KB 310ms
94ms Script
application/javascript 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/js/theme/jquery.waitforimages.js
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa5d486a992d96fe0a780253e7441da9ce88d21b48e59a778c7d4fd9da799094

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 791
cf-request-id: 08e15febb000004e982213d000000001
Last-Modified: Thu, 17 Oct 2013 22:11:47 GMT
Server: cloudflare
ETag: "12141a-5b8-4e8f71a91b1b2"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ylxZe0ZnndEa9PWbsw%2B8aHIJ%2FLyPGeG7sGAiGR6Cf5zV4nlvWuwL47J5pZwAJlOpxIyNZfYfiSN%2Fsonm3xeCIudjewomtifnMCOoYLExmAMZNI3U3Ps%2F"}],"max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c25e8d44e98-FRA

GET
H/1.1 200
OK custom.js Show response
qr-adv.com/themes/v3/js/theme/ 1 KB
1 KB 325ms
92ms Script
application/javascript 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/js/theme/custom.js
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08cf37457213462052c6597a2d774bfd0d83400c927c2d973400f89c0e707fa5

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 575
cf-request-id: 08e15febc200004e55f20e6000000001
Last-Modified: Thu, 17 Oct 2013 22:11:34 GMT
Server: cloudflare
ETag: "12140b-5be-4e8f719d22a71"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2Bt9Mwny8h2%2BLEPxIKQLWaqwtgH9cHGzppUKT7%2FdQ0V4p8e%2F6pgxM5Ac0lTKe11KDPSsGW5X%2BAgqtVQHrtNe3OlVqcJc0mPvM%2BsnVYGrKCx8Ff2EvdO5e"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c2608a54e55-FRA

GET
H/1.1 200
OK jquery.dataTables.min.js Show response
qr-adv.com/themes/v3/js/ 68 KB
20 KB 390ms
93ms Script
application/javascript 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/js/jquery.dataTables.min.js
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c3ca64b7acfdd29b3ca6f1b9b46696369abd462d4546182085c347f72211841

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 19275
cf-request-id: 08e15fec0100004ab69530b000000001
Last-Modified: Thu, 17 Oct 2013 22:11:26 GMT
Server: cloudflare
ETag: "121404-10fe4-4e8f71955d652"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=BsR%2FXaXR298vfjypX05ZEZaxK9PNIUpy%2FoK24vnkHunhaxHjYUv5uKX13E7YKVM840eefOzzZsci4r7eFoSTcJy2cJUtCBCR0yayYsdAMTCuTXw%2BlSfL"}],"max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c266d2f4ab6-FRA

GET
H/1.1 200
OK jquery.autosize-min.js Show response
qr-adv.com/themes/v3/js/ 2 KB
2 KB 393ms
94ms Script
application/javascript 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr-adv.com/themes/v3/js/jquery.autosize-min.js
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0db91532815790fa85ae602886d621fb2bd429ba2c9c85aac1d31751e3fdbadb

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 1078
cf-request-id: 08e15fec0400004e43a1868000000001
Last-Modified: Thu, 17 Oct 2013 22:11:24 GMT
Server: cloudflare
ETag: "121403-84a-4e8f7193b68b2"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=yoLfm%2Bmp5ojtfwg%2FIWseKkv7lwBDpDsoo%2FfT5F1%2B%2B7Ip39mx6M77bL%2FvbpstJFc7oS%2BJWK9QXWRui51ceK8ZKtXJvM%2BimJyX4YzL%2FEUQYpzpGQkjt132"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c266dad4e43-FRA

GET
H/1.1 200
OK orange.png
qr-adv.com/themes/v3/images/logo/ 6 KB
7 KB 96ms
93ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/themes/v3/images/logo/orange.png
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d8643e2af6ead7b7041891b4d68ace467e47548bef7cdbab1922e0a12440b5f

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 6229
cf-request-id: 08e15fec6800004e439b07c000000001
last-modified: Thu, 17 Oct 2013 22:09:55 GMT
Server: cloudflare
etag: "1212ac-1855-4e8f713ef0652"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7Q1NWHQefNx5zyFlirLZ3vB0lt1K3dfgCBvgEEjZi5icO0psUP15jWXZAg9NOqn35EWpFi1mz4hZ6ztPz1FGM8vyAmkY9j43U4Mv8dW016SjOgAE6ZaD"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c270eae4e43-FRA

GET
H/1.1 200
OK 1qlky~q
qr-adv.com/ 388 B
1 KB 437ms
433ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/1qlky~q
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.3.10-1ubuntu3.8
Resource Hash: b18fa4e3bbd5e917b1ced256dfd79d381872c6ea93e460e20ed552314bf338ab

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 10:41:38 GMT
CF-Cache-Status: DYNAMIC
NEL: {"max_age":604800,"report_to":"cf-nel"}
Server: cloudflare
X-Powered-By: PHP/5.3.10-1ubuntu3.8
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Kq6sWjC0vhhMkYItHmIWSc80d%2FEiis1l0YhbHrw03%2FGG83hpINVJ3gyYck1RQCN7KTWxYkDg4l5gawxeVidpNQOyTZ2858WMFMRCCvW1O2a9pC%2Bv2lSn"}],"max_age":604800}
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
CF-RAY: 63159c270e684ab6-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 388
cf-request-id: 08e15fec6800004ab66137b000000001
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK success_tick.png
qr-adv.com/themes/v3/images/ 1 KB
2 KB 99ms
96ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/themes/v3/images/success_tick.png
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ebb43f1daf88b25aad59fa54604c5b4eb63e7f026ad303d8e3e98a9c90b6a472

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 1186
cf-request-id: 08e15fec6800004e5522b6d000000001
Last-Modified: Thu, 17 Oct 2013 22:11:13 GMT
Server: cloudflare
ETag: "1213da-4a2-4e8f7188e7f12"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=DEBN0tFxANLqvDm8Em8mAf8Gm1UQRbAZOLYT5QK3Rx4X1LhiiToOs4bktVMuXvNZ07bDrJ%2BSbP2nuMK0KdSsPX6l27dkfuRdoqwLWXw9DXY53osYturq"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c270a134e55-FRA

GET
H/1.1 200
OK 1qlkz~q
qr-adv.com/ 384 B
1 KB 366ms
363ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/1qlkz~q
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.3.10-1ubuntu3.8
Resource Hash: 0cca1034384d1368a8daf623a89f06cdde4dea4e203ce6fe3dc43ec831118fef

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 10:41:38 GMT
CF-Cache-Status: DYNAMIC
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
X-Powered-By: PHP/5.3.10-1ubuntu3.8
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=zjvw7rmikZQJHQVxtHVf7JJPro0ZlzvoUyi1Juchz%2BGDaJ1XaPiycXb6IVlzar8IXJv%2BAgkr5dRgMygNrS4rw3UFjJPM2WVRAnnAQ0m1SfZHHBPIjArD"}],"max_age":604800}
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
CF-RAY: 63159c271a6d4e98-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 384
cf-request-id: 08e15fec6a00004e986b10b000000001
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK 2Mgfe~q
qr-adv.com/ 376 B
1 KB 645ms
642ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/2Mgfe~q
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.3.10-1ubuntu3.8
Resource Hash: 0e5c3073c2046f68677a868000fd508f7d454e01af5dc863d8705d422ce5ea48

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 10:41:39 GMT
CF-Cache-Status: DYNAMIC
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
X-Powered-By: PHP/5.3.10-1ubuntu3.8
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=iIocbjxw7aIxj%2BGT2n31kUOIu8q5DZtNiPOxSOvivb2u5qp%2Bo1e04rNkSRDMLW6hzqC9zL6InCfbGAPEaQbetcC1C5FLyiDoyPqTF2zbygqaULUjn34I"}],"max_age":604800}
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
CF-RAY: 63159c270f9a2bf6-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 376
cf-request-id: 08e15fec6800002bf62926d000000001
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK 2Mgff~q
qr-adv.com/ 381 B
1 KB 509ms
506ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/2Mgff~q
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.3.10-1ubuntu3.8
Resource Hash: e7b70b3fba8e06f2fa4d71ab22432042a068e764ec2b0580d40fa05e36bde065

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 10:41:38 GMT
CF-Cache-Status: DYNAMIC
NEL: {"max_age":604800,"report_to":"cf-nel"}
Server: cloudflare
X-Powered-By: PHP/5.3.10-1ubuntu3.8
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=mCKcQGmNsM4PJiQE%2BIq5WrR2GZrH%2FuKlBppZlrUkMWop%2FaJx0xSAThB5brZwmucyEhW7DyrqNDUw6WdUfZn%2FUS20recsrMq6ge%2BAgBnUb%2FOcVJ5w0c6D"}],"max_age":604800}
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
CF-RAY: 63159c270aba2bce-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 381
cf-request-id: 08e15fec6800002bce5aab9000000001
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK 2Mgfg~q
qr-adv.com/ 387 B
1 KB 667ms
611ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/2Mgfg~q
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.3.10-1ubuntu3.8
Resource Hash: 45d71cb118c07d93b0bb139fe0a8e9645d26a30efab41cc0f983ee31a0c6df9a

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 10:41:39 GMT
CF-Cache-Status: DYNAMIC
NEL: {"max_age":604800,"report_to":"cf-nel"}
Server: cloudflare
X-Powered-By: PHP/5.3.10-1ubuntu3.8
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=kM7hBNm8XQPftUQ5jxwSeNhW2bvPwwl41OB1%2FQnBWz6MWpoXBVCxkZdg7CmDOLKMjKIES3%2BiM8M2vsCsdhu5MGxlgh1%2FAV1E3gaMymWpefUvkdAt9Snv"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
CF-RAY: 63159c27bb494e55-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 387
cf-request-id: 08e15fecd300004e5519b8f000000001
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK 2Mgfh~q
qr-adv.com/ 379 B
1 KB 601ms
601ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/2Mgfh~q
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.3.10-1ubuntu3.8
Resource Hash: ec9ed49e63ac6dfc77f4cace2597d3de0e846788cef120da6531dc140ca635c3

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 10:41:39 GMT
CF-Cache-Status: DYNAMIC
NEL: {"max_age":604800,"report_to":"cf-nel"}
Server: cloudflare
X-Powered-By: PHP/5.3.10-1ubuntu3.8
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=eg4XxpY5x89DYyLsRGnzKP101Ovx5%2FMPKNj0K93Ha8k1OZsRIpJC5eR%2FxoiSFzP%2BiqJow%2FkqZwQ7Y99z6uBFQIwkD0wzA8sS86ze6gtu0fp0RoZOOzfC"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
CF-RAY: 63159c28386e4e43-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 379
cf-request-id: 08e15fed2800004e43622eb000000001
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK 2Mgfi~q
qr-adv.com/ 391 B
1 KB 541ms
541ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/2Mgfi~q
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.3.10-1ubuntu3.8
Resource Hash: aefebcfb111378fd1b856f75082e41117c0c4c6b483a909a3c2f2322817afc3e

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 10:41:39 GMT
CF-Cache-Status: DYNAMIC
NEL: {"max_age":604800,"report_to":"cf-nel"}
Server: cloudflare
X-Powered-By: PHP/5.3.10-1ubuntu3.8
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=0%2Bq%2Bb0Wt%2FxLVhR44TIHBH59mRdtdrVCU9UIjshEplSFYMRoYdBq08n99YEmzWV1xywAmXRE4vWnaVtGzjN9r14JTK1%2BZlw8defbDW1varzqO2hFhCx3x"}],"max_age":604800}
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
CF-RAY: 63159c29cab34ab6-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 391
cf-request-id: 08e15fee1a00004ab65833e000000001
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK 2Mgfk~q
qr-adv.com/ 384 B
1 KB 409ms
409ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/2Mgfk~q
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.3.10-1ubuntu3.8
Resource Hash: 83f3e4d0df57b9d3e64133e036557ccc4042116f182c9bd95772145e25053ba2

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
Date: Wed, 17 Mar 2021 10:41:39 GMT
CF-Cache-Status: DYNAMIC
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
x-powered-by: PHP/5.3.10-1ubuntu3.8
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7ahPloD7rwsXNXikVKyAZP4%2FkxW6tPnjF%2F4YGj2uXjMatvxbxNrMeERPsuOcMhdAn%2FHV7LioDdTT%2FsEUvTUOUF82QsVmXeMS%2Ft4t9vXjVTbE44eoa9jY"}],"max_age":604800}
Content-Type: image/png
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
CF-RAY: 63159c29eeab4e98-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 384
cf-request-id: 08e15fee3300004e986409d000000001
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK 2Mgfl~q
qr-adv.com/ 380 B
1 KB 536ms
535ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/2Mgfl~q
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.3.10-1ubuntu3.8
Resource Hash: 0376556b5313dc3dad1b691b163b53050b18ffcafe9a09be7995df5a3468c909

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 10:41:39 GMT
CF-Cache-Status: DYNAMIC
NEL: {"max_age":604800,"report_to":"cf-nel"}
Server: cloudflare
X-Powered-By: PHP/5.3.10-1ubuntu3.8
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=eFcGpCLUthdhFFIW%2BDOM22Rc%2FZ1GRODNRm2fa0IK94cEr4%2F0rY7DpaerZ7T6idWiRl%2B5pG2DRiMz%2B4uq2B8qWFuit8uW5sAZ%2FGsmhrLoDyY7pkXu%2FG0u"}],"max_age":604800}
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
CF-RAY: 63159c2a3e792bce-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 380
cf-request-id: 08e15fee6300002bce9832b000000001
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/250/ 353 KB
114 KB 85ms
30ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/250/addthis_widget.js

Requested by

Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: "5f971164-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
cache-control: public, max-age=600
date: Wed, 17 Mar 2021 10:41:38 GMT
x-host: s7.addthis.com
content-length: 116325

GET
H/1.1 200
OK star_icon.png
qr-adv.com/themes/v3/images/ 1 KB
2 KB 95ms
94ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/themes/v3/images/star_icon.png
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e62942d5b86ffa5bc910541ad5b612b8bffcf96adc2ef306648def54e146054

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:39 GMT
CF-Cache-Status: HIT
NEL: {"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 1290
cf-request-id: 08e15fef1900002bf6359e3000000001
Last-Modified: Thu, 17 Oct 2013 22:10:02 GMT
Server: cloudflare
ETag: "1212c6-50a-4e8f7145b4d12"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=wOE0NrFU2z0KWTsnbQRYBLlH%2BIsPu%2BK0%2BSXKy5bYvYX%2Bh6Mg4gi%2BU9QNJ11cZKHAOAhtQlWINvUHOA5j%2FAvUpMymPaZTtw2ajO6qpqEVYAII%2BwPTloaD"}],"max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c2b5ca92bf6-FRA

GET
H/1.1 200
OK plus_icon.png
qr-adv.com/themes/v3/images/ 1 KB
2 KB 98ms
97ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/themes/v3/images/plus_icon.png
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19820a113bb1d006964ac41987870d4888583c97d0bbcc5171b3a729428541db

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:39 GMT
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 1109
cf-request-id: 08e15fef5300004e5543316000000001
Last-Modified: Thu, 17 Oct 2013 22:09:57 GMT
Server: cloudflare
ETag: "1212b1-455-4e8f714099331"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2BkIcqPdYgr2YR68%2F7n5FnIjKMNFIg3iqxgAuD2A5goz5OlMmvcbEGXmD83slqYWDd5pB5HbYwjbaGotPYv9apoDC%2FAR8RLRs8IT%2FP9e%2BPtmwbuubhDP9"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c2bb9d94e55-FRA

GET
H/1.1 200
OK twitter_icon.png
qr-adv.com/themes/v3/images/ 2 KB
2 KB 96ms
96ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/themes/v3/images/twitter_icon.png
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a291fbd6a29b44aaee1bafcd5974028181bf056b627c95b2dbb841e3ea9f4f16

Request headers

Referer: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:39 GMT
CF-Cache-Status: HIT
NEL: {"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 1570
cf-request-id: 08e15fef7800002bf6359e5000000001
Last-Modified: Thu, 17 Oct 2013 22:11:14 GMT
Server: cloudflare
ETag: "1213dc-622-4e8f718a39d52"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2BZV24ISSrdc0C%2B2aQoeNUVs2jCji6eUClmh3%2BJ1C8iY7WyypHGEORAsP8Bkk8EYA6IipgnneYCDGwCkzeGh%2BrY6M94Fak1Os7mvHhn1GTI0y3aUp7070"}],"max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c2bfd5c2bf6-FRA

GET
H2

200

analytics.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/analytics.js
https://www.google-analytics.com/analytics.js

46 KB
19 KB

6ms
6ms

Script
text/javascript

2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: qr-adv.com
URL: http://qr-adv.com/index.html?u=1054862|1054863|1054864|1054865|1054866|1054867|1054868|1054870|1054871&success=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 05 Feb 2021 21:33:27 GMT
server: Golfe2
age: 4393
date: Wed, 17 Mar 2021 09:28:25 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18980
expires: Wed, 17 Mar 2021 11:28:25 GMT

Redirect headers

Location: https://www.google-analytics.com/analytics.js
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK diagonal-noise.png
qr-adv.com/themes/v3/images/ 8 KB
9 KB 169ms
94ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/themes/v3/images/diagonal-noise.png
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/themes/v3/styles/css/options.css
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd973c2b1ef865b051fc1845de9ae66cbb072a601e4bda7157f3a986b1fea0df

Request headers

Referer: http://qr-adv.com/themes/v3/styles/css/options.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 8401
cf-request-id: 08e15fecc500004e436f172000000001
Last-Modified: Thu, 17 Oct 2013 22:09:35 GMT
Server: cloudflare
ETag: "12125b-20d1-4e8f712b57cb2"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=dIChNRCqqWZrEDl6c3DWcRMczRCucKmCiJ%2BazclVHBI8w82zSRvh0BeJKDc4in2v8yFEVpE%2BeWVd4DkQ5PsgFizte2yFByrkdgIFj31D%2BBGJpp8qdBRf"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c27af914e43-FRA

GET
H/1.1 200
OK options.css
qr-adv.com/themes/v3/styles/css/ 11 KB
11 KB 88ms
10ms Image
text/css 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/themes/v3/styles/css/options.css
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/themes/v3/styles/css/options.css
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://qr-adv.com/themes/v3/styles/css/options.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Age: 0
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 1947
cf-request-id: 08e15fecc900004e553f2f8000000001
Last-Modified: Thu, 17 Oct 2013 22:12:00 GMT
Server: cloudflare
ETag: "12145c-2c42-4e8f71b6136b2"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=hmqXy8kZnCoqXq%2F79VGx%2FXT9uIhYxDlhVOMIJ%2Fz8JkxK28Mzx8JK%2B0ZPu5MwwIhdOXJrKXK00e4vJI5pIAqwduG8E54NYf3C%2BrdwseOb6IQNTJy8p70Y"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c27ab174e55-FRA

GET
H/1.1 200
OK MTP_ySUJH_bn48VBG8sNSnhCUOGz7vYGh680lGh-uXM.woff
themes.googleusercontent.com/static/fonts/opensans/v6/ 22 KB
23 KB 13ms
7ms Font
font/woff 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://themes.googleusercontent.com/static/fonts/opensans/v6/MTP_ySUJH_bn48VBG8sNSnhCUOGz7vYGh680lGh-uXM.woff

Requested by

Host: qr-adv.com
URL: http://qr-adv.com/themes/v3/styles/css/fonts.css

Protocol

HTTP/1.1

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a851d97fcc71c78ca279754fabc2289a600aabecec4d9e4387cab9c7400aa2d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://qr-adv.com
Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 07:26:07 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 22 Oct 2019 18:15:00 GMT
Server: sffe
Age: 98131
Vary: Accept-Encoding
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Cross-Origin-Resource-Policy: cross-origin
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 22604
X-XSS-Protection: 0
Expires: Wed, 16 Mar 2022 07:26:07 GMT

GET
H/1.1 200
OK k3k702ZOKiLJc3WVjuplzHhCUOGz7vYGh680lGh-uXM.woff
themes.googleusercontent.com/static/fonts/opensans/v6/ 22 KB
23 KB 7ms
6ms Font
font/woff 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://themes.googleusercontent.com/static/fonts/opensans/v6/k3k702ZOKiLJc3WVjuplzHhCUOGz7vYGh680lGh-uXM.woff

Requested by

Host: qr-adv.com
URL: http://qr-adv.com/themes/v3/styles/css/fonts.css

Protocol

HTTP/1.1

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd0e6f9fbe497b6a0346fde3934cbcbd7c557a334c27bb34e69c7ed430ed4a45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://qr-adv.com
Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 16 Mar 2021 07:22:10 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 22 Oct 2019 18:15:00 GMT
Server: sffe
Age: 98368
Vary: Accept-Encoding
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Cross-Origin-Resource-Policy: cross-origin
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 22748
X-XSS-Protection: 0
Expires: Wed, 16 Mar 2022 07:22:10 GMT

GET
H/1.1 200
OK cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff
themes.googleusercontent.com/static/fonts/opensans/v6/ 21 KB
22 KB 9ms
6ms Font
font/woff 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://themes.googleusercontent.com/static/fonts/opensans/v6/cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff

Requested by

Host: qr-adv.com
URL: http://qr-adv.com/themes/v3/styles/css/fonts.css

Protocol

HTTP/1.1

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90556675373ea9ed1d0e9b5678426d69296b6801c906ca378bb426aa3d6acdc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://qr-adv.com
Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 12 Mar 2021 08:22:52 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 22 Oct 2019 18:15:00 GMT
Server: sffe
Age: 440326
Vary: Accept-Encoding
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Cross-Origin-Resource-Policy: cross-origin
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 21956
X-XSS-Protection: 0
Expires: Sat, 12 Mar 2022 08:22:52 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
384 B 49ms
13ms XHR
text/plain 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j88&a=1023831815&t=pageview&_s=1&dl=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&ul=en-us&de=UTF-8&dt=QR%20track%20%26%20stats%20-%20QR%20ADVertising&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAAABAAAAAC~&jid=882512661&gjid=974300007&cid=900089674.1615977698&tid=UA-7476238-16&_gid=185792168.1615977698&_r=1&_slc=1&z=994333519

Requested by

Host: www.google-analytics.com
URL: http://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 10:41:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://qr-adv.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210315/r20190131/ 226 KB
85 KB 57ms
38ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210315/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-0249992602040212&plah=qr-adv.com&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f75520dc2f01340163664bff9c61dee64f4f558006ff589f605f2ecaec306e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:41:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 86701
x-xss-protection: 0
server: cafe
etag: 14930693550233320034
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 17 Mar 2021 10:41:38 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210315/r20190131/ Frame F9F7 10 KB
5 KB 6ms
5ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210315/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c44ef8885a1386dad99986e4de63457883d50b1a966d27b502f37d691d7bd770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210315/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://qr-adv.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://qr-adv.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 16 Mar 2021 15:46:42 GMT
expires: Tue, 30 Mar 2021 15:46:42 GMT
content-type: text/html; charset=UTF-8
etag: 14488317231655078900
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4661
x-xss-protection: 0
age: 68096
cache-control: public, max-age=1209600
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 85ms
28ms Script
application/x-javascript 184.30.21.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-21-162.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:41:38 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: B402EDC6F7271ED7
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=41550
accept-ranges: bytes
content-length: 948
x-amz-id-2: 3ZiQcYtRTuh4WJ4BUq+mWoVqgQk4EdHwIkUrSZre2GxPFo/4IUZsv5aBqLknQUvSl0wjR3iM+HQ=

GET
H/1.1 200
OK arr-right-mini.png
qr-adv.com/themes/v3/images/img/ 1019 B
2 KB 247ms
94ms Image
image/png 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/themes/v3/images/img/arr-right-mini.png
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/themes/v3/styles/screen.css
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d2338264d0a534c6c39c080c07cf773e613e3c769cef96e5e6529f0988ffbdcb

Request headers

Referer: http://qr-adv.com/themes/v3/styles/screen.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:38 GMT
CF-Cache-Status: HIT
NEL: {"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 1019
cf-request-id: 08e15fedd300004e984b21c000000001
Last-Modified: Thu, 17 Oct 2013 22:09:37 GMT
Server: cloudflare
ETag: "121265-3fb-4e8f712d6cff1"
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=1130yaRcQualMh6JAXKDV4QkZ%2FGSwFpVfXEiD6DLEv5GxBjpu4%2FOyN0DH50z2iBIICcBEnrD9UCg2uOaWaWlw7SpvDUytPZ%2Fsa%2FjWLQ7KlAKVAM%2B%2BJjK"}],"max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c295db24e98-FRA

GET
H/1.1 200
OK options.css
qr-adv.com/themes/v3/styles/css/ 11 KB
11 KB 16ms
15ms Image
text/css 2606:4700:3031::ac43:dd6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr-adv.com/themes/v3/styles/css/options.css
Requested by: Host: qr-adv.com
URL: http://qr-adv.com/themes/v3/styles/css/options.css
Protocol: HTTP/1.1
Server: 2606:4700:3031::ac43:dd6a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://qr-adv.com/themes/v3/styles/css/options.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 10:41:39 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"max_age":604800,"report_to":"cf-nel"}
Age: 1
Connection: keep-alive
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 1947
cf-request-id: 08e15fef7f00004e4382364000000001
Last-Modified: Thu, 17 Oct 2013 22:12:00 GMT
Server: cloudflare
ETag: "12145c-2c42-4e8f71b6136b2"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5Q8FRwwplTLkVsGQ5ycOGyRKdsYxQZeTh7COW5tD%2BE1J6hw3kdIDSfca2%2F1lwuESezg2rq3pgPbV4ieI31W%2Bu2nh%2FqGMVuY1ywmh3q1lqSlweUqlGPXP"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 63159c2bfe254e43-FRA

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/xa-4f44f44768bcd979/ 27 B
207 B 267ms
265ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/xa-4f44f44768bcd979/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-112.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 19a26d6046c4fcfe9e3efbc1fb7532f424c6b0b7590b9e193788e30bce8b9836

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:41:38 GMT
content-encoding: gzip
content-disposition: attachment; filename=1.txt
cache-control: public, max-age=60, s-maxage=86400
content-length: 47
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 200 B
638 B 105ms
46ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=qr-adv.com&callback=_gfp_s_&client=ca-pub-0249992602040212

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210315/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-0249992602040212&plah=qr-adv.com&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

8597d4568b08225047adcdc8fd12c6cb3e9d853a9c440c05b8fc76ac6cc63679

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:41:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 190
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
799 B 34ms
15ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=qr-adv.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 10:41:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
553 B 36ms
15ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=qr-adv.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 10:41:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A9B4 3 KB
1 KB 124ms
107ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&adk=1812271804&adf=3025194257&lmt=1615977698&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&ea=0&flash=0&pra=5&wgl=1&dt=1615977698497&bpp=18&bdt=499&idt=150&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7822349220138&frm=20&pv=2&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=23&ifi=1&uci=a!1&fsb=1&dtd=175

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ef295be877353849482d68679c80fa153bf56c6ee4e1f5332ef62b6c60ae596

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-0249992602040212&output=html&adk=1812271804&adf=3025194257&lmt=1615977698&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&ea=0&flash=0&pra=5&wgl=1&dt=1615977698497&bpp=18&bdt=499&idt=150&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7822349220138&frm=20&pv=2&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=23&ifi=1&uci=a!1&fsb=1&dtd=175
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://qr-adv.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://qr-adv.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 17 Mar 2021 10:41:38 GMT
server: cafe
content-length: 613
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 17-Mar-2021 10:56:38 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 17 Mar 2021 10:41:38 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 34ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

57532d07103088a868f37b813377ca409585e04802671b9c442ca39d8ee70cf0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:41:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615840876344261"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28211
x-xss-protection: 0
expires: Wed, 17 Mar 2021 10:41:38 GMT

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4ADB 58 KB
14 KB 620ms
620ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1141840447&adf=2835730391&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698515&bpp=5&bdt=517&idt=171&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=95&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=2&uci=a!2&fsb=1&xpc=aGmV6JSJPe&p=http%3A//qr-adv.com&dtd=183

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ff65ee19b00017e1879f2488c020bfd2dd861f248ab37e61a36f8194166844d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1141840447&adf=2835730391&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698515&bpp=5&bdt=517&idt=171&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=95&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=2&uci=a!2&fsb=1&xpc=aGmV6JSJPe&p=http%3A//qr-adv.com&dtd=183
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://qr-adv.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://qr-adv.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 17 Mar 2021 10:41:39 GMT
server: cafe
content-length: 14627
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 17-Mar-2021 10:56:38 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 17 Mar 2021 10:41:39 GMT
cache-control: private

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F01C 21 KB
6 KB 163ms
163ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=15&slotname=4986485233&adk=3515876115&adf=4072864089&pi=t.ma~as.4986485233&w=468&lmt=1615977698&psa=0&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698574&bpp=8&bdt=576&idt=129&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=215&ady=2591&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=VEtcudphcd&p=http%3A//qr-adv.com&dtd=134

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5823d757c636340f9bf54605c128d24db476e36e7e40ae08a8a5f232d7457c5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-0249992602040212&output=html&h=15&slotname=4986485233&adk=3515876115&adf=4072864089&pi=t.ma~as.4986485233&w=468&lmt=1615977698&psa=0&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698574&bpp=8&bdt=576&idt=129&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=215&ady=2591&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=VEtcudphcd&p=http%3A//qr-adv.com&dtd=134
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://qr-adv.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://qr-adv.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 17 Mar 2021 10:41:38 GMT
server: cafe
content-length: 5817
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 17-Mar-2021 10:56:38 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 17 Mar 2021 10:41:38 GMT
cache-control: private

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8F8B 54 KB
20 KB 497ms
496ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=250&slotname=6463218437&adk=356343848&adf=3415630641&pi=t.ma~as.6463218437&w=300&lmt=1615977698&psa=0&format=300x250&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698604&bpp=1&bdt=606&idt=115&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1015&ady=375&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=4&uci=a!4&fsb=1&xpc=Zg40y7XZTp&p=http%3A//qr-adv.com&dtd=119

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b94658eb1706483b436d58133e33f33b9b053a25200253d98ba446cc69e35b86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-0249992602040212&output=html&h=250&slotname=6463218437&adk=356343848&adf=3415630641&pi=t.ma~as.6463218437&w=300&lmt=1615977698&psa=0&format=300x250&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698604&bpp=1&bdt=606&idt=115&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1015&ady=375&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=4&uci=a!4&fsb=1&xpc=Zg40y7XZTp&p=http%3A//qr-adv.com&dtd=119
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://qr-adv.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://qr-adv.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 17 Mar 2021 10:41:39 GMT
server: cafe
content-length: 20719
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 17-Mar-2021 10:56:38 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 17 Mar 2021 10:41:39 GMT
cache-control: private

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8C6D 86 KB
31 KB 634ms
634ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49d656ad802b7956f6fe4ba2ffd24c8c49745a537096d7273b4d534ea6c45f82

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNXKy4WSt-8CFYYt0wodx7wDZQ&gqi=4txRYPeWLfTFmwfv_ojwDQ&layout=/sadbundle/%24csp%253Der3%24/3702163449953139277/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://qr-adv.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://qr-adv.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNXKy4WSt-8CFYYt0wodx7wDZQ&gqi=4txRYPeWLfTFmwfv_ojwDQ&layout=/sadbundle/%24csp%253Der3%24/3702163449953139277/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 17 Mar 2021 10:41:39 GMT
server: cafe
content-length: 31401
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 17-Mar-2021 10:56:38 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 17 Mar 2021 10:41:39 GMT
cache-control: private

GET
H2 200 css
fonts.googleapis.com/ Frame F01C 4 KB
729 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=15&slotname=4986485233&adk=3515876115&adf=4072864089&pi=t.ma~as.4986485233&w=468&lmt=1615977698&psa=0&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698574&bpp=8&bdt=576&idt=129&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=215&ady=2591&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=VEtcudphcd&p=http%3A//qr-adv.com&dtd=134

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

df1c43c5ed5cb5e84db3d60979a61fd95ad677117752d29afbceb1f4f06f1409

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 17 Mar 2021 10:04:32 GMT
server: ESF
date: Wed, 17 Mar 2021 10:41:38 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 17 Mar 2021 10:41:38 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210315/r20110914/ Frame F01C 17 KB
7 KB 28ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210315/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5d7a28c9d4b8b842b5dd259ae0ee10b5366b532a90e2881d8ed17f3da9b645f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:39:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 99
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7126
x-xss-protection: 0
server: cafe
etag: 11114773310340928782
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 10:39:59 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F01C 112 KB
34 KB 41ms
27ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c5a0b8523ed52dfff8b07b61549ed61cc80c8b75529ce84a591bc25c9d7289e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:41:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615840882416834"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34604
x-xss-protection: 0
expires: Wed, 17 Mar 2021 10:41:38 GMT

GET
H2 200 counter.d27508c102582d608697.js Show response
s7.addthis.com/static/ 24 KB
8 KB 29ms
29ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/counter.d27508c102582d608697.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

e4f924eac92aa3cc4ea64f2891447e8bd3af49e1a5c0bcd04b7356e2f7f1c04c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: W/"5f971164-5fd2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86313600
date: Wed, 17 Mar 2021 10:41:38 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 8265

GET
H2 200 shares.json Show response
api-public.addthis.com/url/ 45 B
295 B 76ms
74ms Script
application/json 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fqr-adv.com%2F1qlky&callback=_ate.cbs.sc_httpqradvcom1qlky0

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

ef4e95086fd767b25e35f550f291b187eeada2a376e06df49e1417e7dffa9fe9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
surrogate-key: qr-adv.com/1qlky
last-modified: Wed, 17 Mar 2021 10:40:12 GMT
server: nginx/1.15.8
date: Wed, 17 Mar 2021 10:41:39 GMT
vary: Accept-Encoding
content-type: application/json
cache-control: no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length: 65

GET
H2 200 shares.json Show response
api-public.addthis.com/url/ 45 B
295 B 219ms
218ms Script
application/json 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fqr-adv.com%2F1qlkz&callback=_ate.cbs.sc_httpqradvcom1qlkz0

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

9e9879c6bbf02db02221f70cf37b319ca1c7a5950e7c5db68ca82f63ab382ae1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
surrogate-key: qr-adv.com/1qlkz
last-modified: Wed, 17 Mar 2021 10:41:39 GMT
server: nginx/1.15.8
date: Wed, 17 Mar 2021 10:41:39 GMT
vary: Accept-Encoding
content-type: application/json
cache-control: no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length: 65

GET
H2 200 shares.json Show response
api-public.addthis.com/url/ 43 B
292 B 84ms
84ms Script
application/json 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fqr-adv.com%2F2Mgfe&callback=_ate.cbs.sc_httpqradvcomgfe0

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

c36024833d70e4a0c6f203dfdca90922de4a0fd864a856e843975d844737f327

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
surrogate-key: qr-adv.com/2mgfe
last-modified: Wed, 17 Mar 2021 10:40:12 GMT
server: nginx/1.15.8
date: Wed, 17 Mar 2021 10:41:39 GMT
vary: Accept-Encoding
content-type: application/json
cache-control: no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length: 63

GET
H2 200 shares.json Show response
api-public.addthis.com/url/ 43 B
292 B 247ms
246ms Script
application/json 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fqr-adv.com%2F2Mgff&callback=_ate.cbs.sc_httpqradvcomgff0

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

ce7beabb58b8a3f6215c7eab83bd3d6b3166e8359696c8a5a767eaa09420c3b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
surrogate-key: qr-adv.com/2mgff
last-modified: Wed, 17 Mar 2021 10:41:39 GMT
server: nginx/1.15.8
date: Wed, 17 Mar 2021 10:41:39 GMT
vary: Accept-Encoding
content-type: application/json
cache-control: no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length: 63

GET
H2 200 shares.json Show response
api-public.addthis.com/url/ 43 B
292 B 80ms
79ms Script
application/json 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fqr-adv.com%2F2Mgfg&callback=_ate.cbs.sc_httpqradvcomgfg0

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

db7ea5ae79f5c5d50f5eadd1fa4dc5b6e706ecea231ceda770b15f6b4fbe926a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
surrogate-key: qr-adv.com/2mgfg
last-modified: Wed, 17 Mar 2021 10:40:12 GMT
server: nginx/1.15.8
date: Wed, 17 Mar 2021 10:41:39 GMT
vary: Accept-Encoding
content-type: application/json
cache-control: no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length: 63

GET
H2 200 shares.json Show response
api-public.addthis.com/url/ 43 B
292 B 248ms
247ms Script
application/json 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fqr-adv.com%2F2Mgfh&callback=_ate.cbs.sc_httpqradvcomgfh0

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

ef18f5729c9570101576addb2aec8d460d5f481a63e2580a3da7401fafcf91be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
surrogate-key: qr-adv.com/2mgfh
last-modified: Wed, 17 Mar 2021 10:41:39 GMT
server: nginx/1.15.8
date: Wed, 17 Mar 2021 10:41:39 GMT
vary: Accept-Encoding
content-type: application/json
cache-control: no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length: 63

GET
H2 200 shares.json Show response
api-public.addthis.com/url/ 43 B
292 B 50ms
50ms Script
application/json 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fqr-adv.com%2F2Mgfi&callback=_ate.cbs.sc_httpqradvcomgfi0

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

cdf1ece48b051ae803492c05ede92ac49c60aee50095ab7d06cd9c9e6085a296

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
surrogate-key: qr-adv.com/2mgfi
last-modified: Wed, 17 Mar 2021 10:40:12 GMT
server: nginx/1.15.8
date: Wed, 17 Mar 2021 10:41:39 GMT
vary: Accept-Encoding
content-type: application/json
cache-control: no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length: 63

GET
H2 200 shares.json Show response
api-public.addthis.com/url/ 43 B
292 B 194ms
194ms Script
application/json 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fqr-adv.com%2F2Mgfk&callback=_ate.cbs.sc_httpqradvcomgfk0

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

6ee9648a7ce12de5c9a48064a6fcef51d5e66100bfc86b848a012985bf5f1de3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
surrogate-key: qr-adv.com/2mgfk
last-modified: Wed, 17 Mar 2021 10:41:39 GMT
server: nginx/1.15.8
date: Wed, 17 Mar 2021 10:41:39 GMT
vary: Accept-Encoding
content-type: application/json
cache-control: no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length: 63

GET
H2 200 shares.json Show response
api-public.addthis.com/url/ 43 B
292 B 189ms
189ms Script
application/json 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fqr-adv.com%2F2Mgfl&callback=_ate.cbs.sc_httpqradvcomgfl0

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

83bd1d830259123db75c68ad0d072da0e1f58ba8044f489031d1425901c60fec

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
surrogate-key: qr-adv.com/2mgfl
last-modified: Wed, 17 Mar 2021 10:40:12 GMT
server: nginx/1.15.8
date: Wed, 17 Mar 2021 10:41:39 GMT
vary: Accept-Encoding
content-type: application/json
cache-control: no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length: 63

GET
DATA 200
OK truncated
/ 564 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: da6f3508fdb8c1fdf553e4af5556b585ba5998139afe613d56dc0d88c822bd81

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3-Q050 200 7331658777259019020
tpc.googlesyndication.com/simgad/ Frame 8F8B 84 KB
84 KB 30ms
15ms Image
image/gif 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7331658777259019020

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=250&slotname=6463218437&adk=356343848&adf=3415630641&pi=t.ma~as.6463218437&w=300&lmt=1615977698&psa=0&format=300x250&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698604&bpp=1&bdt=606&idt=115&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1015&ady=375&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=4&uci=a!4&fsb=1&xpc=Zg40y7XZTp&p=http%3A//qr-adv.com&dtd=119

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22d2597fbeb86e479af0b8e70f37198a9a52e0013084eafbdaa715d092df82af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 13 Mar 2021 10:52:47 GMT
x-content-type-options: nosniff
age: 344932
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 86264
x-xss-protection: 0
last-modified: Fri, 18 Dec 2020 10:12:44 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 13 Mar 2022 10:52:47 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210315/r20110914/ Frame 8F8B 17 KB
7 KB 28ms
14ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210315/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5d7a28c9d4b8b842b5dd259ae0ee10b5366b532a90e2881d8ed17f3da9b645f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:39:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7126
x-xss-protection: 0
server: cafe
etag: 11114773310340928782
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 10:39:59 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/ Frame 8F8B 2 KB
2 KB 24ms
12ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

79c521a89112af803faa48f72e1f5f1b5d0685129a14b917317d1cc688613a18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:40:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 6751271179024913178
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 10:40:17 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8F8B 112 KB
34 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c5a0b8523ed52dfff8b07b61549ed61cc80c8b75529ce84a591bc25c9d7289e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:41:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615840882416834"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34604
x-xss-protection: 0
expires: Wed, 17 Mar 2021 10:41:39 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/ Frame 8F8B 13 KB
6 KB 27ms
14ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f14a53d6e112f5652255e499e109659fe79678b0de2eec4f42a1ac48c9ce72bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:41:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5996
x-xss-protection: 0
server: cafe
etag: 15528521553155206461
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 10:41:19 GMT

GET
H3-Q050 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/ Frame 8F8B 26 KB
11 KB 30ms
18ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

287d01ceb941124c1e21d4a6a37f20c0eb4dbcfadd94c8c41042f589a0fe3296

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:28:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 787
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10842
x-xss-protection: 0
server: cafe
etag: 8817814149220243033
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 10:28:32 GMT

GET
H3-Q050 200 adview
googleads.g.doubleclick.net/pagead/ Frame 8F8B 0
0 43ms
43ms Fetch
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CEF2a4txRYJGqLc6gzQaG-6PYA6ftsu9hvpKNj6UNkMCI8rEJEAEguq-8CmCViriCyAegAZyv-6gCyAEDqAMByAPJBKoE-AFP0JnuZ8X-WS3EHm4J6S4hzDjehEtFog1MT88auFhdkjTg5KddM5JFXIvaredtBWbq1F0yH8zfInGNJWZsvhCGRhe1TojDIOev8WzNINo0K0oFxybNNjeOf6Fzl_TffgUKmkna5hrQ2A6-3dgr0bCtIdQyJI9dNZkaiXqCo_PTk4s5_s2SwOq9QCfA0eUX36IV5RQNCXm14EOqVtLgUcI3cf1KX3Lrb7wbMgk5SpnoY94Ng2UX23ILTl-YpA6PJQ3a6CyzP2Lh42dqNns0z4eKk5ynOJ0AGBkeCRxsRB9zfS4STHxcDB-yFhvvzUErJFWcTV2kjov78MAEkfmT5boDkgUECAQYAZIFBAgFGASgBgOAB8zQhNcBqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcFEMy_sgLSCAkIgOGAEBABGB-ACgHICwHYEw2yFxoKGAgAEhRwdWItMDI0OTk5MjYwMjA0MDIxMg&sigh=_jYSAOFfPF0&tpd=AGWhJmtZBNMMZRkeqqxZvndAhxSMe9zYL_qvUhbu_oi-w-CrFg

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=250&slotname=6463218437&adk=356343848&adf=3415630641&pi=t.ma~as.6463218437&w=300&lmt=1615977698&psa=0&format=300x250&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698604&bpp=1&bdt=606&idt=115&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1015&ady=375&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=4&uci=a!4&fsb=1&xpc=Zg40y7XZTp&p=http%3A//qr-adv.com&dtd=119
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 17 Mar 2021 10:41:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 17 Mar 2021 10:41:39 GMT

GET
H3-Q050 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4A0D 143 B
220 B 7ms
6ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=250&slotname=6463218437&adk=356343848&adf=3415630641&pi=t.ma~as.6463218437&w=300&lmt=1615977698&psa=0&format=300x250&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698604&bpp=1&bdt=606&idt=115&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1015&ady=375&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=4&uci=a!4&fsb=1&xpc=Zg40y7XZTp&p=http%3A//qr-adv.com&dtd=119
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnlfen9jBY1ldAvyZ8ANDevSyesH3h7QNlPRG7HEV300_mc_WmIF0Ur4SmLSGQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=250&slotname=6463218437&adk=356343848&adf=3415630641&pi=t.ma~as.6463218437&w=300&lmt=1615977698&psa=0&format=300x250&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698604&bpp=1&bdt=606&idt=115&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1015&ady=375&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=4&uci=a!4&fsb=1&xpc=Zg40y7XZTp&p=http%3A//qr-adv.com&dtd=119

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 17 Mar 2021 10:23:20 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1099
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 8F8B 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b460d3e5fd4006806d73d7f47f2aa0c4f57df9bd619f4fdf63fad6284182b0a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame 4ADB 3 KB
1016 B 44ms
30ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1141840447&adf=2835730391&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698515&bpp=5&bdt=517&idt=171&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=95&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=2&uci=a!2&fsb=1&xpc=aGmV6JSJPe&p=http%3A//qr-adv.com&dtd=183

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 17 Mar 2021 10:01:46 GMT
server: ESF
date: Wed, 17 Mar 2021 10:41:39 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 17 Mar 2021 10:41:39 GMT

GET
H3-Q050 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/ Frame 4ADB 2 KB
992 B 7ms
5ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

74be4c34f7ab076bc7be1f685597904c2849c6ca8e935fd65340e5b5764982c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:40:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 895
x-xss-protection: 0
server: cafe
etag: 11223387288966882771
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 10:40:49 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210315/r20110914/ Frame 4ADB 17 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210315/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5d7a28c9d4b8b842b5dd259ae0ee10b5366b532a90e2881d8ed17f3da9b645f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:39:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7126
x-xss-protection: 0
server: cafe
etag: 11114773310340928782
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 10:39:59 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/ Frame 4ADB 2 KB
1 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

79c521a89112af803faa48f72e1f5f1b5d0685129a14b917317d1cc688613a18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:40:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 6751271179024913178
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 10:40:17 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4ADB 112 KB
34 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c5a0b8523ed52dfff8b07b61549ed61cc80c8b75529ce84a591bc25c9d7289e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:41:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615840882416834"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34604
x-xss-protection: 0
expires: Wed, 17 Mar 2021 10:41:39 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/ Frame 4ADB 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f14a53d6e112f5652255e499e109659fe79678b0de2eec4f42a1ac48c9ce72bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:41:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5996
x-xss-protection: 0
server: cafe
etag: 15528521553155206461
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 10:41:19 GMT

GET
H2 200 957c89dfc9e78dd5a0a3956da91f5358.js Show response
www.gstatic.com/mysidia/ Frame 4ADB 25 KB
11 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/957c89dfc9e78dd5a0a3956da91f5358.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74701d1b03dcb606710d7cc01bbf35a36ad5e5e443e33e55894a013f0d65aacf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 11 Mar 2021 10:35:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 11 Mar 2021 09:49:38 GMT
server: sffe
age: 518799
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10839
x-xss-protection: 0
expires: Wed, 09 Jun 2021 10:35:00 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/15462738406945126913/ Frame 4ADB 2 KB
2 KB 6ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15462738406945126913/downsize_200k_v1?w=100&h=100

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2a24d4e9d42317158d2ac1952521d72ec44a68db78b170f494f7826a5ad6130

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 12 Mar 2021 00:03:28 GMT
x-content-type-options: nosniff
age: 470291
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1661
x-xss-protection: 0
last-modified: Sat, 22 Aug 2020 03:08:23 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Mar 2022 00:03:28 GMT

GET
H3-Q050 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4ADB 0
0 43ms
42ms Fetch
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cae_j4txRYNGPLJWB2fcP4dq9mAH64e-yYYuNlsOQDaS87-eMDhABILqvvApglYq4gsgHoAGP9vn2A8gBAagDAaoE_wFP0DxParyD8jlyfgQO0vN6KdFvcFxmoaROSi173y1uaHL5lF7xLoaKvbmmDygBn7lYqc_O5xUTA-GP4B6PZN-XZtNAwnIZcQ0iAT0W48iG9B22VwONNTrWy2KVHBXf6g452EIZv_ZAnK0FO80Xw4sIvpIypdIUjj7EYe2eK6-pQii4mXahRiADSHiSBNxL_icnhXXtifvabmhHM4mbCstOVVqv6lAxsUAvfHNU-MyA9ab1v6MCDyIl7lucfHoGUgHzuPGFsiyRDthpMDGKru34TDHxDiN9xETGnK7d9fMoSK5S356_07-t8atwvJTYlwvxZSoZIunJwY2ZA11VojjABI-4sbydA5IFBAgEGAGSBQQIBRgEgAePtZwSqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcFEJXZ3AXSCAkIgOGAEBABGB-ACgHICwHYEw2yFxoKGAgAEhRwdWItMDI0OTk5MjYwMjA0MDIxMg&sigh=MOid1_MtSLE&template_id=5001&tpd=AGWhJmt3GDL75teUtR296oktAp4Rbg7YFqKnMFSmn6Q1fFeVNQ

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1141840447&adf=2835730391&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698515&bpp=5&bdt=517&idt=171&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=95&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=2&uci=a!2&fsb=1&xpc=aGmV6JSJPe&p=http%3A//qr-adv.com&dtd=183
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 17 Mar 2021 10:41:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/ Frame F808 151 KB
25 KB 7ms
7ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/index.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a242d868ad5898827886e1e1d570172d4a72e11ce0b46c92a68e4f5943fb2f37

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/3702163449953139277/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Tue, 16 Mar 2021 11:36:37 GMT
expires: Wed, 16 Mar 2022 11:36:37 GMT
last-modified: Tue, 09 Mar 2021 11:34:48 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 23632
age: 83102
cache-control: public, max-age=31536000
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 adview
googleads.g.doubleclick.net/pagead/ Frame 8C6D 0
0 44ms
43ms Fetch
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CoX9Q4txRYNXRLYbbzAbH-Y6oBqPw6eZh6MGkrtwNsKSUxdciEAEguq-8CmCViriCyAegAaDyq6QCyAEJqQKLGvdUXPmzPqgDAcgDSKoE-wFP0O8T6SmKfXwfBiEvswQaI7hzCSmax6N6u1fPp9knkB4QbmrxSw4q5el41hH12HoYCyshTeMcZgTIviIe8PTsIY426exTuxUUMo3oERxyU6XDsoCEBVyRXyiqFSBenDKHJslvKcnO82-3lxrnWsEaDxcU_8Ykziz5126SA5WjDdFMpBBOmBf_CYEx4d1PSQuhcLNgtQYu8tIsp9Cn7PWHlo3QE0CEA8MoUXuI2wG4OpUyxM45qv5lwsAqXef8r22_ikDuYhHPnE2w48Z4eEEa1Uw_K4F9wwdmev3xkdruXCtRbnwauAhjaL_M5M3dsvMJpKQy_n3lz8OcoMAE0Niwnr0DkgUECAQYAZIFBAgFGASgBi6AB_rbmcsBqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcFEOHysgHSCAkIgOGAEBABGB-ACgHICwHYEw2yFxoKGAgAEhRwdWItMDI0OTk5MjYwMjA0MDIxMg&sigh=lCLyhDdHNzg&template_id=419&tpd=AGWhJmvoyLC1cw8fFvkKk0YO0PSU2pM4Xw6zEh6Uoa_G445Dhg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 17 Mar 2021 10:41:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210315/r20110914/ Frame 8C6D 17 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210315/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5d7a28c9d4b8b842b5dd259ae0ee10b5366b532a90e2881d8ed17f3da9b645f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:39:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7126
x-xss-protection: 0
server: cafe
etag: 11114773310340928782
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 10:39:59 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/ Frame 8C6D 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

79c521a89112af803faa48f72e1f5f1b5d0685129a14b917317d1cc688613a18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:40:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 6751271179024913178
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 10:40:17 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8C6D 112 KB
34 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c5a0b8523ed52dfff8b07b61549ed61cc80c8b75529ce84a591bc25c9d7289e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:41:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615840882416834"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34604
x-xss-protection: 0
expires: Wed, 17 Mar 2021 10:41:39 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/ Frame 8C6D 13 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210315/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f14a53d6e112f5652255e499e109659fe79678b0de2eec4f42a1ac48c9ce72bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:41:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5996
x-xss-protection: 0
server: cafe
etag: 15528521553155206461
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 10:41:19 GMT

GET
H3-Q050

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4A0D
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
110 B

39ms
39ms

Document
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnlfen9jBY1ldAvyZ8ANDevSyesH3h7QNlPRG7HEV300_mc_WmIF0Ur4SmLSGQ; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 17 Mar 2021 10:41:39 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Wed, 17-Mar-2021 11:41:39 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 17 Mar 2021 10:41:39 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 17 Mar 2021 10:41:39 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 KT7npM2pC4VPAEc6AEIcwWkjK4LR7Yu_WhYO7ltjsYQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 4910 14 KB
6 KB 35ms
20ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/KT7npM2pC4VPAEc6AEIcwWkjK4LR7Yu_WhYO7ltjsYQ.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

293ee7a4cda90b854f00473a00421cc169232b82d1ed8bbf5a160eee5b63b184

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 09:54:00 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 08 Mar 2021 17:45:00 GMT
server: sffe
age: 2859
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5656
x-xss-protection: 0
expires: Thu, 17 Mar 2022 09:54:00 GMT

GET
H3-Q050 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 868E 143 B
165 B 7ms
6ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1141840447&adf=2835730391&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698515&bpp=5&bdt=517&idt=171&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=95&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=2&uci=a!2&fsb=1&xpc=aGmV6JSJPe&p=http%3A//qr-adv.com&dtd=183
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnlfen9jBY1ldAvyZ8ANDevSyesH3h7QNlPRG7HEV300_mc_WmIF0Ur4SmLSGQ; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1141840447&adf=2835730391&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698515&bpp=5&bdt=517&idt=171&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=95&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=2&uci=a!2&fsb=1&xpc=aGmV6JSJPe&p=http%3A//qr-adv.com&dtd=183

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 17 Mar 2021 10:23:20 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1099
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 4ADB 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d5602ee7353f613eec3678621f01a5612bb21d79c44cfa04a26faed17c42c43d

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 4ADB 21 KB
21 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 11 Mar 2021 01:58:20 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
age: 549799
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
expires: Fri, 11 Mar 2022 01:58:20 GMT

GET
H2 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 4ADB 21 KB
21 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 21:42:23 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
age: 565156
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
expires: Thu, 10 Mar 2022 21:42:23 GMT

GET
H3-Q050 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 20F0 143 B
165 B 6ms
6ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnlfen9jBY1ldAvyZ8ANDevSyesH3h7QNlPRG7HEV300_mc_WmIF0Ur4SmLSGQ; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 17 Mar 2021 10:23:20 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1099
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 8C6D 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c1a7e08b514f047fd9953c3b102130f01e676cb317bc95c8e8f59ed88d2fddb

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame F808 109 KB
30 KB 18ms
17ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Noto+Sans+JP:900

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b007a7abd35d50586bad7e196fc8a1540cbd7b2d6322f3c583f7bf4c07217df7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 17 Mar 2021 10:02:02 GMT
server: ESF
date: Wed, 17 Mar 2021 10:41:39 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 17 Mar 2021 10:41:39 GMT

GET
H3-Q050 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame F808 16 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 01:08:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34360
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5866
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 18 Mar 2021 01:08:59 GMT

GET
H3-Q050 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame F808 22 KB
9 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4634b94630896f1a23c5ce01f743d720847c5f4dd28fb549ed503cb2df4f8e87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 12:41:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79185
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8867
x-xss-protection: 0
server: cafe
etag: 18043545750443934562
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Wed, 17 Mar 2021 12:41:54 GMT

GET
H3-Q050

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 868E
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
21 B

40ms
40ms

Document
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnlfen9jBY1ldAvyZ8ANDevSyesH3h7QNlPRG7HEV300_mc_WmIF0Ur4SmLSGQ; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 17 Mar 2021 10:41:39 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Wed, 17-Mar-2021 11:41:39 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 17 Mar 2021 10:41:39 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 17 Mar 2021 10:41:39 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 4ADB 54 KB
21 KB 83ms
25ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

3477e8fe3b7becd59943c9497c9a6cdcb7768f59f5c0bba0bcf981c923b25c6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 09:58:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2602
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20897
x-xss-protection: 0
server: cafe
etag: 7857869394883405340
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Wed, 17 Mar 2021 10:58:17 GMT

GET
H3-Q050

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 20F0
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
21 B

39ms
39ms

Document
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnlfen9jBY1ldAvyZ8ANDevSyesH3h7QNlPRG7HEV300_mc_WmIF0Ur4SmLSGQ; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 17 Mar 2021 10:41:39 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Wed, 17-Mar-2021 11:41:39 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 17 Mar 2021 10:41:39 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 17 Mar 2021 10:41:39 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 -F6pfjtqLzI2JPCgQBnw7HFQQi8q1xVxjfp_dakBof6Bs-tb3ab2FNISVac.118.woff2
fonts.gstatic.com/s/notosansjp/v28/ Frame F808 13 KB
13 KB 31ms
17ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notosansjp/v28/-F6pfjtqLzI2JPCgQBnw7HFQQi8q1xVxjfp_dakBof6Bs-tb3ab2FNISVac.118.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Noto+Sans+JP:900

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7adca3a48d9202190836b2fdb7375c122d0e6f95cfba0ec83082a84184b3d529

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 12 Mar 2021 14:23:14 GMT
x-content-type-options: nosniff
last-modified: Thu, 12 Nov 2020 04:14:59 GMT
server: sffe
age: 418705
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13216
x-xss-protection: 0
expires: Sat, 12 Mar 2022 14:23:14 GMT

GET
H3-Q050 200 -F6pfjtqLzI2JPCgQBnw7HFQQi8q1xVxjfp_dakBof6Bs-tb3ab2FNISVac.119.woff2
fonts.gstatic.com/s/notosansjp/v28/ Frame F808 47 KB
48 KB 24ms
18ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notosansjp/v28/-F6pfjtqLzI2JPCgQBnw7HFQQi8q1xVxjfp_dakBof6Bs-tb3ab2FNISVac.119.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Noto+Sans+JP:900

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b9dae434b225e4750e1e8283e35a66705ca6ac543689b10dabb5c0e15edd0eed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 11 Mar 2021 19:45:12 GMT
x-content-type-options: nosniff
last-modified: Thu, 12 Nov 2020 04:10:09 GMT
server: sffe
age: 485787
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48632
x-xss-protection: 0
expires: Fri, 11 Mar 2022 19:45:12 GMT

GET
H3-Q050 200 -F6pfjtqLzI2JPCgQBnw7HFQQi8q1xVxjfp_dakBof6Bs-tb3ab2FNISVac.117.woff2
fonts.gstatic.com/s/notosansjp/v28/ Frame F808 10 KB
10 KB 20ms
15ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notosansjp/v28/-F6pfjtqLzI2JPCgQBnw7HFQQi8q1xVxjfp_dakBof6Bs-tb3ab2FNISVac.117.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Noto+Sans+JP:900

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d6f76318fa8b3ed0fd4c0c1544804ce897c3db006c47ca5c3356b27d1afff3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 12 Mar 2021 12:42:41 GMT
x-content-type-options: nosniff
last-modified: Thu, 12 Nov 2020 04:21:49 GMT
server: sffe
age: 424738
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9952
x-xss-protection: 0
expires: Sat, 12 Mar 2022 12:42:41 GMT

GET
H3-Q050 200 -F6pfjtqLzI2JPCgQBnw7HFQQi8q1xVxjfp_dakBof6Bs-tb3ab2FNISVac.59.woff2
fonts.gstatic.com/s/notosansjp/v28/ Frame F808 15 KB
15 KB 19ms
14ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notosansjp/v28/-F6pfjtqLzI2JPCgQBnw7HFQQi8q1xVxjfp_dakBof6Bs-tb3ab2FNISVac.59.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Noto+Sans+JP:900

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ffff5170ec6b0bcdeac4abec181cbf6b06f9afd9d78948e54bc20b028e00ae9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 11 Mar 2021 19:49:49 GMT
x-content-type-options: nosniff
last-modified: Thu, 12 Nov 2020 04:14:32 GMT
server: sffe
age: 485510
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15184
x-xss-protection: 0
expires: Fri, 11 Mar 2022 19:49:49 GMT

GET
H3-Q050 200 KT7npM2pC4VPAEc6AEIcwWkjK4LR7Yu_WhYO7ltjsYQ.js Show response
pagead2.googlesyndication.com/bg/ Frame F808 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/KT7npM2pC4VPAEc6AEIcwWkjK4LR7Yu_WhYO7ltjsYQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

293ee7a4cda90b854f00473a00421cc169232b82d1ed8bbf5a160eee5b63b184

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 09:54:00 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 08 Mar 2021 17:45:00 GMT
server: sffe
age: 2859
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5656
x-xss-protection: 0
expires: Thu, 17 Mar 2022 09:54:00 GMT

GET
H3-Q050 200 GLS_Paketshop_Kundenbindung.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/ Frame F808 29 KB
7 KB 10ms
10ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/GLS_Paketshop_Kundenbindung.svg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

185acc66772f8a3fd8f2cee0b7c3f06a9ec5fb27abc7d2b098fa68ec91d4a86f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 83097
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7099
x-xss-protection: 0
last-modified: Tue, 09 Mar 2021 11:34:48 GMT
server: sffe
date: Tue, 16 Mar 2021 11:36:42 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 16 Mar 2022 11:36:42 GMT

GET
H3-Q050 200 GLS_Paketshop_Kunden.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/ Frame F808 29 KB
7 KB 9ms
8ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/GLS_Paketshop_Kunden.svg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f5953f9b2d7c8b881274830e1631bf3abda43946a307873e44505b8b1796898

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 83097
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7064
x-xss-protection: 0
last-modified: Tue, 09 Mar 2021 11:34:48 GMT
server: sffe
date: Tue, 16 Mar 2021 11:36:42 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 16 Mar 2022 11:36:42 GMT

GET
H3-Q050 200 GLS_Paketshop_Geld.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/ Frame F808 31 KB
9 KB 8ms
7ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/GLS_Paketshop_Geld.svg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74671ab79c0924e3d0e9b377c7bf2b6f9b60671df32c8a51808186615b5ce01d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 83097
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7316
x-xss-protection: 0
last-modified: Tue, 09 Mar 2021 11:34:48 GMT
server: sffe
date: Tue, 16 Mar 2021 11:36:42 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 16 Mar 2022 11:36:42 GMT

GET
H3-Q050 200 01_Paketshop-Icon.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/ Frame F808 2 KB
870 B 13ms
12ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/01_Paketshop-Icon.svg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7ed0bfc8e35a28042c39a4f594acc38f7dacd5dc07de852e90e88b3ac781cee

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 83097
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 837
x-xss-protection: 0
last-modified: Tue, 09 Mar 2021 11:34:48 GMT
server: sffe
date: Tue, 16 Mar 2021 11:36:42 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 16 Mar 2022 11:36:42 GMT

GET
H3-Q050 200 GLS_Paketshop_Sterne.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/ Frame F808 29 KB
7 KB 12ms
12ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/GLS_Paketshop_Sterne.svg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f20570a8613040f81ea37ae604c05c0cd7adc4f8b2ea880bfc5c10beedf31e5

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 83097
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7021
x-xss-protection: 0
last-modified: Tue, 09 Mar 2021 11:34:48 GMT
server: sffe
date: Tue, 16 Mar 2021 11:36:42 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 16 Mar 2022 11:36:42 GMT

GET
H3-Q050 200 GLS_Logo.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/ Frame F808 2 KB
952 B 12ms
11ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/GLS_Logo.svg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07868401a56635b4e357e2c7aab09f8e026185a09cc5de5beb60a1fcbcd64315

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 83097
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 919
x-xss-protection: 0
last-modified: Tue, 09 Mar 2021 11:34:48 GMT
server: sffe
date: Tue, 16 Mar 2021 11:36:42 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 16 Mar 2022 11:36:42 GMT

GET
H3-Q050 200 GLS-emblem-klima-protect.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/ Frame F808 6 KB
3 KB 11ms
10ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3702163449953139277/GLS-emblem-klima-protect.svg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0249992602040212&output=html&h=90&slotname=3649352833&adk=1957155544&adf=2827832974&pi=t.ma~as.3649352833&w=728&lmt=1615977698&psa=0&format=728x90&url=http%3A%2F%2Fqr-adv.com%2Findex.html%3Fu%3D1054862%7C1054863%7C1054864%7C1054865%7C1054866%7C1054867%7C1054868%7C1054870%7C1054871%26success%3D1&flash=0&wgl=1&dt=1615977698610&bpp=7&bdt=611&idt=117&shv=r20210315&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&prev_slotnames=4986485233&nras=1&correlator=7822349220138&frm=20&pv=1&ga_vid=900089674.1615977698&ga_sid=1615977699&ga_hid=1023831815&ga_fc=0&ga_wpids=UA-7476238-16&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=436&ady=2953&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44737536%2C21066428%2C21068083&oid=3&pvsid=632681917414498&rx=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8192&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Ags5GIGRWW&p=http%3A//qr-adv.com&dtd=121

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd06ab94d3fe081043ea16f641688a2c743bef33f7dfe4c8a0a1edc3292ca15b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 83097
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2624
x-xss-protection: 0
last-modified: Tue, 09 Mar 2021 11:34:48 GMT
server: sffe
date: Tue, 16 Mar 2021 11:36:42 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 16 Mar 2022 11:36:42 GMT

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 9 KB
7 KB 51ms
38ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210315&st=env

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8960044e9160cd3a1ac54275b80420514459ab6352fab9986d7dc5d203e5321b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 10:41:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6644
x-xss-protection: 0

POST
H2 204 csi
csi.gstatic.com/ Frame 4ADB 0
331 B 372ms
128ms Other
image/gif 2607:f8b0:4008:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&puid=1~kmdbedd3&ctx=2&gqid=4txRYL_ZK8zE1wa9l5PoDA&qqid=CNGIyoWSt-8CFZVA9ggdYW0PEw&met.4=fb.iu~lb.lg~ol.r2~bdt.-jh~bpp.-4z~idt.-d~dtd.-1~dt.-54&met.3=739.lg~555.m1~556.m1_1~740.mm_1~740.mn~740.mo~740.nn~740.qr~738.qy~749.qy_4~736.r3_1~735.r6_1~740.th~113.wt_5~112.ws_7~740.x0&met.1=1.kmdbecgb~6.0~7.0~8.0~9.0~10.0~12.1~13.h9~14.ha~15.i4~16.lg~17.lg~18.lh~19.qy~20.qy~21.r2~22.ju~23.ju&met.7=CAUQCBgBMO4EOM4HaAFw7QR4wHKAAaNyiAG7zgOwAQG4AQM~CBIQBxgBIKMFKKMFMNEFOC1ApAVIpQVQpQVYxwVgpQVosgVw0AV4-AeAAacEiAHzGKoBFQoTR29vZ2xlIFNhbnM6NDAwLDUwMLABAbgBAw~CBwQChgBIKUFKKUFMKwFOAhopgVwrAV44AeAAf8GiAGEDLABAbgBAw~CBwQChgBIKUFKKUFMK0FOAhopgVwrAV48jeAAdY3iAHtiQGwAQG4AQM~CBwQChgBIKUFKKUFMK8FOApoqQVwrgV4swqAAZcKiAHYE7ABAbgBAw~CCoQChgBIKUFKKUFMLgFOBM~CBwQChgBIKUFKKUFMK0FOAhopgVwrQV4iC-AAewuiAGza7ABAbgBAw~CBsQChgBIKUFKKUFMLAFOAo~CBcQAhgBIKkFKKkFMLEFOAdoqgVwsAV47g2AAf0MiAH9DLABAbgBAw~CCEQBBgBIMYFKMYFMPIFOCxoxgVw8QV4FbABAbgBAw~CCgQBRgBIOIFKOIFMOsFOAlo4wVw6QV4pQGAAZEBiAGPAbABAbgBAw~CBMQAhgBIKEGKKEGMKgGOAdoogZwpwZ42KoBgAHUqQGIAdSpAaoBEAoKZ29vZ2xlc2FucxAbGAKwAQG4AQM~CBMQAhgBIKQGKKQGMKsGOAZopQZwqgZ4tKkBgAGwqAGIAbCoAaoBEAoKZ29vZ2xlc2FucxAbGAKwAQG4AQM~CCgQChgBINQHKNQHMLsIOGdA1QdI1gdQ1gdYjghg5wdojghwpwh4zqcBgAGhowGIAZuvA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4008:801::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 10:41:40 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 10:41:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1611170586013198"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6403
x-xss-protection: 0
expires: Wed, 17 Mar 2021 10:41:39 GMT

GET
H3-Q050 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/221/ Frame 74A7 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/221/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://qr-adv.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://qr-adv.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 4984
date: Wed, 17 Mar 2021 10:39:35 GMT
expires: Thu, 17 Mar 2022 10:39:35 GMT
last-modified: Tue, 08 Dec 2020 21:41:15 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 124
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 KT7npM2pC4VPAEc6AEIcwWkjK4LR7Yu_WhYO7ltjsYQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 74A7 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/KT7npM2pC4VPAEc6AEIcwWkjK4LR7Yu_WhYO7ltjsYQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

293ee7a4cda90b854f00473a00421cc169232b82d1ed8bbf5a160eee5b63b184

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 09:54:00 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 08 Mar 2021 17:45:00 GMT
server: sffe
age: 2859
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5656
x-xss-protection: 0
expires: Thu, 17 Mar 2022 09:54:00 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
224 B 40ms
39ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=221&t=2&li=gda_r20210315&jk=632681917414498&bg=!zM-lz4vNAAYO7zDoDu87ACkAdvg8Wkvdt5x9zwPUZI-iYHX00YJruiDopuqmE7tehJVXP3sYRuBkCAIAAAB6UgAAAA5oAQcKAKlPXk04Wu6OGZJgHd4Wke7xTnsRytOipUiegwQe5x-69lq9QmqAtWPy-BJOppSwiW5twyWy8js3B5apTnsrEBnmlDcreGTluMc4nRu9CmGJi-HPPfNxh-wFRjuseTcWoFz548K6RO4lH_2iACvBh34zJIpH6V2Wy377ZtPQZH1DXaSl7pAtHTUxZ3SI67qRD1zASWW7gVjBJg53psXc1NKIA0wn-1Mg73bimQHbcFKZE3tEBPn29FEvairX1S1CpnoYgQJj8iVjAL4xaiUrMZ7CwORbDF26esYIQPCdQjENb7mDnX02MyYvIUcVDCdZjDlSVkQxy0XWmKmzqsS3u2RsiRDk3Smm2v6zhlCp2CRyyEwQR3WlRz4lDz_zSpk2vJfGPjvq7q41mtEcPXWJr5y9JZtv_nqfqK_pyeqv7mjCJf6xhC6pTMzZuLfTD7uRSBZ_A96khSHC4VyZEQuEVlyF9nqQxKSZsWxkWGDpmcJbx-WzyCHhUEBfT8MYnY0GKzI01A75wURPGfn8F0XnsD0EJ3f2GeQk6gtjuulhgH_2L-czMeyH9CrNZSuQjtzQgWgqok2kgUDTNxvNoJfbdPSsx1xmoeaZ26OXMQ7iHoXLmAdqvvP2P-k4bZGxct7Xze55XiEDIotAo2bkWxjEv9nZHm9EYj7nNLRecvOYb-TAtDnyHUMuERkLTCx7uXcyW0c82dop-4EpoZcU5l0ew9O8gjUFP96b6UhEN6TIVcHsVyWXKZE50AqnuwS7-E9HsTPBeIEGW7pz3tmj85GzXQFPWDFuEHFSCF7043V7l6tIpnVzSR8orhOMHSYGSBtxQja3fbB9DO0HB6vg9biJY7jJlB7bDlRe5Q

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 10:41:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8F8B 42 B
155 B 41ms
41ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuX7rui7dRPEr_JgPx1mcPviIPxISqOKCQEYzPd24gDNTSXk_r-EOa2zHyxqeIgO8CTRFbkq3OuLAAhv3KMNgUwPRoCmfmYSRi95oIfVpk4j-l2eaQnMx3YVbiVOw&sai=AMfl-YQbrZ4X09DyDDe1Hi5qFN9DZNWen7O_-x8vVCVKIMwvLN9aRIQfjEFsvg47omI5mqEpXfx7ItkGh_9q&sig=Cg0ArKJSzMJ3zyhYGzrhEAE&id=osdim&mcvt=1000&p=375,1015,625,1315&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210315&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=4&adk=356343848&rs=2&met=mue&la=0&cr=0&osd=1&vs=4&rst=1615977698724&dlt=501&rpt=33&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 10:41:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4ADB 42 B
66 B 42ms
41ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv4CuEUU_1LaPaPqhsnxWat-bW71zTbwpnDyDQEqdiGzEQzX5_AXDw-MoRKAJlYA3pRI0wEGHdy_YXeMRN7xT3m70hcF8G8cy7W6p7Ds6sFMRFw4dClENyrQwGO7Q&sai=AMfl-YSZdQrMf30wT9PoiHdQgfYGMom5duCE686oZLB2e3jkKgnByO6gNHepTxRVrO5uy121j9JeHdz2JGzt&sig=Cg0ArKJSzIcjqeQDlpU4EAE&id=osdim&mcvt=1000&p=95,436,185,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210315&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=1141840447&rs=2&met=mue&la=0&cr=0&osd=1&vs=4&rst=1615977698700&dlt=651&rpt=52&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 10:41:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 14.2dfb61b890959f78272d.js Show response
s7.addthis.com/static/ 397 B
544 B 28ms
28ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/14.2dfb61b890959f78272d.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

6070049215ef9b98d1b389d67963816172ff29513d34335c5061cd9619a3ea17

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://qr-adv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: W/"5ed917ff-18d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86313600
date: Wed, 17 Mar 2021 10:41:40 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 304

Verdicts & Comments Add Verdict or Comment

91 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 16:53:01	Name: DSID Value: NO_DATA
.qr-adv.com/	1970-01-20 02:14:33	Name: __gads Value: ID=5aded0f61cabb70c-22217a7c1aa70017:T=1615977698:RT=1615977698:S=ALNI_MbD6J0lDy-w5S0tiBHP3FbtLKJLwg
.doubleclick.net/	1970-01-20 02:14:33	Name: IDE Value: AHWqTUnlfen9jBY1ldAvyZ8ANDevSyesH3h7QNlPRG7HEV300_mc_WmIF0Ur4SmLSGQ
.qr-adv.com/	1970-01-19 16:52:57	Name: _gat Value: 1
.doubleclick.net/	1970-01-19 16:52:58	Name: test_cookie Value: CheckForPermission
.qr-adv.com/	1970-01-20 10:24:09	Name: _ga Value: GA1.2.900089674.1615977698
.qr-adv.com/	1970-01-19 16:54:24	Name: _gid Value: GA1.2.185792168.1615977698
qr-adv.com/	1969-12-31 23:59:59	Name: shorturl Value: 6863pmb0vfs0dbfjlqs9o1th31
qr-adv.com/	1970-01-19 16:52:59	Name: __atuvs Value: 6051dce21137c7af000
qr-adv.com/	1970-01-20 02:23:08	Name: __atuvc Value: 1%7C11
.qr-adv.com/	1970-01-19 17:36:09	Name: __cfduid Value: dbba4d4c2a52d20f1f8f3c11c32bb199b1615977697

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
api-public.addthis.com
clck.ru
csi.gstatic.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
pagead2.googlesyndication.com
partner.googleadservices.com
qr-adv.com
s7.addthis.com
sba.yandex.net
securepubads.g.doubleclick.net
themes.googleusercontent.com
tpc.googlesyndication.com
v1.addthisedge.com
www.google-analytics.com
www.google.com
www.googletagservices.com
www.gstatic.com
z.moatads.com
104.75.88.112
142.250.185.162
142.250.186.162
184.30.21.162
2606:4700:3031::ac43:dd6a
2607:f8b0:4008:801::2003
2a00:1450:4001:800::200e
2a00:1450:4001:802::2001
2a00:1450:4001:808::2002
2a00:1450:4001:809::2001
2a00:1450:4001:810::2002
2a00:1450:4001:810::2004
2a00:1450:4001:811::2003
2a00:1450:4001:812::2002
2a00:1450:4001:812::2003
2a00:1450:4001:813::2002
2a00:1450:4001:813::2004
2a00:1450:4001:827::2002
2a00:1450:4001:828::2002
2a00:1450:4001:828::200e
2a00:1450:4001:82a::200a
2a02:6b8::221
2a02:6b8::232
0376556b5313dc3dad1b691b163b53050b18ffcafe9a09be7995df5a3468c909
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34
07868401a56635b4e357e2c7aab09f8e026185a09cc5de5beb60a1fcbcd64315
08cf37457213462052c6597a2d774bfd0d83400c927c2d973400f89c0e707fa5
0bd297a38fb7b928e03194e67397a73d76f90379207c12e5b8e73f123c4d529a
0cca1034384d1368a8daf623a89f06cdde4dea4e203ce6fe3dc43ec831118fef
0d8643e2af6ead7b7041891b4d68ace467e47548bef7cdbab1922e0a12440b5f
0db91532815790fa85ae602886d621fb2bd429ba2c9c85aac1d31751e3fdbadb
0e5c3073c2046f68677a868000fd508f7d454e01af5dc863d8705d422ce5ea48
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
185acc66772f8a3fd8f2cee0b7c3f06a9ec5fb27abc7d2b098fa68ec91d4a86f
196be374b361fd98656bd697bfbd25407a224d04a6d0976410447b5e165dd938
19820a113bb1d006964ac41987870d4888583c97d0bbcc5171b3a729428541db
19a26d6046c4fcfe9e3efbc1fb7532f424c6b0b7590b9e193788e30bce8b9836
1b460d3e5fd4006806d73d7f47f2aa0c4f57df9bd619f4fdf63fad6284182b0a
1c1a7e08b514f047fd9953c3b102130f01e676cb317bc95c8e8f59ed88d2fddb
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
22d2597fbeb86e479af0b8e70f37198a9a52e0013084eafbdaa715d092df82af
287d01ceb941124c1e21d4a6a37f20c0eb4dbcfadd94c8c41042f589a0fe3296
293ee7a4cda90b854f00473a00421cc169232b82d1ed8bbf5a160eee5b63b184
30b84b640093e4fa8ef37d461d0f495a73695c2c03eaa1a9297d3884ef226c7f
3477e8fe3b7becd59943c9497c9a6cdcb7768f59f5c0bba0bcf981c923b25c6b
3b048e6d83d332e30a02f95aa0bfb5169e9f1a99b91945d6de5c45f2be1ebf46
3ef295be877353849482d68679c80fa153bf56c6ee4e1f5332ef62b6c60ae596
45d71cb118c07d93b0bb139fe0a8e9645d26a30efab41cc0f983ee31a0c6df9a
4634b94630896f1a23c5ce01f743d720847c5f4dd28fb549ed503cb2df4f8e87
49d656ad802b7956f6fe4ba2ffd24c8c49745a537096d7273b4d534ea6c45f82
49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504
4de1d9179fcdb8fea93a9aeee6d17f5b1e1d26042f7ba795cbd91db1b382aea4
4f5953f9b2d7c8b881274830e1631bf3abda43946a307873e44505b8b1796898
57532d07103088a868f37b813377ca409585e04802671b9c442ca39d8ee70cf0
5823d757c636340f9bf54605c128d24db476e36e7e40ae08a8a5f232d7457c5f
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f
5f75520dc2f01340163664bff9c61dee64f4f558006ff589f605f2ecaec306e7
6070049215ef9b98d1b389d67963816172ff29513d34335c5061cd9619a3ea17
6c3ca64b7acfdd29b3ca6f1b9b46696369abd462d4546182085c347f72211841
6c8ddfad20e38be0c8d5ec9682e4fc923caa79e973651db3a9ae7b0d8c0537e0
6ee9648a7ce12de5c9a48064a6fcef51d5e66100bfc86b848a012985bf5f1de3
6f20570a8613040f81ea37ae604c05c0cd7adc4f8b2ea880bfc5c10beedf31e5
7331e568d44900f570f233a6cc0022a6a8f272f6fdabcae6ddc2092fe1c00c1a
74671ab79c0924e3d0e9b377c7bf2b6f9b60671df32c8a51808186615b5ce01d
74701d1b03dcb606710d7cc01bbf35a36ad5e5e443e33e55894a013f0d65aacf
74be4c34f7ab076bc7be1f685597904c2849c6ca8e935fd65340e5b5764982c9
79c521a89112af803faa48f72e1f5f1b5d0685129a14b917317d1cc688613a18
7a19841dbc05d4c521b5ae3a6fc7f89bf49ea726e6483b5ccbb9b0291940b89f
7adca3a48d9202190836b2fdb7375c122d0e6f95cfba0ec83082a84184b3d529
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
7e62942d5b86ffa5bc910541ad5b612b8bffcf96adc2ef306648def54e146054
803292ceec966b37ca72127b471f8c8e24bdd49d11d4f72202250dd7c6986919
83bd1d830259123db75c68ad0d072da0e1f58ba8044f489031d1425901c60fec
83f3e4d0df57b9d3e64133e036557ccc4042116f182c9bd95772145e25053ba2
8597d4568b08225047adcdc8fd12c6cb3e9d853a9c440c05b8fc76ac6cc63679
8960044e9160cd3a1ac54275b80420514459ab6352fab9986d7dc5d203e5321b
8ff65ee19b00017e1879f2488c020bfd2dd861f248ab37e61a36f8194166844d
90556675373ea9ed1d0e9b5678426d69296b6801c906ca378bb426aa3d6acdc3
9d6f76318fa8b3ed0fd4c0c1544804ce897c3db006c47ca5c3356b27d1afff3d
9e9879c6bbf02db02221f70cf37b319ca1c7a5950e7c5db68ca82f63ab382ae1
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a242d868ad5898827886e1e1d570172d4a72e11ce0b46c92a68e4f5943fb2f37
a291fbd6a29b44aaee1bafcd5974028181bf056b627c95b2dbb841e3ea9f4f16
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a851d97fcc71c78ca279754fabc2289a600aabecec4d9e4387cab9c7400aa2d0
aa5d486a992d96fe0a780253e7441da9ce88d21b48e59a778c7d4fd9da799094
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
aefebcfb111378fd1b856f75082e41117c0c4c6b483a909a3c2f2322817afc3e
b007a7abd35d50586bad7e196fc8a1540cbd7b2d6322f3c583f7bf4c07217df7
b18fa4e3bbd5e917b1ced256dfd79d381872c6ea93e460e20ed552314bf338ab
b5d7a28c9d4b8b842b5dd259ae0ee10b5366b532a90e2881d8ed17f3da9b645f
b628dbcc44582120e5ab4cefc1883680193d16192d78bb809b1c044cc742c49f
b7ed0bfc8e35a28042c39a4f594acc38f7dacd5dc07de852e90e88b3ac781cee
b94658eb1706483b436d58133e33f33b9b053a25200253d98ba446cc69e35b86
b9dae434b225e4750e1e8283e35a66705ca6ac543689b10dabb5c0e15edd0eed
bb74e0857a515bba7514be5880db482d5e2f32047b5b27bed2b8d064e731b094
c2a24d4e9d42317158d2ac1952521d72ec44a68db78b170f494f7826a5ad6130
c36024833d70e4a0c6f203dfdca90922de4a0fd864a856e843975d844737f327
c44ef8885a1386dad99986e4de63457883d50b1a966d27b502f37d691d7bd770
c5a0b8523ed52dfff8b07b61549ed61cc80c8b75529ce84a591bc25c9d7289e0
cd06ab94d3fe081043ea16f641688a2c743bef33f7dfe4c8a0a1edc3292ca15b
cd0e6f9fbe497b6a0346fde3934cbcbd7c557a334c27bb34e69c7ed430ed4a45
cd973c2b1ef865b051fc1845de9ae66cbb072a601e4bda7157f3a986b1fea0df
cdf1ece48b051ae803492c05ede92ac49c60aee50095ab7d06cd9c9e6085a296
ce7beabb58b8a3f6215c7eab83bd3d6b3166e8359696c8a5a767eaa09420c3b6
d2338264d0a534c6c39c080c07cf773e613e3c769cef96e5e6529f0988ffbdcb
d37880e1cebd4f4df68e26475d8fcf50e43c7e83921e3c69627797f1861afe3b
d5602ee7353f613eec3678621f01a5612bb21d79c44cfa04a26faed17c42c43d
d9bf9bcbd42d52fbb94b6468ecaa7b038c6f5b8a76d807960a214e61e84166e9
d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39
da6f3508fdb8c1fdf553e4af5556b585ba5998139afe613d56dc0d88c822bd81
db3278692c721622a3d0329dabcece810924f7479abb624604231bf121ebc98d
db7ea5ae79f5c5d50f5eadd1fa4dc5b6e706ecea231ceda770b15f6b4fbe926a
df1c43c5ed5cb5e84db3d60979a61fd95ad677117752d29afbceb1f4f06f1409
df4432172533296e1270a70a80d47d6e388ea75fed18bf975e0840405ee23294
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4f924eac92aa3cc4ea64f2891447e8bd3af49e1a5c0bcd04b7356e2f7f1c04c
e7b70b3fba8e06f2fa4d71ab22432042a068e764ec2b0580d40fa05e36bde065
ebb43f1daf88b25aad59fa54604c5b4eb63e7f026ad303d8e3e98a9c90b6a472
ec9ed49e63ac6dfc77f4cace2597d3de0e846788cef120da6531dc140ca635c3
ef18f5729c9570101576addb2aec8d460d5f481a63e2580a3da7401fafcf91be
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef4e95086fd767b25e35f550f291b187eeada2a376e06df49e1417e7dffa9fe9
f14a53d6e112f5652255e499e109659fe79678b0de2eec4f42a1ac48c9ce72bd
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
f9d05793ddacf41d51a255e9ea719278d6f910885cf3a6895fb8658613996059
ffff5170ec6b0bcdeac4abec181cbf6b06f9afd9d78948e54bc20b028e00ae9d

qr-adv.com Open in urlscan Pro 2606:4700:3031::ac43:dd6a Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

128 Requests

66 %HTTPS

83 %IPv6

16 Domains

22 Subdomains

20 IPs

3 Countries

1302 kBTransfer

3414 kBSize

11 Cookies

2 Outgoing links

Page URL History

Redirected requests

128 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

qr-adv.com Open in urlscan Pro
2606:4700:3031::ac43:dd6a Public Scan

Screenshot
Live screenshot

Full Image

128
Requests

66 %
HTTPS

83 %
IPv6

16
Domains

22
Subdomains

20
IPs

3
Countries

1302 kB
Transfer

3414 kB
Size

11
Cookies

128 HTTP transactions
4 data transactions