game.gnlore.com Open in urlscan Pro
167.88.125.7 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://game.gnlore.com/victoria-3-product/
Submission: On September 24 via api (September 24th 2023, 6:20:13 pm UTC) from US — Scanned from DE

Summary HTTP 195 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 40 IPs in 10 countries across 36 domains to perform 195 HTTP transactions. The main IP is 167.88.125.7, located in Atlanta, United States and belongs to RAMNODE, US. The main domain is game.gnlore.com.
TLS certificate: Issued by R3 on August 3rd 2023. Valid for: 3 months.

This is the only time game.gnlore.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
26	167.88.125.7 167.88.125.7	3842 (RAMNODE) (RAMNODE)
32	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:82a::2008	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:812::2016	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
2 12	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c02::9d	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
22	2a00:1450:400... 2a00:1450:4001:806::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
4	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
6 24	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
3 7	104.18.27.193 104.18.27.193	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 5	185.89.210.244 185.89.210.244	29990 (ASN-APPNEX) (ASN-APPNEX)
4 4	35.157.117.145 35.157.117.145	16509 (AMAZON-02) (AMAZON-02)
1 1	35.204.74.118 35.204.74.118	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
2	18.196.96.246 18.196.96.246	16509 (AMAZON-02) (AMAZON-02)
2	178.250.7.11 178.250.7.11	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2 2	51.75.86.98 51.75.86.98	16276 (OVH) (OVH)
16	2a00:1450:400... 2a00:1450:4001:81c::2006	15169 (GOOGLE) (GOOGLE)
2	2a02:fa8:8806... 2a02:fa8:8806:20::2040	41041 (VCLK-EU-SE) (VCLK-EU-SE)
1	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
2 2	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
1 1	2a05:d018:d29... 2a05:d018:d29:3602:92bc:acd1:fb60:2d82	16509 (AMAZON-02) (AMAZON-02)
3 3	37.157.4.29 37.157.4.29	198622 (ADFORM) (ADFORM)
4	144.76.238.55 144.76.238.55	24940 (HETZNER-AS) (HETZNER-AS)
1 4	138.201.64.38 138.201.64.38	24940 (HETZNER-AS) (HETZNER-AS)
2	216.58.206.34 216.58.206.34	15169 (GOOGLE) (GOOGLE)
2	145.239.193.130 145.239.193.130	16276 (OVH) (OVH)
1	2a0b:4d07:102::1 2a0b:4d07:102::1	44239 (PROINITY ...) (PROINITY PROINITY)
1	18.134.234.224 18.134.234.224	16509 (AMAZON-02) (AMAZON-02)
1 2	142.250.181.230 142.250.181.230	15169 (GOOGLE) (GOOGLE)
1 1	94.23.99.218 94.23.99.218	16276 (OVH) (OVH)
1	104.64.118.247 104.64.118.247	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	151.101.66.49 151.101.66.49	54113 (FASTLY) (FASTLY)
1	2a05:d01c:1d8... 2a05:d01c:1d8:8102:d9e9:4576:4b39:3a88	16509 (AMAZON-02) (AMAZON-02)
1	52.222.139.78 52.222.139.78	16509 (AMAZON-02) (AMAZON-02)
1	99.86.4.53 99.86.4.53	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:81c::2002	15169 (GOOGLE) (GOOGLE)
2	3.8.252.32 3.8.252.32	16509 (AMAZON-02) (AMAZON-02)
195	40

26 167.88.125.7 (Atlanta, United States)

ASN3842 (RAMNODE, US)

game.gnlore.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2016 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

i.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c02::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2a00:1450:4001:806::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 142.250.185.162 (United States) 6 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.18.27.193 (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.89.210.244 (Germany) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.157.117.145 (Frankfurt am Main, Germany) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-117-145.eu-central-1.compute.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.204.74.118 (Ascension Island) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 118.74.204.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.196.96.246 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-96-246.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.7.11 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.75.86.98 (United Kingdom) 2 redirects

ASN16276 (OVH, FR)
PTR: ip98.ip-51-75-86.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:81c::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:fa8:8806:20::2040 (Sweden)

ASN41041 (VCLK-EU-SE, US)

dclk-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.71.131.137 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.186.193.173 (Mountain View, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com

gcm.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ipac.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:d29:3602:92bc:acd1:fb60:2d82 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.157.4.29 (Denmark) 3 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 144.76.238.55 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.55.238.76.144.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.64.38 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.38.64.201.138.clients.your-server.de

hal900011.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.206.34 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s10-in-f2.1e100.net

ade.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 145.239.193.130 (France)

ASN16276 (OVH, FR)

pv.medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a0b:4d07:102::1 (Switzerland)

ASN44239 (PROINITY PROINITY, CH)

adv.office-partner.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.134.234.224 (United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-134-234-224.eu-west-2.compute.amazonaws.com

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.230 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f6.1e100.net

8019191.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.23.99.218 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: ip218.ip-94-23-99.eu

medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.64.118.247 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-64-118-247.deploy.static.akamaitechnologies.com

www.awin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.49 (United States) 1 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8102:d9e9:4576:4b39:3a88 (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.139.78 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-139-78.ams50.r.cloudfront.net

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.4.53 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-53.fra6.r.cloudfront.net

cdn.track.production.webgains.team	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.8.252.32 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-8-252-32.eu-west-2.compute.amazonaws.com

api.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
56	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 122 tpc.googlesyndication.com — Cisco Umbrella Rank: 169 ade.googlesyndication.com — Cisco Umbrella Rank: 333	561 KB
40	doubleclick.net 9 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 66 stats.g.doubleclick.net — Cisco Umbrella Rank: 175 cm.g.doubleclick.net — Cisco Umbrella Rank: 329 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 433 8019191.fls.doubleclick.net — Cisco Umbrella Rank: 293895	172 KB
26	gnlore.com game.gnlore.com	998 KB
16	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 408	8 MB
8	redintelligence.net 1 redirects hal9000.redintelligence.net — Cisco Umbrella Rank: 35069 hal900011.redintelligence.net — Cisco Umbrella Rank: 269045	39 KB
7	casalemedia.com 3 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 1026	4 KB
6	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2225 www.google.com — Cisco Umbrella Rank: 11 adservice.google.com — Cisco Umbrella Rank: 182	1 KB
5	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 360	4 KB
5	gstatic.com www.gstatic.com fonts.gstatic.com	130 KB
5	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1368 www.googleadservices.com — Cisco Umbrella Rank: 178	605 B
4	w55c.net 4 redirects pm.w55c.net — Cisco Umbrella Rank: 1562	3 KB
4	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 254	228 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 111	290 KB
3	webgains.io analytics.webgains.io — Cisco Umbrella Rank: 34232 api.webgains.io — Cisco Umbrella Rank: 72808	18 KB
3	medialead.de 1 redirects pv.medialead.de — Cisco Umbrella Rank: 42019 medialead.de — Cisco Umbrella Rank: 41634	1 KB
3	adform.net 3 redirects c1.adform.net — Cisco Umbrella Rank: 954	2 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 113	3 KB
3	ytimg.com i.ytimg.com — Cisco Umbrella Rank: 102	78 KB
2	ctnsnet.com 2 redirects gcm.ctnsnet.com — Cisco Umbrella Rank: 51511 ipac.ctnsnet.com — Cisco Umbrella Rank: 7500	1 KB
2	dotomi.com dclk-match.dotomi.com — Cisco Umbrella Rank: 5383	207 B
2	onetag-sys.com 2 redirects onetag-sys.com — Cisco Umbrella Rank: 1153	678 B
2	criteo.com dis.criteo.com — Cisco Umbrella Rank: 910	725 B
2	bidswitch.net x.bidswitch.net — Cisco Umbrella Rank: 614	291 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 96	21 KB
1	webgains.team cdn.track.production.webgains.team — Cisco Umbrella Rank: 104278	3 KB
1	innovid.com ag.innovid.com — Cisco Umbrella Rank: 2427	296 B
1	everesttech.net 1 redirects sync-tm.everesttech.net — Cisco Umbrella Rank: 1237	544 B
1	awin1.com www.awin1.com — Cisco Umbrella Rank: 16620	702 B
1	webgains.com track.webgains.com — Cisco Umbrella Rank: 44441	2 KB
1	office-partner.de adv.office-partner.de — Cisco Umbrella Rank: 312847	931 B
1	yahoo.com 1 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 783	717 B
1	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 637	265 B
1	rlcdn.com id.rlcdn.com — Cisco Umbrella Rank: 1301	98 B
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 1332	714 B
1	google.de www.google.de — Cisco Umbrella Rank: 3974	408 B
0	gemius.pl Failed googlecm.hit.gemius.pl Failed
195	36

	Domain	Requested by
32	pagead2.googlesyndication.com	game.gnlore.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com s0.2mdn.net
26	game.gnlore.com	game.gnlore.com
22	cm.g.doubleclick.net	6 redirects googleads.g.doubleclick.net game.gnlore.com
22	tpc.googlesyndication.com	googleads.g.doubleclick.net game.gnlore.com tpc.googlesyndication.com s0.2mdn.net pagead2.googlesyndication.com
16	s0.2mdn.net	game.gnlore.com s0.2mdn.net
12	googleads.g.doubleclick.net	2 redirects pagead2.googlesyndication.com googleads.g.doubleclick.net
7	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
5	ib.adnxs.com	3 redirects googleads.g.doubleclick.net
4	hal900011.redintelligence.net	1 redirects googleads.g.doubleclick.net hal900011.redintelligence.net
4	hal9000.redintelligence.net	googleads.g.doubleclick.net hal900011.redintelligence.net
4	pm.w55c.net	4 redirects
4	www.google.com	googleads.g.doubleclick.net tpc.googlesyndication.com
4	www.googleadservices.com	game.gnlore.com
4	www.googletagservices.com	googleads.g.doubleclick.net
4	www.googletagmanager.com	game.gnlore.com www.googletagmanager.com adv.office-partner.de
3	c1.adform.net	3 redirects
3	fonts.gstatic.com	fonts.googleapis.com
3	fonts.googleapis.com	googleads.g.doubleclick.net hal900011.redintelligence.net
3	i.ytimg.com	game.gnlore.com
2	api.webgains.io	analytics.webgains.io
2	8019191.fls.doubleclick.net	1 redirects game.gnlore.com
2	pv.medialead.de	hal900011.redintelligence.net googleads.g.doubleclick.net
2	ade.googlesyndication.com	game.gnlore.com
2	googleads4.g.doubleclick.net	game.gnlore.com
2	dclk-match.dotomi.com	googleads.g.doubleclick.net
2	onetag-sys.com	2 redirects
2	dis.criteo.com	googleads.g.doubleclick.net
2	x.bidswitch.net	googleads.g.doubleclick.net
2	www.gstatic.com	googleads.g.doubleclick.net
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	adservice.google.com	8019191.fls.doubleclick.net
1	cdn.track.production.webgains.team	googleads.g.doubleclick.net
1	analytics.webgains.io	track.webgains.com
1	ag.innovid.com	googleads.g.doubleclick.net
1	ipac.ctnsnet.com	1 redirects
1	sync-tm.everesttech.net	1 redirects
1	www.awin1.com	googleads.g.doubleclick.net
1	medialead.de	1 redirects
1	track.webgains.com	game.gnlore.com
1	adv.office-partner.de	hal900011.redintelligence.net
1	pr-bh.ybp.yahoo.com	1 redirects
1	gcm.ctnsnet.com	1 redirects
1	match.adsrvr.org	googleads.g.doubleclick.net
1	id.rlcdn.com	googleads.g.doubleclick.net
1	um.simpli.fi	1 redirects
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.google.de	game.gnlore.com
1	region1.analytics.google.com	www.googletagmanager.com
0	googlecm.hit.gemius.pl Failed	googleads.g.doubleclick.net
195	50

This site contains links to these domains. Also see Links.

Domain
www.gnlore.com
tw.bignox.com

Subject Issuer	Validity	Valid
game.gnlore.com R3	`2023-08-03` - `2023-11-01`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
edgestatic.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2023-02-02` - `2024-03-03`	a year	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2023-03-23` - `2024-03-23`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-19` - `2023-10-18`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2023-08-15` - `2024-09-15`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
redintelligence.net R3	`2023-08-11` - `2023-11-09`	3 months	crt.sh
pv.medialead.de R3	`2023-08-13` - `2023-11-11`	3 months	crt.sh
adv.office-partner.de R3	`2023-08-29` - `2023-11-27`	3 months	crt.sh
*.webgains.com Amazon RSA 2048 M01	`2023-05-15` - `2024-06-13`	a year	crt.sh
www.awin1.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-10` - `2024-03-09`	a year	crt.sh
*.innovid.com RapidSSL TLS RSA CA G1	`2023-03-15` - `2024-04-14`	a year	crt.sh
*.webgains.io Amazon RSA 2048 M01	`2023-07-24` - `2024-08-22`	a year	crt.sh
cdn.track.production.webgains.team Amazon RSA 2048 M03	`2023-08-30` - `2024-09-27`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh

This page contains 26 frames:

Primary Page: https://game.gnlore.com/victoria-3-product/
Frame ID: 3BF84D848B48E3F97436AEC9E83F3A3A
Requests: 44 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230920/r20190131/zrt_lookup.html
Frame ID: 8AA3734E275C3AC56C0B28ACB310BFA7
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&adk=1812271804&adf=3025194257&lmt=1695572408&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x675_l%7C212x675_r&format=0x0&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579608171&bpp=19&bdt=1125&idt=215&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5085991068093&frm=20&pv=2&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=245
Frame ID: E1D63981A0C24AEE94EA00E1527B4481
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=280&adk=935936864&adf=614321402&pi=t.aa~a.1043414356~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695572408&rafmt=1&to=qs&pwprc=6114872683&format=1200x280&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579608191&bpp=2&bdt=1146&idt=230&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=167&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=rzLliOD7Gr&p=https%3A//game.gnlore.com&dtd=234
Frame ID: BFA45D2B6FE30C3AF854FBDDA897AF7C
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2736490106&adf=2334466290&pi=t.aa~a.308491958~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280&nras=3&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=2115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cltBAE1Jvg&p=https%3A//game.gnlore.com&dtd=5
Frame ID: 170EF0FE1268F55BAB3071356B782A76
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=280&adk=2767623100&adf=1730821504&pi=t.aa~a.2296496848~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x280&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2100&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250&nras=4&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2467&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=HmtLWhpJ9o&p=https%3A//game.gnlore.com&dtd=31
Frame ID: AAC20BE1907291027959F6DA58FC70BE
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=90&adk=3130937508&adf=226233620&pi=t.aa~a.1154693969~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x90&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250%2C1200x280&nras=5&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2757&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=xuohkQVNe2&p=https%3A//game.gnlore.com&dtd=37
Frame ID: 90A06C89CB7A18DC0221F0E1B19D0976
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js
Frame ID: E1B55541934136AE8AB15360F0C06A15
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsY5er4xgEwAQ&v=APEucNX_ApAbhUqPFSk_Wk-9hwYZ1p3pVqDLNH4DR21sIWP3qqk1-lFU7bRZC8REfB8WTEUZxg672lhzc724k7YxxKcCiyYJEoH6b-Q2e1sZ-iwsVHZTPu2IjsFZ-Js6GOHh_9jEUL6F7b1x5213XYegrNZkLTwVLmkZX5P1lzgo0aqb3fvv1MI
Frame ID: B68FBE42F5A0650AC56B4AB80DA30FEA
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: 7A28B26C53217CC71261FE6295F3D0A8
Requests: 20 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: EBCF211FCB7FADFA9BBD7963AA8E096E
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNVAEJ5lSgDp7EBmnMcT6C0_zn4VvN-7pP0HYLK6PxYo3eXUzFK9mOl5UUJ4_eNw9wURcInYOBxuah_MZ_DyTSUSvTlsESqPCooHflbvF0Q6sbqu5gFZahWe8BwHyawzOA8R3vTcrW288iQv0H0jcfvFd9l_BAdfrm8-o3GxYBwSt_BaTJg
Frame ID: C3A1EB6857F74DEFF73B6BC7C3593EE0
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: 74622898450CAD4D6CB23EF12615D2A8
Requests: 21 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 82E7E57EFE0D7CAF41A86BE58B229AFB
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 984CA65B1310DD43494F7E5A7C1938D9
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js
Frame ID: 55ECA83A6D7381DD0236A0A060540E99
Requests: 1 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250
Frame ID: C09C0F341122C7BD6857B364FAF7308F
Requests: 17 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 4C21DAF0DFD7A04586F84D963734D56F
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/tGcDLxZnxcZjneq6ZTfMhLSKmVRaNAcBIKHxIKG0fIc.js
Frame ID: 11748505AB5774625A8C1A861E419C38
Requests: 1 HTTP requests in this frame

Frame: https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=93569300126359104444550012457011&t=htlp&gdpr=1&consent=1&gdpr_consent=
Frame ID: 12A2CBCAB19FE42A86F87DF78171F0A4
Requests: 1 HTTP requests in this frame

Frame: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Frame ID: BB2AAB8E9E62BEF79544ACD55EBBC5A3
Requests: 3 HTTP requests in this frame

Frame: https://8019191.fls.doubleclick.net/activityi;dc_pre=CLXtlaPuw4EDFerhOwIdEoEFLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=196151741010.29974
Frame ID: B059C399EC3B0800E337E52237450323
Requests: 2 HTTP requests in this frame

Frame: https://hal900011.redintelligence.net/request_content.php?s=93569300126359104444550012457011&a=8fc18f8a
Frame ID: ACB0E5C36EA41A81FA57EDA2D82F0AA4
Requests: 6 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: CA7EFE0369ECA5859576125AAA5F76AD
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 321D701E093F31B0B304DA7E74B8275B
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 6F652B2E4D5E1676C99E193EE428A7AB
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

維多利亞３（Victoria 3）Grand版、標準版、特典、季票、價格 – Gnlore

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Webgains (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

analytics\.webgains\.io

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

195
Requests

87 %
HTTPS

45 %
IPv6

36
Domains

50
Subdomains

40
IPs

10
Countries

10921 kB
Transfer

13457 kB
Size

29
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.gnlore.com/service/
Title: 服務

Search URL Search Domain Scan URL

URL: https://tw.bignox.com/?utm_source=gnlore
Title: 夜神模擬器

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 58

https://googleads.g.doubleclick.net/pagead/adview?ai=CT0w02H0QZYHEHJnU6gS-nIPQDLPHsKNui-H925QM2tkeEAEgjOqWfmCVgoCAmAegAa6YiqICyAEJqQJhMUYfcd-xPqgDAcgDywSqBPcBT9AgqHzTz2mi_kPWjXRgfHcZRjCqW7K0hx7JsoNVlKaAhK7CuAmp_JaMnctxnU5PCRrP0wNeMXJ88YBBIUIwWq39zh6WPqRbUqUx5vUUT5pSouOB_Fe8qFGcrYa8CXfKtDa1mUXFjeGQN3leEliH0H0SsoQdsVg5AGFGZTQ85qY8LDkTUqmJNEZF-dDvy3TL6VYz2T8P_8a4ZLJCV4hBBoQc94NfS_9uQKL6qNRaQAcZoWDxv4Pbtvsm4hOOap1-AiXnyMZA58Eg7i8Cp_ehu4o8uNt4dZ4btr31iITgD_-LLojgc0yodyk1F2yKaVb3VrPAMU2_28AE9ZXJnIQDiAWT-vmMKJIFBAgEGAGSBQQIBRgEoAYugAe65_XdAagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEENSJCNIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqaCSBodHRwczovL3hjcmFmdC5uZXQvcmVnaXN0cmF0aW9uL4AKAcgLAdgTDIgUA9AVAYAXAbIXHAoaCAASFHB1Yi0yNjEyNjM3Mjk2MjM0NzI5GAA&sigh=kpvReXtxeVk&uach_m=[UACH]&ase=2&nis=4&cid=CAQSGwBpAlJWtJbrDxJqzR0uttsbWFUy_LjtET62xBgB&template_id=5000&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2216756744097079510749%22,%22debug_reporting%22:true,%22destination%22:%22https://xcraft.net%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22608341038%22],%224%22:[%2209-24%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%226043714218688844257%22}&andc=true

Request Chain 69

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEOQ2tu-uk8j-oiEqdll0kA&google_cver=1

Request Chain 70

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZRB92R7NijsLMpH9ipPWMAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJHRGgMUGCNqO7ShbIZIknY&google_cver=1

Request Chain 71

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEDu3Jwv4wmL2OC98sWoHVGc&google_cver=1

Request Chain 72

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk3NDc5NzQxNTUxMDcyMzQwNQ%3D%3D

Request Chain 97

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEEQaIPn0naOvH_Ov9JtF0fE&google_cver=1&google_push=AXcoOmRLdkrMVFA8F4C-g-wIbwDirhYFaZhmsi2GDDuuTCw0TdOkHVsw9SVNzcFUdU6DulIR1sgUUxlXUYouIMDD00rRk0NCmT9q67c HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEEQaIPn0naOvH_Ov9JtF0fE&google_cver=1&google_push=AXcoOmRLdkrMVFA8F4C-g-wIbwDirhYFaZhmsi2GDDuuTCw0TdOkHVsw9SVNzcFUdU6DulIR1sgUUxlXUYouIMDD00rRk0NCmT9q67c HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=aTF4SENGOXYxUUt0SWU1&google_gid=CAESEEQaIPn0naOvH_Ov9JtF0fE&google_cver=1&google_push=AXcoOmRLdkrMVFA8F4C-g-wIbwDirhYFaZhmsi2GDDuuTCw0TdOkHVsw9SVNzcFUdU6DulIR1sgUUxlXUYouIMDD00rRk0NCmT9q67c

Request Chain 98

https://um.simpli.fi/gp_match?google_gid=CAESEP7Jnf7CqiNK6HXFizDEt-s&google_cver=1&google_push=AXcoOmTQSZIj1UkbUVeGyqxVIpW5Dck6Tlh4yp0UZ9WF25Dp4afILew9ZsvseCYQ8_T61nqaLsJAE3iLgPsZxf4oNM489NYhbJwh-w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=41F3CDC676584E19AF349086F837717E&google_push=AXcoOmTQSZIj1UkbUVeGyqxVIpW5Dck6Tlh4yp0UZ9WF25Dp4afILew9ZsvseCYQ8_T61nqaLsJAE3iLgPsZxf4oNM489NYhbJwh-w

Request Chain 102

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEJMva3Zu75bIznNdG5wFaJ4&google_cver=1&google_push=AXcoOmQCVdCOs5NO9mQ1rvy4kapHjmnhuUtHdJQkludkMkhirpEdLGdC-lF2yt1Bt_s6TUNmLCQHkE9Mt7_d7g2S9_zAvLqV_SOqpyg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQCVdCOs5NO9mQ1rvy4kapHjmnhuUtHdJQkludkMkhirpEdLGdC-lF2yt1Bt_s6TUNmLCQHkE9Mt7_d7g2S9_zAvLqV_SOqpyg

Request Chain 111

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJHRGgMUGCNqO7ShbIZIknY&google_cver=1

Request Chain 112

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZRB92R7NijsLMpH9ipPWMAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJHRGgMUGCNqO7ShbIZIknY&google_cver=1

Request Chain 113

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESELafMlP-UhULMeZ8KlrLsbo&google_cver=1

Request Chain 114

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk3NDc5NzQxNTUxMDcyMzQwNQ%3D%3D

Request Chain 116

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEBT8NKSvlG2xHx4xBZ0DABw&google_cver=1&google_push=AXcoOmQJ6jS08H-Igjt_Vi7d81Qzbm2rMM9jEZvHe0slY1j_-I739Ug4XnVWw-RDKvKG0T-zaUUvcZ68l0xAgR5lrUmn3_5AOf51414 HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEBT8NKSvlG2xHx4xBZ0DABw&google_cver=1&google_push=AXcoOmQJ6jS08H-Igjt_Vi7d81Qzbm2rMM9jEZvHe0slY1j_-I739Ug4XnVWw-RDKvKG0T-zaUUvcZ68l0xAgR5lrUmn3_5AOf51414 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=WXUxZFplNkwxUUt0SWU1&google_gid=CAESEBT8NKSvlG2xHx4xBZ0DABw&google_cver=1&google_push=AXcoOmQJ6jS08H-Igjt_Vi7d81Qzbm2rMM9jEZvHe0slY1j_-I739Ug4XnVWw-RDKvKG0T-zaUUvcZ68l0xAgR5lrUmn3_5AOf51414

Request Chain 118

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEOfTM2EcZ4wx5LdfYLuMBQg&google_cver=1&google_push=AXcoOmSKNXA33-7NJWSLXlzdb0A2Jk3VrHuDS6VYlS2AGw6-28eIHfygVvQUxsXmb3DXXpAdEmAsUWPVdEk4hLi3ggTFB433TCbF9AqY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmSKNXA33-7NJWSLXlzdb0A2Jk3VrHuDS6VYlS2AGw6-28eIHfygVvQUxsXmb3DXXpAdEmAsUWPVdEk4hLi3ggTFB433TCbF9AqY&google_hm=1_uenND4RdaPKsU19MAS_IU

Request Chain 119

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECvwASSn103JgOOgKkyyz_U&google_cver=1&google_push=AXcoOmRoJzpYbOZ42a6dkOQbmHzVmHGGdAxrTbn56eMrJXPeiu0Tx9g0WLnIN4MgFgrkkp5WqPpqfpDQur8oH2l1UUwr7PMQHNlvTg0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRoJzpYbOZ42a6dkOQbmHzVmHGGdAxrTbn56eMrJXPeiu0Tx9g0WLnIN4MgFgrkkp5WqPpqfpDQur8oH2l1UUwr7PMQHNlvTg0&google_hm=eS1SZkFTb0FSRTJwR25VLndzVEhPVU9WcjRhaXFNRzJNY35B

Request Chain 120

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEOQERKisCWzB_hRJdbCSkkA&google_cver=1&google_push=AXcoOmS6FdzpVrmJ1Hj4OKRr4aDD4m3NsO6d9TSUW8s35xCYwRFvCwA8tW8FcI7FEYVQda2XYF9XAL1X-ZfRfVMxvUwQuy8kLA-9Fm8W HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEOQERKisCWzB_hRJdbCSkkA&google_cver=1&google_push=AXcoOmS6FdzpVrmJ1Hj4OKRr4aDD4m3NsO6d9TSUW8s35xCYwRFvCwA8tW8FcI7FEYVQda2XYF9XAL1X-ZfRfVMxvUwQuy8kLA-9Fm8W HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODY5ODE1MDAyNzU3MTA4MjUwMA&google_push=AXcoOmS6FdzpVrmJ1Hj4OKRr4aDD4m3NsO6d9TSUW8s35xCYwRFvCwA8tW8FcI7FEYVQda2XYF9XAL1X-ZfRfVMxvUwQuy8kLA-9Fm8W

Request Chain 121

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEMwng3erfTYPMQwUqHZ5oH0&google_cver=1&google_push=AXcoOmSWLc8f1gOIXOvAKQUFojydWNq1dsVQaPR4eAuFdbpMc-CPdHIwou689d57ldi1dbe_jympnNjy3qzLhnDa5jdZirrEqkwfTe32 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSWLc8f1gOIXOvAKQUFojydWNq1dsVQaPR4eAuFdbpMc-CPdHIwou689d57ldi1dbe_jympnNjy3qzLhnDa5jdZirrEqkwfTe32

Request Chain 126

https://googleads.g.doubleclick.net/pagead/adview?ai=C8TKp2X0QZbflDcak78EPv42nkA2zx7CjbqCP-K3yC9rZHhABIIzqln5glYKAgJgHoAGumIqiAsgBCakCYTFGH3HfsT6oAwHIA8sEqgTxAU_QRzC3_yp_S0xxlXNjdU5fpdD3Rrg_HcA10M2eSBsrf4Z6WJES_3IgJG1yUfJgC4YL1IZu8TKXQYj6VP5PD-meH8ryUB7ccmiFYCHVezJAryG4SEG7EaLYPHCaTsM_P-CoYSlIS-cyc75bluhNPew7QWN-cw5xdb1zdfQBx3Bsgjn7CmHsb1ZDt1ujhyi6MnckL0yqFMKJO2nQJm4fFuv1LEo5jT3mI7bKI_XNaPNtfJr_sFDV8lyAo0zUxwypbLAKsoxMaanKNOFQhHtUr4KxSHPz2BoW-wU9qOYZ3n1l2o_35AGi4NSuFoktHy0j11HABL6XgI6PA4gFk_r5jCiSBQQIBBgBkgUECAUYBKAGLoAHuuf13QGoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBCX0AbSCBYIgOGAEBABGB8yAqoCOgKAQEi9_cE6mgkgaHR0cHM6Ly94Y3JhZnQubmV0L3JlZ2lzdHJhdGlvbi-ACgHICwHYEwyIFATQFQGAFwGyFxwKGggAEhRwdWItMjYxMjYzNzI5NjIzNDcyORgA&sigh=Mia6rmifovQ&uach_m=[UACH]&ase=2&nis=4&cid=CAQSPABpAlJWLTgHYs_4Ow0LwpkIOy3nYPO25dHVxo9GC5aJBG5T80P65_RqDX30wmViYLEVBI_3k_mpatQP-hgB&template_id=5000&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2218438662421790227813%22,%22debug_reporting%22:true,%22destination%22:%22https://xcraft.net%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22608341038%22],%224%22:[%2209-24%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2215176676339710286113%22}&andc=true

Request Chain 144

https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=90c7d166c3&subid=&uid=1e8925cde4ef2cf5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC0Kno2X0QZYqOFb6Wpt8P9Jif6ASm5b2gaYWVnKfJD_AuEAEgjOqWfmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE8wFP0EnJWJfOpv4ep8HezIQ0CwJzH6VtcrqSnpSnyhdF2AsYb9PaITOT7usWtDFeel3X7pPuZhc_2rHiIsO2s6mwyeMp56XXUgRTcVch6AE_fq_9CPbr1hQjVRHbvAMoraQkIcR2arVu2FZSCDROwoTdWdPB7raZKYaElZrBjSbO-fiylhUMUgG9yth5UGlOiq6_OtDQ-PUggVqvNAUin9yG8ax5JIP1zReFtwMROY0NkZomiSOzikN3VBEmJYUyJHzSDdRn5pHXsVXA2HXJ7ZAIvw-2-dPMeNYDcBTHjE5jb-rAQ-l08ePUVKwq7IBNJj6QqQXABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIyt62ou7DgQMVPovpBR10zAdNEAEYASAAEgI6APD_BwE%26num%3D1%26cid%3DCAQSPABpAlJWuZt1mkXmzQwW-74JOqvx1e9HPQcu6h5lhSGMWCX7aB-vx1nt25qxFXa7PexAmTsrx67GlE2TQhgB%26sig%3DAOD64_21DzGGx7JTKycj17f5_pKUcgw4-Q%26client%3Dca-pub-2612637296234729%26dbm_c%3DAKAmf-AITIO62hGhx5cP5LIuc3XXP8G6o4EvacMYcGi1Wv9RrwjHakBIkvwB3AW8t_5DYVVw0sYrk42qRWTGm7cVZ9ruJf2GyFGbyNFk0BAocy4bCm0lB2mrJSUBFiFPypnWIg8Q7bFLkja9VGl1uAep4RZKrzVP9HaN7YnKc6dhvi1JlBJCCYg%26cry%3D1%26dbm_d%3DAKAmf-D0MG9JDk8mQWArA2o6Bud93Qp6ZNCYwOGcfke6gWZgLE-sOpWARL3mkCxq1nV4yeHpPBb5FRLklofQxJlnDoM3C1P4i0ecNz_1mViNuHM793EUNDZ7PBEAyMGbb4n17EbHUCFAr81SUaoYSmXXDZ3nhzMEg4XSocSLa55QjXeV50VqZCE5S4IjE4L0bGbLL3Tg6VWcQ59qTnfJ0E_TNAXbXQGp-JpI715cAiKFqEw5CHt15bC-5cjvbyLW7qF2Ny24nyVG15rZlfscN7qwadx_VLNHV_Ikl9lI3ju_Wuqn-_3wTITUSNKb7ygp68wUpaT8jZyfn8mT6mVUB6hHMZqJEOnKUYv7PfZgPgPvg6ZhyDbEKEBS3ZmJ-y2cvBqq7CqNBSwJo7Qxd7QxTLKZxCP49LfpemIKCCF0MnuZ9W4L8uMjOlcJ3MRLLl1zUmXo4XNYTKG-ftxNs4dl1SPVWo3VWSKqEyGnEVmjlXa-S1_jPdlCTVk11M1vZz1QRRkBJqzGBUrtZAb8fiL14qrhU0Uwj7gDBw%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2612637296234729%26output%3Dhtml%26h%3D90%26adk%3D3130937508%26adf%3D226233620%26pi%3Dt.aa~a.1154693969~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695572409%26rafmt%3D1%26to%3Dqs%26pwprc%3D6114872683%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fgame.gnlore.com%252Fvictoria-3-product%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1695579609146%26bpp%3D1%26bdt%3D2101%26idt%3D0%26shv%3Dr20230920%26mjsv%3Dm202309140101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Dc39bed6084529430-22d9689489de00fe%253AT%253D1695579608%253ART%253D1695579608%253AS%253DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ%26gpic%3DUID%253D00000c834195fde1%253AT%253D1695579608%253ART%253D1695579608%253AS%253DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug%26prev_fmts%3D0x0%252C1200x280%252C333x250%252C1200x280%26nras%3D5%26correlator%3D5085991068093%26frm%3D20%26pv%3D1%26ga_vid%3D1909208556.1695579608%26ga_sid%3D1695579608%26ga_hid%3D37659207%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D2757%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759927%252C44759842%252C44759876%252C42531705%26oid%3D2%26psts%3DAOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt%26pvsid%3D4005920162221254%26tmod%3D655216534%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D5%26uci%3Da!5%26btvi%3D3%26fsb%3D1%26xpc%3DxuohkQVNe2%26p%3Dhttps%253A%2F%2Fgame.gnlore.com%26dtd%3D37&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fgame.gnlore.com&random=3165122228800&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=90c7d166c3&subid=&uid=1e8925cde4ef2cf5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC0Kno2X0QZYqOFb6Wpt8P9Jif6ASm5b2gaYWVnKfJD_AuEAEgjOqWfmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE8wFP0EnJWJfOpv4ep8HezIQ0CwJzH6VtcrqSnpSnyhdF2AsYb9PaITOT7usWtDFeel3X7pPuZhc_2rHiIsO2s6mwyeMp56XXUgRTcVch6AE_fq_9CPbr1hQjVRHbvAMoraQkIcR2arVu2FZSCDROwoTdWdPB7raZKYaElZrBjSbO-fiylhUMUgG9yth5UGlOiq6_OtDQ-PUggVqvNAUin9yG8ax5JIP1zReFtwMROY0NkZomiSOzikN3VBEmJYUyJHzSDdRn5pHXsVXA2HXJ7ZAIvw-2-dPMeNYDcBTHjE5jb-rAQ-l08ePUVKwq7IBNJj6QqQXABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIyt62ou7DgQMVPovpBR10zAdNEAEYASAAEgI6APD_BwE%26num%3D1%26cid%3DCAQSPABpAlJWuZt1mkXmzQwW-74JOqvx1e9HPQcu6h5lhSGMWCX7aB-vx1nt25qxFXa7PexAmTsrx67GlE2TQhgB%26sig%3DAOD64_21DzGGx7JTKycj17f5_pKUcgw4-Q%26client%3Dca-pub-2612637296234729%26dbm_c%3DAKAmf-AITIO62hGhx5cP5LIuc3XXP8G6o4EvacMYcGi1Wv9RrwjHakBIkvwB3AW8t_5DYVVw0sYrk42qRWTGm7cVZ9ruJf2GyFGbyNFk0BAocy4bCm0lB2mrJSUBFiFPypnWIg8Q7bFLkja9VGl1uAep4RZKrzVP9HaN7YnKc6dhvi1JlBJCCYg%26cry%3D1%26dbm_d%3DAKAmf-D0MG9JDk8mQWArA2o6Bud93Qp6ZNCYwOGcfke6gWZgLE-sOpWARL3mkCxq1nV4yeHpPBb5FRLklofQxJlnDoM3C1P4i0ecNz_1mViNuHM793EUNDZ7PBEAyMGbb4n17EbHUCFAr81SUaoYSmXXDZ3nhzMEg4XSocSLa55QjXeV50VqZCE5S4IjE4L0bGbLL3Tg6VWcQ59qTnfJ0E_TNAXbXQGp-JpI715cAiKFqEw5CHt15bC-5cjvbyLW7qF2Ny24nyVG15rZlfscN7qwadx_VLNHV_Ikl9lI3ju_Wuqn-_3wTITUSNKb7ygp68wUpaT8jZyfn8mT6mVUB6hHMZqJEOnKUYv7PfZgPgPvg6ZhyDbEKEBS3ZmJ-y2cvBqq7CqNBSwJo7Qxd7QxTLKZxCP49LfpemIKCCF0MnuZ9W4L8uMjOlcJ3MRLLl1zUmXo4XNYTKG-ftxNs4dl1SPVWo3VWSKqEyGnEVmjlXa-S1_jPdlCTVk11M1vZz1QRRkBJqzGBUrtZAb8fiL14qrhU0Uwj7gDBw%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2612637296234729%26output%3Dhtml%26h%3D90%26adk%3D3130937508%26adf%3D226233620%26pi%3Dt.aa~a.1154693969~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695572409%26rafmt%3D1%26to%3Dqs%26pwprc%3D6114872683%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fgame.gnlore.com%252Fvictoria-3-product%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1695579609146%26bpp%3D1%26bdt%3D2101%26idt%3D0%26shv%3Dr20230920%26mjsv%3Dm202309140101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Dc39bed6084529430-22d9689489de00fe%253AT%253D1695579608%253ART%253D1695579608%253AS%253DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ%26gpic%3DUID%253D00000c834195fde1%253AT%253D1695579608%253ART%253D1695579608%253AS%253DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug%26prev_fmts%3D0x0%252C1200x280%252C333x250%252C1200x280%26nras%3D5%26correlator%3D5085991068093%26frm%3D20%26pv%3D1%26ga_vid%3D1909208556.1695579608%26ga_sid%3D1695579608%26ga_hid%3D37659207%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D2757%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759927%252C44759842%252C44759876%252C42531705%26oid%3D2%26psts%3DAOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt%26pvsid%3D4005920162221254%26tmod%3D655216534%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D5%26uci%3Da!5%26btvi%3D3%26fsb%3D1%26xpc%3DxuohkQVNe2%26p%3Dhttps%253A%2F%2Fgame.gnlore.com%26dtd%3D37&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fgame.gnlore.com&random=3165122228800&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 166

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=196151741010.29974 HTTP 302
https://8019191.fls.doubleclick.net/activityi;dc_pre=CLXtlaPuw4EDFerhOwIdEoEFLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=196151741010.29974

Request Chain 168

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=93569300126359104444550012457011&t=htlp&gdpr=1&consent=1&gdpr_consent= HTTP 302
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=93569300126359104444550012457011&t=htlp&gdpr=1&consent=1&gdpr_consent=

Request Chain 173

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESECxsM_d5RZhgCoOpdbbNYtQ&google_cver=1&google_push=AXcoOmQPIEygkjQd0LDs8yBFh1MsgjenEZzAy7OXXTeFz7yw7Ma16YFRTWzXIN-aU_IxnFU0NRsB6Sj10c24Zee8s9eN7xu_tEkC4SQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESECxsM_d5RZhgCoOpdbbNYtQ&google_push=AXcoOmQPIEygkjQd0LDs8yBFh1MsgjenEZzAy7OXXTeFz7yw7Ma16YFRTWzXIN-aU_IxnFU0NRsB6Sj10c24Zee8s9eN7xu_tEkC4SQ

Request Chain 174

https://ipac.ctnsnet.com/int/cm?exc=1&acc=crimtan_au&google_gid=CAESEAfPGqmF27zObgLsWJp1iHw&google_cver=1&google_push=AXcoOmSqMWnjju7CPpnG2Zj6GMluCPMnIjtRCdfQBg62gR0oDQ5a18ah_rgUxEvcEmrp1ptHVM28hgHLJhU8F4ZsiN46zEF33ljubhg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=AXcoOmSqMWnjju7CPpnG2Zj6GMluCPMnIjtRCdfQBg62gR0oDQ5a18ah_rgUxEvcEmrp1ptHVM28hgHLJhU8F4ZsiN46zEF33ljubhg&google_hm=1_uenND4RdaPKsU19MAS_IU

Request Chain 177

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEPk4gjJJP9K48bboATejwCU&google_cver=1&google_push=AXcoOmSjUyaGPyuL5Vq8-n4ljyWz33qsJJDoOEgaPKlerNMnEDts_GYNmLqgh9HGQWecwQiVUblTm5pH6fm8aX02_D-vQOoeUb5ynnU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODY5ODE1MDAyNzU3MTA4MjUwMA&google_push=AXcoOmSjUyaGPyuL5Vq8-n4ljyWz33qsJJDoOEgaPKlerNMnEDts_GYNmLqgh9HGQWecwQiVUblTm5pH6fm8aX02_D-vQOoeUb5ynnU

195 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
game.gnlore.com/victoria-3-product/ 46 KB
13 KB 870ms
353ms Document
text/html 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 116e513225e7dee39b12dd4f04d26898b29b72f5ff8fa8248ad7fba8c2ef5c89

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Sun, 24 Sep 2023 18:20:06 GMT
Link: <https://game.gnlore.com/wp-json/>; rel="https://api.w.org/" <https://game.gnlore.com/wp-json/wp/v2/posts/36111>; rel="alternate"; type="application/json" <https://game.gnlore.com/?p=36111>; rel=shortlink
Server: nginx/1.14.0 (Ubuntu)
Transfer-Encoding: chunked

GET
H/1.1 200
OK style.min.css
game.gnlore.com/wp-includes/css/dist/block-library/ 102 KB
102 KB 178ms
177ms Stylesheet
text/css 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-includes/css/dist/block-library/style.min.css?ver=6.3.1
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 67447c3656caad630373253691f3e8f64467eafd6e7305c9b0e98111b0b41694

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:07 GMT
Last-Modified: Tue, 08 Aug 2023 20:35:32 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64d2a714-19824"
Content-Type: text/css
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 104484
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK style.css
game.gnlore.com/wp-content/themes/colormag/ 121 KB
121 KB 339ms
337ms Stylesheet
text/css 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-content/themes/colormag/style.css?ver=3.0.5
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 5eb77d84bdf5a71d624df5525860b4e44896fab951c84084e63d09b136e9167d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:07 GMT
Last-Modified: Wed, 06 Sep 2023 17:31:55 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64f8b78b-1e457"
Content-Type: text/css
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 123991
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK magnific-popup.min.css
game.gnlore.com/wp-content/themes/colormag/assets/js/magnific-popup/ 5 KB
5 KB 513ms
171ms Stylesheet
text/css 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-content/themes/colormag/assets/js/magnific-popup/magnific-popup.min.css?ver=3.0.5
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e529245e8867300ffd2b6f6c1e5b36d41ce8c71a9eb7cbdec52360c0be7b0017

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:07 GMT
Last-Modified: Wed, 06 Sep 2023 17:31:55 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64f8b78b-1463"
Content-Type: text/css
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5219
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK font-awesome.min.css
game.gnlore.com/wp-content/themes/colormag/assets/library/fontawesome/css/ 30 KB
31 KB 702ms
351ms Stylesheet
text/css 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-content/themes/colormag/assets/library/fontawesome/css/font-awesome.min.css?ver=3.0.5
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:07 GMT
Last-Modified: Wed, 06 Sep 2023 17:31:55 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64f8b78b-7918"
Content-Type: text/css
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 31000
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK jquery.min.js Show response
game.gnlore.com/wp-includes/js/jquery/ 85 KB
86 KB 702ms
351ms Script
application/javascript 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.0
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:07 GMT
Last-Modified: Tue, 08 Aug 2023 20:35:32 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64d2a714-155ba"
Content-Type: application/javascript
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 87482
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK jquery-migrate.min.js Show response
game.gnlore.com/wp-includes/js/jquery/ 13 KB
14 KB 721ms
365ms Script
application/javascript 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:07 GMT
Last-Modified: Tue, 08 Aug 2023 20:35:32 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64d2a714-3509"
Content-Type: application/javascript
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 13577
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 147 KB
50 KB 177ms
103ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cfc321df846749615922046a2efff3649c5b994e917f7ed58a02f660d68c8e9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51031
x-xss-protection: 0
server: cafe
etag: 10454150025235189670
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 24 Sep 2023 18:20:08 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 131 KB
51 KB 109ms
37ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-134610508-1

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8a62d099c6a1cd9ac8e1e416175a998ba3ed34cd2bc249194f12675d30e619d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:08 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 51726
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 24 Sep 2023 18:20:08 GMT

GET
H/1.1 200
OK Noxplayer-300x200p.jpg
game.gnlore.com/media/ 29 KB
29 KB 663ms
353ms Image
image/jpeg 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://game.gnlore.com/media/Noxplayer-300x200p.jpg
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 7a6bf080d151eb6301c6b0a5f87c3dded4d89852545c03d5a5d800f3ac6a86e9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Wed, 30 Aug 2023 10:39:00 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64ef1c44-73c5"
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29637
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK lhcjwxfz-image1-300p.jpg
game.gnlore.com/media/ 17 KB
18 KB 474ms
172ms Image
image/jpeg 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://game.gnlore.com/media/lhcjwxfz-image1-300p.jpg
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 4b8d4277763eff0a0c1bb80e77f469202acc196824f637aadf408501ca5bf494

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Fri, 22 Sep 2023 10:07:34 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "650d6766-4535"
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 17717
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 hqdefault.jpg
i.ytimg.com/vi/vhOcb8saZPc/ 26 KB
26 KB 139ms
66ms Image
image/jpeg 2a00:1450:4001:812::2016
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi/vhOcb8saZPc/hqdefault.jpg

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de9348830d5048e11ee17758288022a42f088c10667a4e4d7445130a0068e011

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:08 GMT
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27020
x-xss-protection: 0
server: sffe
etag: "1694744285"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sun, 24 Sep 2023 20:20:08 GMT

GET
H2 200 hqdefault.jpg
i.ytimg.com/vi/mShKf-C3xxg/ 17 KB
17 KB 132ms
59ms Image
image/jpeg 2a00:1450:4001:812::2016
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi/mShKf-C3xxg/hqdefault.jpg

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d41b693d59fcbc01996c3cdae8bba9035b2156f8c08bb2927bea96dc7a7b2ee4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:08 GMT
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17225
x-xss-protection: 0
server: sffe
etag: "1694659883"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sun, 24 Sep 2023 20:20:08 GMT

GET
H2 200 hqdefault.jpg
i.ytimg.com/vi/QYCrC4xWtd8/ 34 KB
35 KB 100ms
36ms Image
image/jpeg 2a00:1450:4001:812::2016
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi/QYCrC4xWtd8/hqdefault.jpg

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ec3329dcfc4df212ec718a1fb1dec020642ae68f353c61bb042d2fc1f11df2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:08 GMT
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35325
x-xss-protection: 0
server: sffe
etag: "1694782498"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sun, 24 Sep 2023 20:20:08 GMT

GET
H/1.1 200
OK nier-replicant-ver-122474487139-300px-1.jpg
game.gnlore.com/media/ 8 KB
9 KB 310ms
178ms Image
image/jpeg 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://game.gnlore.com/media/nier-replicant-ver-122474487139-300px-1.jpg
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e4f8bf028d52dffe3f2027afe94818d76348ba33f1c708763feb126260634871

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Tue, 10 Aug 2021 23:16:09 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "611308b9-217e"
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8574
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK jquery.bxslider.min.js Show response
game.gnlore.com/wp-content/themes/colormag/assets/js/ 24 KB
24 KB 177ms
177ms Script
application/javascript 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-content/themes/colormag/assets/js/jquery.bxslider.min.js?ver=3.0.5
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 2e15e49379e85a43b49374fb7dbb9de56109527f63ec0d1efbe096adacd2a295

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:07 GMT
Last-Modified: Wed, 06 Sep 2023 17:31:55 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64f8b78b-5e03"
Content-Type: application/javascript
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 24067
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK jquery.magnific-popup.min.js Show response
game.gnlore.com/wp-content/themes/colormag/assets/js/magnific-popup/ 20 KB
20 KB 176ms
176ms Script
application/javascript 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-content/themes/colormag/assets/js/magnific-popup/jquery.magnific-popup.min.js?ver=3.0.5
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 521e8d0a51454628b8fc84e91049e5d52945d1b61848436266c05af3a60a2904

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Wed, 06 Sep 2023 17:31:55 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64f8b78b-4ecf"
Content-Type: application/javascript
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 20175
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK navigation.min.js Show response
game.gnlore.com/wp-content/themes/colormag/assets/js/ 2 KB
2 KB 176ms
175ms Script
application/javascript 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-content/themes/colormag/assets/js/navigation.min.js?ver=3.0.5
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 0eff32133eb996e2b45f523ac9210d4b408f34e05868e592112f9abc322306eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Wed, 06 Sep 2023 17:31:55 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64f8b78b-60b"
Content-Type: application/javascript
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1547
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK jquery.fitvids.min.js Show response
game.gnlore.com/wp-content/themes/colormag/assets/js/fitvids/ 2 KB
2 KB 171ms
169ms Script
application/javascript 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-content/themes/colormag/assets/js/fitvids/jquery.fitvids.min.js?ver=3.0.5
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: fedf6af2935e1c30de75cc8f879ca86bd81dff8accd1c943c8a94440013115fa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Wed, 06 Sep 2023 17:31:55 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64f8b78b-807"
Content-Type: application/javascript
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2055
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK skip-link-focus-fix.min.js Show response
game.gnlore.com/wp-content/themes/colormag/assets/js/ 327 B
661 B 178ms
176ms Script
application/javascript 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-content/themes/colormag/assets/js/skip-link-focus-fix.min.js?ver=3.0.5
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: a8c2b783dfb2a8ae80f75f9b271024777ef513e93fe8b220c0df95ed8fe3a4a0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Wed, 06 Sep 2023 17:31:55 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64f8b78b-147"
Content-Type: application/javascript
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 327
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK colormag-custom.min.js Show response
game.gnlore.com/wp-content/themes/colormag/assets/js/ 7 KB
7 KB 172ms
171ms Script
application/javascript 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-content/themes/colormag/assets/js/colormag-custom.min.js?ver=3.0.5
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 3fbe8e26c3139fc2d45811c9996c402841780837b3a6cb74b43304c0340c342d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Wed, 06 Sep 2023 17:31:55 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64f8b78b-1b3f"
Content-Type: application/javascript
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6975
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
BLOB 200
OK dbfa58e3-6a9f-4348-9418-148aa14b2bce
https://game.gnlore.com/ 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://game.gnlore.com/dbfa58e3-6a9f-4348-9418-148aa14b2bce
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Length: 1245
Content-Type: text/javascript

GET
H/1.1 200
OK OpenSans-VariableFont.woff
game.gnlore.com/wp-content/themes/colormag/assets/fonts/ 78 KB
79 KB 179ms
177ms Font
application/font-woff 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-content/themes/colormag/assets/fonts/OpenSans-VariableFont.woff
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/wp-content/themes/colormag/style.css?ver=3.0.5
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 01860d2273448228ae1e9f7b7150e82bdcf98896938cccd44815f4c1c856204c

Request headers

Referer: https://game.gnlore.com/wp-content/themes/colormag/style.css?ver=3.0.5
Origin: https://game.gnlore.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Wed, 06 Sep 2023 17:31:55 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64f8b78b-13944"
Content-Type: application/font-woff
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 80196

GET
H/1.1 200
OK OpenSans-Medium.woff
game.gnlore.com/wp-content/themes/colormag/assets/fonts/ 79 KB
79 KB 337ms
180ms Font
application/font-woff 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-content/themes/colormag/assets/fonts/OpenSans-Medium.woff
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/wp-content/themes/colormag/style.css?ver=3.0.5
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 4a31a8733940d9d2cb4e98b82b96ecb180ce1de0fc2a8e6397e6bba48aa33c46

Request headers

Referer: https://game.gnlore.com/wp-content/themes/colormag/style.css?ver=3.0.5
Origin: https://game.gnlore.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Wed, 06 Sep 2023 17:31:55 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64f8b78b-13aa4"
Content-Type: application/font-woff
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 80548

GET
H/1.1 200
OK fontawesome-webfont.woff2
game.gnlore.com/wp-content/themes/colormag/assets/library/fontawesome/fonts/ 75 KB
76 KB 335ms
173ms Font
application/octet-stream 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-content/themes/colormag/assets/library/fontawesome/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/wp-content/themes/colormag/assets/library/fontawesome/css/font-awesome.min.css?ver=3.0.5
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://game.gnlore.com/wp-content/themes/colormag/assets/library/fontawesome/css/font-awesome.min.css?ver=3.0.5
Origin: https://game.gnlore.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Wed, 06 Sep 2023 17:31:55 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64f8b78b-12d68"
Content-Type: application/octet-stream
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 77160

GET
H/1.1 200
OK OpenSans-SemiBold.woff
game.gnlore.com/wp-content/themes/colormag/assets/fonts/ 78 KB
79 KB 514ms
350ms Font
application/font-woff 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-content/themes/colormag/assets/fonts/OpenSans-SemiBold.woff
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/wp-content/themes/colormag/style.css?ver=3.0.5
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e401b72553ea85689b6a2ee010d65bd1d41bd99d765ca892c49589e9a170634b

Request headers

Referer: https://game.gnlore.com/wp-content/themes/colormag/style.css?ver=3.0.5
Origin: https://game.gnlore.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Wed, 06 Sep 2023 17:31:55 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64f8b78b-13938"
Content-Type: application/font-woff
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 80184

GET
H/1.1 200
OK OpenSans-Italic.woff
game.gnlore.com/wp-content/themes/colormag/assets/fonts/ 82 KB
82 KB 345ms
176ms Font
application/font-woff 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-content/themes/colormag/assets/fonts/OpenSans-Italic.woff
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/wp-content/themes/colormag/style.css?ver=3.0.5
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: abca6b3f5e3a4af083ea3e72fdae1e310f4a40c999ddd0e268a8fafdeaca3497

Request headers

Referer: https://game.gnlore.com/wp-content/themes/colormag/style.css?ver=3.0.5
Origin: https://game.gnlore.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Wed, 06 Sep 2023 17:31:55 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64f8b78b-14840"
Content-Type: application/font-woff
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 84032

GET
H/1.1 200
OK fifa-23-standard-edition-cover-300p.jpg
game.gnlore.com/media/ 9 KB
9 KB 186ms
186ms Image
image/jpeg 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://game.gnlore.com/media/fifa-23-standard-edition-cover-300p.jpg
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: d94639f71e76d54bd933786e8356c15e8023ac53ab8bb8ea399a0da9fe7e9b6c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Sat, 06 Aug 2022 12:15:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "62ee5b78-23e4"
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9188
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK zero-motle-premium-edition-300p.jpg
game.gnlore.com/media/ 8 KB
8 KB 169ms
169ms Image
image/jpeg 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://game.gnlore.com/media/zero-motle-premium-edition-300p.jpg
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 2e68f8a31e7a3fdc27d8a03ab8d37c4f69d4a49af7579dad9fc9c7b520523950

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Fri, 02 Dec 2022 11:12:25 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6389dd99-2065"
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8293
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK a-plague-tale-innocence-pre-order-music-250px-1.jpg
game.gnlore.com/media/ 5 KB
5 KB 177ms
176ms Image
image/jpeg 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://game.gnlore.com/media/a-plague-tale-innocence-pre-order-music-250px-1.jpg
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: ef7598634d8232665e2db4caf316bc781a604cc8434dd831132928a6efd932a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Tue, 10 Aug 2021 23:15:39 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6113089b-1475"
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5237
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 254 KB
87 KB 40ms
39ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-MPE22XYXHL&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-134610508-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f0f6af6d31950271742da0d62e63bd2907c0bc0a238ba972c97f222d70b8e3fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:08 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 89052
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 24 Sep 2023 18:20:08 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 77ms
20ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-134610508-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 24 Sep 2023 17:49:43 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 1825
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sun, 24 Sep 2023 19:49:43 GMT

GET
H/1.1 200
OK wp-emoji-release.min.js Show response
game.gnlore.com/wp-includes/js/ 18 KB
19 KB 171ms
171ms Script
application/javascript 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-includes/js/wp-emoji-release.min.js?ver=6.3.1
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/victoria-3-product/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Wed, 29 Mar 2023 20:34:47 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6424a0e7-4904"
Content-Type: application/javascript
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 18692
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/ 379 KB
129 KB 101ms
100ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-2612637296234729&plah=game.gnlore.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

98548c06857417fc015a98d2227d0cc41596ce3bda32bffc85f8ca3d006805dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 131562
x-xss-protection: 0
server: cafe
etag: 7743625317656959639
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 24 Sep 2023 18:20:08 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230920/r20190131/ Frame 8AA3 10 KB
5 KB 85ms
20ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230920/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://game.gnlore.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 17396
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 13:30:12 GMT
etag: 2603938475786422795
expires: Sun, 08 Oct 2023 13:30:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
region1.analytics.google.com/g/ 0
254 B 80ms
27ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-MPE22XYXHL&gtm=45je39k2&_p=37659207&_gaz=1&cid=1909208556.1695579608&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAAI&_s=1&sid=1695579608&sct=1&seg=0&dl=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&dt=%E7%B6%AD%E5%A4%9A%E5%88%A9%E4%BA%9E%EF%BC%93%EF%BC%88Victoria%203%EF%BC%89Grand%E7%89%88%E3%80%81%E6%A8%99%E6%BA%96%E7%89%88%E3%80%81%E7%89%B9%E5%85%B8%E3%80%81%E5%AD%A3%E7%A5%A8%E3%80%81%E5%83%B9%E6%A0%BC%20%E2%80%93%20Gnlore&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-MPE22XYXHL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:08 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://game.gnlore.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
254 B 86ms
29ms Ping
text/plain 2a00:1450:400c:c02::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-MPE22XYXHL&cid=1909208556.1695579608&gtm=45je39k2&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-MPE22XYXHL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c02::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:08 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://game.gnlore.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 113ms
61ms Image
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-MPE22XYXHL&cid=1909208556.1695579608&gtm=45je39k2&aip=1&z=117318634

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
207 B 28ms
27ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=37659207&t=pageview&_s=1&dl=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ul=en-us&de=UTF-8&dt=%E7%B6%AD%E5%A4%9A%E5%88%A9%E4%BA%9E%EF%BC%93%EF%BC%88Victoria%203%EF%BC%89Grand%E7%89%88%E3%80%81%E6%A8%99%E6%BA%96%E7%89%88%E3%80%81%E7%89%B9%E5%85%B8%E3%80%81%E5%AD%A3%E7%A5%A8%E3%80%81%E5%83%B9%E6%A0%BC%20%E2%80%93%20Gnlore&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1997954700&gjid=1380749348&cid=1909208556.1695579608&tid=UA-134610508-1&_gid=934134892.1695579608&_r=1&gtm=457e39k2&jsscut=1&z=1792779614

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://game.gnlore.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:08 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://game.gnlore.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK OpenSans-Regular.woff
game.gnlore.com/wp-content/themes/colormag/assets/fonts/ 78 KB
79 KB 328ms
176ms Font
application/font-woff 167.88.125.7
RAMNODE

General

Check archive.org

Show headers Download Go to

Full URL: https://game.gnlore.com/wp-content/themes/colormag/assets/fonts/OpenSans-Regular.woff
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/wp-content/themes/colormag/style.css?ver=3.0.5
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 167.88.125.7 Atlanta, United States, ASN3842 (RAMNODE, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 543ceb846af6fbfff9fc58f1e53994f3f191116c51ca95de3ce75d675c50ea66

Request headers

Referer: https://game.gnlore.com/wp-content/themes/colormag/style.css?ver=3.0.5
Origin: https://game.gnlore.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:08 GMT
Last-Modified: Wed, 06 Sep 2023 17:31:55 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "64f8b78b-13998"
Content-Type: application/font-woff
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 80280

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
148 B 36ms
35ms XHR
text/plain 2a00:1450:400c:c02::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-134610508-1&cid=1909208556.1695579608&jid=1997954700&gjid=1380749348&_gid=934134892.1695579608&_u=YADAAUAAAAAAACAAI~&z=694993176

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c02::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://game.gnlore.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sun, 24 Sep 2023 18:20:08 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://game.gnlore.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 387 B
605 B 83ms
31ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=game.gnlore.com&callback=_gfp_s_&client=ca-pub-2612637296234729

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309140101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-2612637296234729&plah=game.gnlore.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1288b0b3d62836988db4905996cbf8e317badae2d54eae1b3afc1b65a9874c75

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 253
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E1D6 17 KB
5 KB 678ms
676ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&adk=1812271804&adf=3025194257&lmt=1695572408&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x675_l%7C212x675_r&format=0x0&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579608171&bpp=19&bdt=1125&idt=215&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5085991068093&frm=20&pv=2&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=245

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf689384688979a215ce372d64fbc91e99563f051b6ba3c8d76186e0d1877be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://game.gnlore.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 5343
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 18:20:09 GMT
expires: Sun, 24 Sep 2023 18:20:09 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame BFA4 120 KB
40 KB 526ms
526ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=280&adk=935936864&adf=614321402&pi=t.aa~a.1043414356~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695572408&rafmt=1&to=qs&pwprc=6114872683&format=1200x280&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579608191&bpp=2&bdt=1146&idt=230&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=167&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=rzLliOD7Gr&p=https%3A//game.gnlore.com&dtd=234

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5b62609de41fe28668ba6b2a1fca5abd5c5537fb32ada667ddefe70ad8e7c8f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://game.gnlore.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 41101
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 18:20:08 GMT
expires: Sun, 24 Sep 2023 18:20:08 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame BFA4 14 KB
2 KB 78ms
30ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=280&adk=935936864&adf=614321402&pi=t.aa~a.1043414356~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695572408&rafmt=1&to=qs&pwprc=6114872683&format=1200x280&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579608191&bpp=2&bdt=1146&idt=230&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=167&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=rzLliOD7Gr&p=https%3A//game.gnlore.com&dtd=234

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 24 Sep 2023 18:20:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 18:18:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 24 Sep 2023 18:20:09 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame BFA4 2 KB
973 B 73ms
23ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:26:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21246
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:26:03 GMT

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/14809003673391781576/ Frame BFA4 40 KB
40 KB 85ms
36ms Image
image/jpeg 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14809003673391781576/14763004658117789537?w=600&h=314

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d6b6b77c0d3ef41ecf8ba29f5351171104e466910fa007d590a7c62004efeb6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 16:16:33 GMT
x-content-type-options: nosniff
age: 439416
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40815
x-xss-protection: 0
last-modified: Thu, 01 Sep 2022 14:28:50 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 18 Sep 2024 16:16:33 GMT

GET
DATA 200
OK truncated
/ Frame BFA4 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame BFA4 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/ Frame BFA4 23 KB
9 KB 60ms
24ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:29:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21057
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
server: cafe
etag: 9583221549990841032
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:29:12 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame BFA4 3 KB
1 KB 64ms
28ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:33:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6376
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 16:33:53 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame BFA4 20 KB
8 KB 56ms
21ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21221
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:26:28 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BFA4 182 KB
57 KB 132ms
67ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Sep 2023 18:20:09 GMT

GET
H2 200 c233ef7b00e27d1a3d2fdfcca9f8c94a.js Show response
www.gstatic.com/mysidia/ Frame BFA4 36 KB
15 KB 72ms
20ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/c233ef7b00e27d1a3d2fdfcca9f8c94a.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8ab5f91903d3ffacb3291e6c04e255b777d32970c2ac56f48e527089044b234

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 20:54:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 422724
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15198
x-xss-protection: 0
last-modified: Tue, 19 Sep 2023 20:35:04 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 18 Dec 2023 20:54:45 GMT

GET
DATA 200
OK truncated
/ Frame BFA4 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cb0fafab9d9cc65a1359edadd9ef67ff71d09a84348eaf37e9a0b55cc98f6c9b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 170E 27 KB
11 KB 502ms
501ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2736490106&adf=2334466290&pi=t.aa~a.308491958~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280&nras=3&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=2115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cltBAE1Jvg&p=https%3A//game.gnlore.com&dtd=5

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a128b287f920a5042d84a49c11b89788a712523a2be5ef4b911566823dac6d72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://game.gnlore.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11730
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 18:20:09 GMT
expires: Sun, 24 Sep 2023 18:20:09 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AAC2 123 KB
42 KB 701ms
699ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=280&adk=2767623100&adf=1730821504&pi=t.aa~a.2296496848~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x280&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2100&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250&nras=4&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2467&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=HmtLWhpJ9o&p=https%3A//game.gnlore.com&dtd=31

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

27bac3f44c763f47592e531c40a0bd481af3a01201fcd55bd33ec885cb7c62f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://game.gnlore.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 42487
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 18:20:09 GMT
expires: Sun, 24 Sep 2023 18:20:09 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 90A0 30 KB
13 KB 709ms
708ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=90&adk=3130937508&adf=226233620&pi=t.aa~a.1154693969~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x90&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250%2C1200x280&nras=5&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2757&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=xuohkQVNe2&p=https%3A//game.gnlore.com&dtd=37

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c136c054b97ce28bd0b2b02e33bb3056dc150bb7363a8e03cca840b67137760f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://game.gnlore.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 13059
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 18:20:09 GMT
expires: Sun, 24 Sep 2023 18:20:09 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame BFA4 33 KB
34 KB 69ms
20ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 05:04:01 GMT
x-content-type-options: nosniff
age: 134168
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 22 Sep 2024 05:04:01 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame BFA4
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CT0w02H0QZYHEHJnU6gS-nIPQDLPHsKNui-H925QM2tkeEAEgjOqWfmCVgoCAmAegAa6YiqICyAEJqQJhMUYfcd-xPqgDAcgDywSqBPcBT9AgqHzTz2mi_kPWjXRgfHcZRjCqW7K0hx7JsoN...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2216756744097079510749%22,%22debug_reporting%22:true,%22destination%22:%22https://xcraft.net%22,%22event_report_window%22:%2...

0
0

96ms
55ms

Fetch
text/css

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2216756744097079510749%22,%22debug_reporting%22:true,%22destination%22:%22https://xcraft.net%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22608341038%22],%224%22:[%2209-24%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%226043714218688844257%22}&andc=true

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:09 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"16756744097079510749","debug_reporting":true,"destination":"https://xcraft.net","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["608341038"],"4":["09-24"],"6":["true"]},"priority":"500","source_event_id":"6043714218688844257"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 24 Sep 2023 18:20:09 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 24 Sep 2023 18:20:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"16756744097079510749","debug_reporting":true,"destination":"https://xcraft.net","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["608341038"],"4":["09-24"],"6":["true"]},"priority":"500","source_event_id":"6043714218688844257"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js Show response
pagead2.googlesyndication.com/bg/ Frame E1B5 37 KB
14 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85de8e1049567f060665a08f4f9784af156edc484723473acd40953eb3bde550

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 07:19:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 385245
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14709
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 07:19:24 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 141ms
54ms Preflight
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 24 Sep 2023 18:20:09 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame B68F 624 B
242 B 64ms
61ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsY5er4xgEwAQ&v=APEucNX_ApAbhUqPFSk_Wk-9hwYZ1p3pVqDLNH4DR21sIWP3qqk1-lFU7bRZC8REfB8WTEUZxg672lhzc724k7YxxKcCiyYJEoH6b-Q2e1sZ-iwsVHZTPu2IjsFZ-Js6GOHh_9jEUL6F7b1x5213XYegrNZkLTwVLmkZX5P1lzgo0aqb3fvv1MI

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2736490106&adf=2334466290&pi=t.aa~a.308491958~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280&nras=3&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=2115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cltBAE1Jvg&p=https%3A//game.gnlore.com&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2736490106&adf=2334466290&pi=t.aa~a.308491958~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280&nras=3&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=2115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cltBAE1Jvg&p=https%3A//game.gnlore.com&dtd=5
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 18:20:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 7A28 89 KB
31 KB 161ms
161ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4accbcd793680c2ea0a65714771ef37d5eeb42bdaedba9882dd0d78eae09e00e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:09 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31438
x-xss-protection: 0
server: cafe
etag: 13183557946744512263
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 24 Sep 2023 18:20:09 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 7A28 3 KB
1 KB 24ms
21ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:33:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6376
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 16:33:53 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 7A28 20 KB
8 KB 22ms
19ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21221
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:26:28 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 7A28 0
0 77ms
28ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQjxin9FYPwzQoetiPhDbrgoQfH9RcrfvO9wIPFySbmG682mcuNnRfKiFcStoj0CK5JwUI4qMrrQyVBaYMX4epGzrr1aA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2736490106&adf=2334466290&pi=t.aa~a.308491958~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280&nras=3&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=2115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cltBAE1Jvg&p=https%3A//game.gnlore.com&dtd=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7A28 182 KB
57 KB 60ms
58ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Sep 2023 18:20:09 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7A28 42 B
63 B 123ms
121ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CsmH7XVltHk3pTy-ei4y6iPtKhprGvaaeBEGTsxPFrRawOv0jYGs3bvNfb9csRP7zYka6LWYaVpEU5d1ZHcD5dUsNgwAGafgaWE7P4lPfIsCxoDsY

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7A28 0
20 B 123ms
121ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=15348802603310012892&x=1&ct=76

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame B68F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEOQ2tu-uk8j-oiEqdll0kA&google_cver=1

43 B
338 B

37ms
36ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEOQ2tu-uk8j-oiEqdll0kA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsY5er4xgEwAQ&v=APEucNX_ApAbhUqPFSk_Wk-9hwYZ1p3pVqDLNH4DR21sIWP3qqk1-lFU7bRZC8REfB8WTEUZxg672lhzc724k7YxxKcCiyYJEoH6b-Q2e1sZ-iwsVHZTPu2IjsFZ-Js6GOHh_9jEUL6F7b1x5213XYegrNZkLTwVLmkZX5P1lzgo0aqb3fvv1MI
Protocol: H2
Server: 104.18.27.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DPdoRyHXw5lBE9IqNSb1wBdiz1s7ymHBQzO7kgG%2B99jqhfzw8rz%2BXmMlvoWtIyDhoDxXqF5qKkX%2BJzILEVuOBKgSyESi1bsDpDoFaYE5wO1NCbdiQEW2vD5ku7aLuDvyNGKWJJ12pQsrtQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 80bd0a31afa83627-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEOQ2tu-uk8j-oiEqdll0kA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame B68F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZRB92R7NijsLMpH9ipPWMAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJHRGgMUGCNqO7ShbIZIknY&google_cver=1

43 B
770 B

41ms
40ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJHRGgMUGCNqO7ShbIZIknY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsY5er4xgEwAQ&v=APEucNX_ApAbhUqPFSk_Wk-9hwYZ1p3pVqDLNH4DR21sIWP3qqk1-lFU7bRZC8REfB8WTEUZxg672lhzc724k7YxxKcCiyYJEoH6b-Q2e1sZ-iwsVHZTPu2IjsFZ-Js6GOHh_9jEUL6F7b1x5213XYegrNZkLTwVLmkZX5P1lzgo0aqb3fvv1MI
Protocol: H3
Server: 104.18.27.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ErIY%2B9rfyqitOs3l1bgeAJLSW%2FsVu0pWVxjCSnlkAwsvuuQHN%2BcAJ3AsSrmGsdSvrY41Au7atfSIBPh%2B3mLCokiuHz5w4THZi%2F3kPxQEYin30pmEiHYZenl4fetnOWbESkJLaX3NOlA9%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 80bd0a323ec6362f-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJHRGgMUGCNqO7ShbIZIknY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame B68F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEDu3Jwv4wmL2OC98sWoHVGc&google_cver=1

43 B
841 B

28ms
28ms

Image
image/gif

185.89.210.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEDu3Jwv4wmL2OC98sWoHVGc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsY5er4xgEwAQ&v=APEucNX_ApAbhUqPFSk_Wk-9hwYZ1p3pVqDLNH4DR21sIWP3qqk1-lFU7bRZC8REfB8WTEUZxg672lhzc724k7YxxKcCiyYJEoH6b-Q2e1sZ-iwsVHZTPu2IjsFZ-Js6GOHh_9jEUL6F7b1x5213XYegrNZkLTwVLmkZX5P1lzgo0aqb3fvv1MI

Protocol

Server

185.89.210.244 , Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
an-x-request-uuid: a58a98ad-cc2d-43ed-b774-ff93d443186f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 217.114.215.133; 217.114.215.133; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEDu3Jwv4wmL2OC98sWoHVGc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame B68F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk3NDc5NzQxNTUxMDcyMzQwNQ%3D%3D

170 B
243 B

32ms
31ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk3NDc5NzQxNTUxMDcyMzQwNQ%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
an-x-request-uuid: 1c0b2020-c47d-4228-8f88-e086521b6be1
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk3NDc5NzQxNTUxMDcyMzQwNQ%3D%3D
x-proxy-origin: 217.114.215.133; 217.114.215.133; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7A28 0
20 B 123ms
122ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=930786289113&version=m202309120101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7A28 0
20 B 122ms
121ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=930786289113&version=m202309120101&ct=76&x=1&cor=15348802603310012000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7A28 103 KB
39 KB 73ms
73ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B90TQvqwiy-YKDMCeFq56dYi-6qrSgai4BbdK69qUXRE1XiNFCWcE9pVY_0xHqNe_bHvJSrXN6LN-BFDu7LhuWOVcMPTDYcRhn_yHBQl05aTKqFZUkz63UVOy8LEcKrTxxIycyON2DQ6dx0Ovp6UvwNoKotBWowyOWUG4mD68KrfBscjk&dbm_d=AKAmf-BCFphAax0Yp8djJTdR4yhAQO-5Mlsp8lzVwNQifEsG2PORCoKQqXhkqSY9kTgsGMZEebNoRWA-aKAGu63tHFc8056vuVePoz4YgFt3CBo0mBO_Ai1hzBUNuiHlxnjkcnae7lRDzeCQ93xZNAtAK9oZ7s13Oo2LpxprIBt7SpxRfWzibHjrOSAuLhnM3YzYTsB5PektCWGQIMBxh3Y-EawbE-Oa0YGbR5By4uNvWmEBQM7llKpC5oxnq_miHAS1Qit6vYBmR21zG0p_ww_uvg0UzidCZXsEp7nOa4XbVakgu_Qu3N-OwMEQglhynK43I87aQgPSKxdDSmx9z9N_yiRWXboVAw86pKqnVDK-i3Vl-_FFG5sac6m7dQegTXoMX7DdotNwCzlWIEi6GWdTbKPNL6V2e3I-uF0hfJOncIeWfA1mC0BPn9eYYGBCW4rbq1Ldc1JGN-oqQeMcCAATJTmrQUWL7tEYNvFgybpn2LL2dNlQxFWUTYQvEGVJk97MSlnal-VJ0NPsf933qOO-F2u3C4ZMKlFbKWGe5wPrUT8l8r2H5g9h7xdmmBHjvkNbVOHZM0UJ_K6v5Dt3M_EeqVWW84rJHJ6-6mVHBhj5zEJ0F1MHCIJYtxV3Xopu21Ms7xStuflBACvhx7QC4qi2wDOX-59HK9NOUpkWDSn6CloZoeKvx4w4M8Zvz0TafkdwTVLNm4NqPTw1syKjlYPBvMXu10iqBuIyMJxeu9VNGk8lClP5pWKiBvuIyJ3g2SZ5N1Lq9YNU4AJR5JaeJs8H1ju2l28KyBsZLe3jZG3cyluAg1buRGQrsQJRW6zKzaqbO1xybzm7oEpkrCkYauYsIQNXitneRnc0p3mF2qvbdYNBlrfxncR1BXiL3jDuxgptAIr8F3JlrlXk7YeY0UJYgFqGVfQEGnqNjASeXaexhI4kbonmXMhcATnZYMyoJQHmI9qh800XasFubHomVT5uRtcjT4Fmr58Fd6XLeVkksVwjAWl55Q8bCc5DZVQ9T2H4hFL6I984FkELVlLLredrvLlxtrUQcAjzupIF_IlkK9dUstQvkAF9OkwgN-4dptVGnuyb6R4IGH92cn7JHzOdhJ2ZAH2cDX34a_fXXF3pJ6yEJNNgzvhZmJVsakkA1Mew-GjVunrGIF0TPI_ndGGO8Jfi3fkG-XTWIsM12nZKb40DUZTesI2lGVWTrgKhfpsd-O7u6SkxX6mcN5hDNIMHEMlSpWLjQMziLKDN5EZiANw_OBDbRWGEs7qCAGNZixnLcOa06lFanHqxbiUfaFpaNYAI44hA1B07i1UehDzGNft1kmRBVrFnjekPmdZkDFrHxO2qNPh-jZYTjTHf9u8Lj47hJHKSHLhSSSPyg5EVo1WAuvjaFLxZFNCkXRCXhcf3vdWVrRxlivnbuqiZl5vAkr_wjmAStjWK9fozlJ2ALXM2KrQWW0BjcKLlHa7jBz4rCVS1pElwhWkEC-of3XviHBj2JbkXa0eUgV8hviuZ4juIz0luAjygF3PlTkySEmVuc_5SwHfYFzix56YCt1jQ3ZRCc45eK8XgXvST_ig6nc8HwsXMcJgrPnlrlDyAWSgmany95vOBlO3XI5d1Pavzic8OC72od6Hzt2EnGS9NzXAnaf_PtRE8kQrpivVBL0wImrNZuIpvkG4lssDY_4n2PH4rCudPJL-M1PxakpGo-Ve0Y1aj-csDhOVN8uqxup4LZTkrT6N4iO8X0Go8TW-HNx6joUFSDq6buTgicPimKZ468xxQxJnjygbII2zLEajB7D9OnZpu9h-cauS7omZQLaXRXR7Ztud2Ij2_1LfWkqRxNvRIhCESucYHEw_0ptWGZs6gXAnAMQjrGmsjY-wtatYahYy5YcxMqbOPmbRVJx30KRaQiE8uWSQMOQIbfEi9IVQaiE6aJTCKBU-kM8Tub9l1Rd8Qg0tLEDF3PtAQYEPs1D1n8G_tEjMRkVb7JS4rJDS9YQV5l5ZX8LV3kfh7-W1bl897hCPNV1m2-jpFZ3k9UrnGKLJPyty9OKBXc5UsEnPZuyqwzfGRScVElhS7k3f7TIx4KMwStKkDA8xhMQAS8bfI2y_bD8_g5xG95VYGNG5tgiHf-vFC9qwx9WStmGgzz_LlFLh_yRoodMZ5LfPPKif2wvPGU2jvGju-IbydaqW-R-yJS8sD6XPCZOPJB4hsS6W7QJvP2S6pCfYIfZJQaI_NaEZNz2NHGX9os8r3rAB1chz2oAfpYgUf-LBYhigz8gtXZR9MeHuYuXl3u7WtHZol0gpSINQZRmFdBgbhDGhTCkOmv41M4WnZbd9l0IWWDo6szxPO41Qer_4bsR6b4mbEFl46h5SPbq1syKrZTT4caYb57yp5FrUPms9mnX9DdtBmQxhg2CkPwnbJcFTOJiPVmkeIBrQ9pw14EIcGipKXdICXZITBraxxKrHxDOoV82XEauNZ6DpMQq48f1u7hgXep7eZJL1MDqt-yKREqMC1mR2RpnpgYnnj4aC_PuZC6S0njKWNlhMNdVIOc8CfAx1v8CUzC7vkY4lp0jFNMlVZJtcV_Wv1yQv1ysPgkUrQC3dBdbHjFmTsDr11-rmVjh7tOfpDcUhfJZrcd0eoe58_JRlpmXo16hC0FmSLvP_tyawk5DczfitMbw35xeUknR2xCrmb-DJxpk-2s3yX199vNtNJaqajto1PHRwxHhcy2RKphk3K-TM7_VqgweUzyygfJPnGxjOWdmNDLhHkEL18OO67gOGQunbIjwq9N6GKAKu8ZhWlY9oltjMwa7Cq9SpvhUe-g_wzETYBMhk9XOJLt-8zmWHrSU7MqL0z96_3eYsHCY4rUI6ZeH2huKEsg7XDQsfTItHlXO9O4gZJLeB9mC3UcWERmpLWuBqu0EUVrITble9hLtwCHjhFfSQDH-RfBrQQwXXuuQF-pTExmaFt8EFBWf1A8lTc9lG0_IsDT2bOVncVqPAdHGPYK35RnqqncEFPC3_mxYkHwyeksj4_TpSjL3SWu5VKbvh80Io-6J75gx5oXi3aVvLH0uWrlM372og4Cka8e8Uvu674374Dk6G8B-u10zZhPvZFfFlyl-NJtu1Gu1CtZPKi87JQ1PQuU-TkAymxXtmv8yy7WdXUY_WcXTWPx0NPPAP9hxKFfeVem-gl7dKy4Xun2AQLaLgFIxo95hsHGtDU18e5cbLYSqJhXfuFMJUeDVBF_ZE8w2kE7o8avIYN6riI63cgeFT6DsslRHhhfcCuMLRaapn6C6YvRwUAdWHCOomegE72DwlKmxdryYZFsTYNlzL0hSBvVLFYQlurLo9qCsbUVcfv5mnAl47DophlmpOLIexLJX7PBZIepo_UziYvVqK8LHB_xYEm_gXZCAor7jb-t-bRFwU9gzSWsdfm1yrzUA9C-2dOuUzHLlRnbH2a7I-ei_KiPqfRustjtLk9HiJ4yeEvA1597OF3wPTVADVszevF77XGjwcj14AFboLFyitmLABxZiRN1iQbkks7zTeeZOYcaBzhzv9dzJXE_CsbQZn179ve3yWX-ts9gwUeODF5h-7gE9akNltERgwuqUCXWB2IgpfluY9PV1gLpLZDtAszK5ggXZtFD69pjjukqYlvk09ogtI&cid=CAQSPABpAlJWaVkKRiZtysElqbYjw0aAsylh8jUaqKbRd7n-zxGLqL65osQtf1UB9X6d_IGSOpoSjWD1Fm1dMBgB&dv3_ver=m202309120101&rfl=https%3A%2F%2Fgame.gnlore.com%2F&ds=l&xdt=1&iif=1&cor=15348802603310012000&adk=497053795&idt=187&cac=0&dtd=26

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bb6c99b4c07e0ac204245abaf2275d8d3a6b9ffed0645add3a4570ad50c0aea4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2736490106&adf=2334466290&pi=t.aa~a.308491958~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280&nras=3&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=2115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cltBAE1Jvg&p=https%3A//game.gnlore.com&dtd=5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39701
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame AAC2 17 KB
1 KB 30ms
29ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat%3A400%2C500%7CGoogle%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=280&adk=2767623100&adf=1730821504&pi=t.aa~a.2296496848~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x280&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2100&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250&nras=4&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2467&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=HmtLWhpJ9o&p=https%3A//game.gnlore.com&dtd=31

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8736be1070fc66462690b8f676308abbab086d487bbe0eb9ac741b4b03da89a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 24 Sep 2023 18:20:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 17:57:01 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 24 Sep 2023 18:20:09 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame AAC2 2 KB
892 B 20ms
20ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:26:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21246
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:26:03 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/ Frame AAC2 23 KB
9 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:29:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21057
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
server: cafe
etag: 9583221549990841032
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:29:12 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame AAC2 3 KB
1 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:33:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6376
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 16:33:53 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame AAC2 20 KB
8 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21221
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:26:28 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame AAC2 0
0 29ms
28ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTEMj7fxajanK26Os0eAI78NehUapiLdvAe1-jLTICC2EiW9dgSgZbYbUFLMnl0DuOZAYqVgPFDW28A5xnU44JZkIWjLw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=280&adk=2767623100&adf=1730821504&pi=t.aa~a.2296496848~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x280&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2100&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250&nras=4&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2467&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=HmtLWhpJ9o&p=https%3A//game.gnlore.com&dtd=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AAC2 182 KB
57 KB 94ms
94ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Sep 2023 18:20:09 GMT

GET
H2 200 9041af033b7a690ba70e3134a2c135bf.js Show response
www.gstatic.com/mysidia/ Frame AAC2 36 KB
15 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9041af033b7a690ba70e3134a2c135bf.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f9d88352b286107f60c320c4c088f718c2a3a273818cd61901edb7f235a9339

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 09:37:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 463375
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15189
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 23:26:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 18 Dec 2023 09:37:14 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame EBCF 1 KB
643 B 23ms
21ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 81200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 19:46:49 GMT
etag: 48472445140208031
expires: Sun, 24 Sep 2023 19:46:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C3A1 624 B
242 B 66ms
62ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNVAEJ5lSgDp7EBmnMcT6C0_zn4VvN-7pP0HYLK6PxYo3eXUzFK9mOl5UUJ4_eNw9wURcInYOBxuah_MZ_DyTSUSvTlsESqPCooHflbvF0Q6sbqu5gFZahWe8BwHyawzOA8R3vTcrW288iQv0H0jcfvFd9l_BAdfrm8-o3GxYBwSt_BaTJg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=90&adk=3130937508&adf=226233620&pi=t.aa~a.1154693969~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x90&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250%2C1200x280&nras=5&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2757&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=xuohkQVNe2&p=https%3A//game.gnlore.com&dtd=37

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=90&adk=3130937508&adf=226233620&pi=t.aa~a.1154693969~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x90&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250%2C1200x280&nras=5&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2757&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=xuohkQVNe2&p=https%3A//game.gnlore.com&dtd=37
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 18:20:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 7462 89 KB
31 KB 230ms
230ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4accbcd793680c2ea0a65714771ef37d5eeb42bdaedba9882dd0d78eae09e00e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:09 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31438
x-xss-protection: 0
server: cafe
etag: 13183557946744512263
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 24 Sep 2023 18:20:09 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 7462 3 KB
1 KB 22ms
19ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:33:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6376
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 16:33:53 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 7462 20 KB
8 KB 23ms
20ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21221
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:26:28 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 7462 0
0 30ms
27ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSko8JHFn3koQtY_0Jl4M52eOVviVNOiQ-J-eG5HFoCsS2LGz-CH_poWyG2nBPxp8JufzsTUgLYm9ukdCBHRJRNtLR3vQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=90&adk=3130937508&adf=226233620&pi=t.aa~a.1154693969~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x90&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250%2C1200x280&nras=5&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2757&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=xuohkQVNe2&p=https%3A//game.gnlore.com&dtd=37
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7462 182 KB
57 KB 129ms
126ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Sep 2023 18:20:10 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7462 42 B
63 B 123ms
120ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BvZDy-4a-jHtEqW_NYthvWWrXrXee3Hrf87NmZcz3mniKDCyWM4zum_0aS1xahfl8FEOjfT-r2-TV5Pe8t2_LSihJB2JkXlgD7Kx241eHS8NsGDM0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7462 0
20 B 124ms
121ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=10538905297369636256&x=1&ct=77

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/14809003673391781576/ Frame AAC2 40 KB
40 KB 25ms
23ms Image
image/jpeg 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14809003673391781576/14763004658117789537?w=600&h=314

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d6b6b77c0d3ef41ecf8ba29f5351171104e466910fa007d590a7c62004efeb6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 16:16:33 GMT
x-content-type-options: nosniff
age: 439416
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40815
x-xss-protection: 0
last-modified: Thu, 01 Sep 2022 14:28:50 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 18 Sep 2024 16:16:33 GMT

GET
DATA 200
OK truncated
/ Frame AAC2 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame AAC2 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame AAC2 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7558855ee5a48c98018f73c01b91b9ae06da4be88f8ed7fd5b0b252b16c106c7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EBCF
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEEQaIPn0naOvH_Ov9JtF0fE&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEEQaIPn0naOvH_Ov9JtF0fE&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=aTF4SENGOXYxUUt0SWU1&google_gid=CAESEEQaIPn0naOvH_Ov9JtF0fE&google_cver=1&google_push=AXcoOmRLdkrMVFA8F4C-g-wIbwDirhYFaZhmsi2GDDuuTCw...

170 B
188 B

32ms
32ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=aTF4SENGOXYxUUt0SWU1&google_gid=CAESEEQaIPn0naOvH_Ov9JtF0fE&google_cver=1&google_push=AXcoOmRLdkrMVFA8F4C-g-wIbwDirhYFaZhmsi2GDDuuTCw0TdOkHVsw9SVNzcFUdU6DulIR1sgUUxlXUYouIMDD00rRk0NCmT9q67c

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 18:20:10 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-789-g976496f#rel-ec2-master i-0848f2daa11a85918@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=aTF4SENGOXYxUUt0SWU1&google_gid=CAESEEQaIPn0naOvH_Ov9JtF0fE&google_cver=1&google_push=AXcoOmRLdkrMVFA8F4C-g-wIbwDirhYFaZhmsi2GDDuuTCw0TdOkHVsw9SVNzcFUdU6DulIR1sgUUxlXUYouIMDD00rRk0NCmT9q67c
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EBCF
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEP7Jnf7CqiNK6HXFizDEt-s&google_cver=1&google_push=AXcoOmTQSZIj1UkbUVeGyqxVIpW5Dck6Tlh4yp0UZ9WF25Dp4afILew9ZsvseCYQ8_T61nqaLsJAE3iLgPsZxf4oNM489NYhbJwh-w
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=41F3CDC676584E19AF349086F837717E&google_push=AXcoOmTQSZIj1UkbUVeGyqxVIpW5Dck6Tlh4yp0UZ9WF25Dp4afILew9ZsvseCYQ8_T61nqaLsJAE3iLgPsZxf4...

170 B
188 B

33ms
32ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=41F3CDC676584E19AF349086F837717E&google_push=AXcoOmTQSZIj1UkbUVeGyqxVIpW5Dck6Tlh4yp0UZ9WF25Dp4afILew9ZsvseCYQ8_T61nqaLsJAE3iLgPsZxf4oNM489NYhbJwh-w

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 24 Sep 2023 18:20:10 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=41F3CDC676584E19AF349086F837717E&google_push=AXcoOmTQSZIj1UkbUVeGyqxVIpW5Dck6Tlh4yp0UZ9WF25Dp4afILew9ZsvseCYQ8_T61nqaLsJAE3iLgPsZxf4oNM489NYhbJwh-w
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sat, 23 Sep 2023 18:20:10 GMT

GET
H2 451 466606.gif
id.rlcdn.com/ Frame EBCF 0
98 B 95ms
28ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAXcoOmTjLxGcHK7HFiHi_W3_NJKoMoc_hv9wN3Oy4IT-jg95DsMLkq85DrEHUWYUP3Rd5jEOBWb4isNjk7b52f-ilq9xiv7-e0pjfQ&google_gid=CAESEAG-bNltrVgCzjb2jOoBtzQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=280&adk=2767623100&adf=1730821504&pi=t.aa~a.2296496848~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x280&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2100&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250&nras=4&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2467&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=HmtLWhpJ9o&p=https%3A//game.gnlore.com&dtd=31
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:10 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 sync
x.bidswitch.net/ Frame EBCF 43 B
146 B 98ms
21ms Image
image/gif 18.196.96.246
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEDb10O61ZGx9k-SW4caaZ54&google_cver=1&google_push=AXcoOmS7Zvr92psK3kplmMknWnrRwC6HYjVeXg_ynSNl_7JqkJ11r4T4YgpFt9dBK1o8I7syTm4eHCbFs4n8DKH1UTXPvzn51DK5zvk
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=280&adk=2767623100&adf=1730821504&pi=t.aa~a.2296496848~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x280&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2100&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250&nras=4&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2467&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=HmtLWhpJ9o&p=https%3A//game.gnlore.com&dtd=31
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.196.96.246 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-96-246.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:10 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame EBCF 43 B
363 B 112ms
30ms Image
image/gif 178.250.7.11
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQeiIw4bnLr5dLp9_7HjrpOsin9p1vVKlf67N_W68ewWMriFGb9WPmu7X9RkGIr6bQ_2ePlJZUD4OomlNsXAReFAqCoeXRe0ow&google_gid=CAESEDKQBS_8eMBHUWzxd0VzFL0&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.7.11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:09 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 229960
expires: Sun, 24 Sep 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EBCF
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEJMva3Zu75bIznNdG5wFaJ4&google_cver=1&google_push=AXcoOmQCVdCOs5NO9mQ1rvy4kapHjmnhuUtHdJQkludkMkhirpEdLGdC-lF2yt1Bt_s6TUNmLCQHkE9Mt7_d...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQCVdCOs5NO9mQ1rvy4kapHjmnhuUtHdJQkludkMkhirpEdLGdC-lF2yt1Bt_s6TUNmLCQHkE9Mt7_d7g2S9_zAvLqV_SOqpyg

170 B
188 B

30ms
29ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQCVdCOs5NO9mQ1rvy4kapHjmnhuUtHdJQkludkMkhirpEdLGdC-lF2yt1Bt_s6TUNmLCQHkE9Mt7_d7g2S9_zAvLqV_SOqpyg

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQCVdCOs5NO9mQ1rvy4kapHjmnhuUtHdJQkludkMkhirpEdLGdC-lF2yt1Bt_s6TUNmLCQHkE9Mt7_d7g2S9_zAvLqV_SOqpyg
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET googleredir
googlecm.hit.gemius.pl/ Frame EBCF 0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame EBCF 0
12 B 32ms
30ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ljn3fuRWk2RKTdjGrC1MjASEOTy_pvOEm-IOti630lb0Xg5Q9oa_D8lZo2MAy06fE719DBMg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:09 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 7A28 172 KB
61 KB 93ms
19ms Script
text/javascript 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:29:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21059
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 25 Sep 2023 12:29:11 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230920/r20110914/elements/html/ Frame 7A28 11 KB
4 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230920/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B90TQvqwiy-YKDMCeFq56dYi-6qrSgai4BbdK69qUXRE1XiNFCWcE9pVY_0xHqNe_bHvJSrXN6LN-BFDu7LhuWOVcMPTDYcRhn_yHBQl05aTKqFZUkz63UVOy8LEcKrTxxIycyON2DQ6dx0Ovp6UvwNoKotBWowyOWUG4mD68KrfBscjk&dbm_d=AKAmf-BCFphAax0Yp8djJTdR4yhAQO-5Mlsp8lzVwNQifEsG2PORCoKQqXhkqSY9kTgsGMZEebNoRWA-aKAGu63tHFc8056vuVePoz4YgFt3CBo0mBO_Ai1hzBUNuiHlxnjkcnae7lRDzeCQ93xZNAtAK9oZ7s13Oo2LpxprIBt7SpxRfWzibHjrOSAuLhnM3YzYTsB5PektCWGQIMBxh3Y-EawbE-Oa0YGbR5By4uNvWmEBQM7llKpC5oxnq_miHAS1Qit6vYBmR21zG0p_ww_uvg0UzidCZXsEp7nOa4XbVakgu_Qu3N-OwMEQglhynK43I87aQgPSKxdDSmx9z9N_yiRWXboVAw86pKqnVDK-i3Vl-_FFG5sac6m7dQegTXoMX7DdotNwCzlWIEi6GWdTbKPNL6V2e3I-uF0hfJOncIeWfA1mC0BPn9eYYGBCW4rbq1Ldc1JGN-oqQeMcCAATJTmrQUWL7tEYNvFgybpn2LL2dNlQxFWUTYQvEGVJk97MSlnal-VJ0NPsf933qOO-F2u3C4ZMKlFbKWGe5wPrUT8l8r2H5g9h7xdmmBHjvkNbVOHZM0UJ_K6v5Dt3M_EeqVWW84rJHJ6-6mVHBhj5zEJ0F1MHCIJYtxV3Xopu21Ms7xStuflBACvhx7QC4qi2wDOX-59HK9NOUpkWDSn6CloZoeKvx4w4M8Zvz0TafkdwTVLNm4NqPTw1syKjlYPBvMXu10iqBuIyMJxeu9VNGk8lClP5pWKiBvuIyJ3g2SZ5N1Lq9YNU4AJR5JaeJs8H1ju2l28KyBsZLe3jZG3cyluAg1buRGQrsQJRW6zKzaqbO1xybzm7oEpkrCkYauYsIQNXitneRnc0p3mF2qvbdYNBlrfxncR1BXiL3jDuxgptAIr8F3JlrlXk7YeY0UJYgFqGVfQEGnqNjASeXaexhI4kbonmXMhcATnZYMyoJQHmI9qh800XasFubHomVT5uRtcjT4Fmr58Fd6XLeVkksVwjAWl55Q8bCc5DZVQ9T2H4hFL6I984FkELVlLLredrvLlxtrUQcAjzupIF_IlkK9dUstQvkAF9OkwgN-4dptVGnuyb6R4IGH92cn7JHzOdhJ2ZAH2cDX34a_fXXF3pJ6yEJNNgzvhZmJVsakkA1Mew-GjVunrGIF0TPI_ndGGO8Jfi3fkG-XTWIsM12nZKb40DUZTesI2lGVWTrgKhfpsd-O7u6SkxX6mcN5hDNIMHEMlSpWLjQMziLKDN5EZiANw_OBDbRWGEs7qCAGNZixnLcOa06lFanHqxbiUfaFpaNYAI44hA1B07i1UehDzGNft1kmRBVrFnjekPmdZkDFrHxO2qNPh-jZYTjTHf9u8Lj47hJHKSHLhSSSPyg5EVo1WAuvjaFLxZFNCkXRCXhcf3vdWVrRxlivnbuqiZl5vAkr_wjmAStjWK9fozlJ2ALXM2KrQWW0BjcKLlHa7jBz4rCVS1pElwhWkEC-of3XviHBj2JbkXa0eUgV8hviuZ4juIz0luAjygF3PlTkySEmVuc_5SwHfYFzix56YCt1jQ3ZRCc45eK8XgXvST_ig6nc8HwsXMcJgrPnlrlDyAWSgmany95vOBlO3XI5d1Pavzic8OC72od6Hzt2EnGS9NzXAnaf_PtRE8kQrpivVBL0wImrNZuIpvkG4lssDY_4n2PH4rCudPJL-M1PxakpGo-Ve0Y1aj-csDhOVN8uqxup4LZTkrT6N4iO8X0Go8TW-HNx6joUFSDq6buTgicPimKZ468xxQxJnjygbII2zLEajB7D9OnZpu9h-cauS7omZQLaXRXR7Ztud2Ij2_1LfWkqRxNvRIhCESucYHEw_0ptWGZs6gXAnAMQjrGmsjY-wtatYahYy5YcxMqbOPmbRVJx30KRaQiE8uWSQMOQIbfEi9IVQaiE6aJTCKBU-kM8Tub9l1Rd8Qg0tLEDF3PtAQYEPs1D1n8G_tEjMRkVb7JS4rJDS9YQV5l5ZX8LV3kfh7-W1bl897hCPNV1m2-jpFZ3k9UrnGKLJPyty9OKBXc5UsEnPZuyqwzfGRScVElhS7k3f7TIx4KMwStKkDA8xhMQAS8bfI2y_bD8_g5xG95VYGNG5tgiHf-vFC9qwx9WStmGgzz_LlFLh_yRoodMZ5LfPPKif2wvPGU2jvGju-IbydaqW-R-yJS8sD6XPCZOPJB4hsS6W7QJvP2S6pCfYIfZJQaI_NaEZNz2NHGX9os8r3rAB1chz2oAfpYgUf-LBYhigz8gtXZR9MeHuYuXl3u7WtHZol0gpSINQZRmFdBgbhDGhTCkOmv41M4WnZbd9l0IWWDo6szxPO41Qer_4bsR6b4mbEFl46h5SPbq1syKrZTT4caYb57yp5FrUPms9mnX9DdtBmQxhg2CkPwnbJcFTOJiPVmkeIBrQ9pw14EIcGipKXdICXZITBraxxKrHxDOoV82XEauNZ6DpMQq48f1u7hgXep7eZJL1MDqt-yKREqMC1mR2RpnpgYnnj4aC_PuZC6S0njKWNlhMNdVIOc8CfAx1v8CUzC7vkY4lp0jFNMlVZJtcV_Wv1yQv1ysPgkUrQC3dBdbHjFmTsDr11-rmVjh7tOfpDcUhfJZrcd0eoe58_JRlpmXo16hC0FmSLvP_tyawk5DczfitMbw35xeUknR2xCrmb-DJxpk-2s3yX199vNtNJaqajto1PHRwxHhcy2RKphk3K-TM7_VqgweUzyygfJPnGxjOWdmNDLhHkEL18OO67gOGQunbIjwq9N6GKAKu8ZhWlY9oltjMwa7Cq9SpvhUe-g_wzETYBMhk9XOJLt-8zmWHrSU7MqL0z96_3eYsHCY4rUI6ZeH2huKEsg7XDQsfTItHlXO9O4gZJLeB9mC3UcWERmpLWuBqu0EUVrITble9hLtwCHjhFfSQDH-RfBrQQwXXuuQF-pTExmaFt8EFBWf1A8lTc9lG0_IsDT2bOVncVqPAdHGPYK35RnqqncEFPC3_mxYkHwyeksj4_TpSjL3SWu5VKbvh80Io-6J75gx5oXi3aVvLH0uWrlM372og4Cka8e8Uvu674374Dk6G8B-u10zZhPvZFfFlyl-NJtu1Gu1CtZPKi87JQ1PQuU-TkAymxXtmv8yy7WdXUY_WcXTWPx0NPPAP9hxKFfeVem-gl7dKy4Xun2AQLaLgFIxo95hsHGtDU18e5cbLYSqJhXfuFMJUeDVBF_ZE8w2kE7o8avIYN6riI63cgeFT6DsslRHhhfcCuMLRaapn6C6YvRwUAdWHCOomegE72DwlKmxdryYZFsTYNlzL0hSBvVLFYQlurLo9qCsbUVcfv5mnAl47DophlmpOLIexLJX7PBZIepo_UziYvVqK8LHB_xYEm_gXZCAor7jb-t-bRFwU9gzSWsdfm1yrzUA9C-2dOuUzHLlRnbH2a7I-ei_KiPqfRustjtLk9HiJ4yeEvA1597OF3wPTVADVszevF77XGjwcj14AFboLFyitmLABxZiRN1iQbkks7zTeeZOYcaBzhzv9dzJXE_CsbQZn179ve3yWX-ts9gwUeODF5h-7gE9akNltERgwuqUCXWB2IgpfluY9PV1gLpLZDtAszK5ggXZtFD69pjjukqYlvk09ogtI&cid=CAQSPABpAlJWaVkKRiZtysElqbYjw0aAsylh8jUaqKbRd7n-zxGLqL65osQtf1UB9X6d_IGSOpoSjWD1Fm1dMBgB&dv3_ver=m202309120101&rfl=https%3A%2F%2Fgame.gnlore.com%2F&ds=l&xdt=1&iif=1&cor=15348802603310012000&adk=497053795&idt=187&cac=0&dtd=26

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 06:58:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40904
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 06:58:25 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230920/r20110914/ Frame 7A28 30 KB
11 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230920/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c5e1a1e8982becdc83263b687951cfc5c5976af5b5d67eab53451cb72ac78925

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 06:58:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40904
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11587
x-xss-protection: 0
server: cafe
etag: 192838463742493612
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 06:58:25 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7A28 41 KB
13 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 280421
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 20 Sep 2024 12:26:28 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 82E7 1 KB
643 B 26ms
25ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 81200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 19:46:49 GMT
etag: 48472445140208031
expires: Sun, 24 Sep 2023 19:46:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7A28 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1293f8310bfc9697dcd9d64de42e332ff59e594eca1bc3e255474c0693167d23

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C3A1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJHRGgMUGCNqO7ShbIZIknY&google_cver=1

43 B
730 B

36ms
36ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJHRGgMUGCNqO7ShbIZIknY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNVAEJ5lSgDp7EBmnMcT6C0_zn4VvN-7pP0HYLK6PxYo3eXUzFK9mOl5UUJ4_eNw9wURcInYOBxuah_MZ_DyTSUSvTlsESqPCooHflbvF0Q6sbqu5gFZahWe8BwHyawzOA8R3vTcrW288iQv0H0jcfvFd9l_BAdfrm8-o3GxYBwSt_BaTJg
Protocol: H3
Server: 104.18.27.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4xu7yzDHna6i8i1BcaZb16mHhO33h1OzhkX7s71SaWh87Q7nZ7EitPpXaU9KdByUe%2BCdko%2Fp2UCZhCiUg5kkA13BjlDpcBb5fQuUofRR7awjJP%2FxA54SIvUJZ9flsBT0q4NViPhbY1lwvQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 80bd0a331fcf362f-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJHRGgMUGCNqO7ShbIZIknY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C3A1
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZRB92R7NijsLMpH9ipPWMAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJHRGgMUGCNqO7ShbIZIknY&google_cver=1

43 B
733 B

44ms
43ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJHRGgMUGCNqO7ShbIZIknY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNVAEJ5lSgDp7EBmnMcT6C0_zn4VvN-7pP0HYLK6PxYo3eXUzFK9mOl5UUJ4_eNw9wURcInYOBxuah_MZ_DyTSUSvTlsESqPCooHflbvF0Q6sbqu5gFZahWe8BwHyawzOA8R3vTcrW288iQv0H0jcfvFd9l_BAdfrm8-o3GxYBwSt_BaTJg
Protocol: H3
Server: 104.18.27.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WT5RZkVFPLutH9itdnk7VIFeakgHEdjJAQH2mN%2B%2BKcWoU4QgfKvyREDQ6C95EcgrzBGo%2BzcSYme7QvFTwHGMnC3utrpbdDxH%2F6eoZABisyBZcU3f2eeMqNOlASUcn1P0eKuFHmjJSkMudQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 80bd0a334818362f-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJHRGgMUGCNqO7ShbIZIknY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame C3A1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESELafMlP-UhULMeZ8KlrLsbo&google_cver=1

43 B
844 B

29ms
28ms

Image
image/gif

185.89.210.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESELafMlP-UhULMeZ8KlrLsbo&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNVAEJ5lSgDp7EBmnMcT6C0_zn4VvN-7pP0HYLK6PxYo3eXUzFK9mOl5UUJ4_eNw9wURcInYOBxuah_MZ_DyTSUSvTlsESqPCooHflbvF0Q6sbqu5gFZahWe8BwHyawzOA8R3vTcrW288iQv0H0jcfvFd9l_BAdfrm8-o3GxYBwSt_BaTJg

Protocol

Server

185.89.210.244 , Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
an-x-request-uuid: 2f361d95-04fb-4b0c-a5f4-3f2201ee2441
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 217.114.215.133; 217.114.215.133; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESELafMlP-UhULMeZ8KlrLsbo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C3A1
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk3NDc5NzQxNTUxMDcyMzQwNQ%3D%3D

170 B
188 B

32ms
31ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk3NDc5NzQxNTUxMDcyMzQwNQ%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
an-x-request-uuid: 94e9e639-8c23-4e07-80b0-4144924a6165
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk3NDc5NzQxNTUxMDcyMzQwNQ%3D%3D
x-proxy-origin: 217.114.215.133; 217.114.215.133; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 82E7 0
104 B 220ms
70ms Image
text/plain 2a02:fa8:8806:20::2040
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEG1MG05Zdm4W4bVvht5rcro&google_cver=1&google_push=AXcoOmShiLwyRgG5N94HPYhrGuM2SXQ8rlKntKi0iZqfG1jZT8PcyU67ZuA_jSa7TN6QgUDmQM6NnytZG0A2XRZ2I9VLz9EVUrGVspw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2736490106&adf=2334466290&pi=t.aa~a.308491958~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280&nras=3&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=2115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cltBAE1Jvg&p=https%3A//game.gnlore.com&dtd=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:20::2040 , Sweden, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 82E7
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEBT8NKSvlG2xHx4xBZ0DABw&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEBT8NKSvlG2xHx4xBZ0DABw&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=WXUxZFplNkwxUUt0SWU1&google_gid=CAESEBT8NKSvlG2xHx4xBZ0DABw&google_cver=1&google_push=AXcoOmQJ6jS08H-Igjt_Vi7d81Qzbm2rMM9jEZvHe0slY1j...

170 B
188 B

32ms
32ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=WXUxZFplNkwxUUt0SWU1&google_gid=CAESEBT8NKSvlG2xHx4xBZ0DABw&google_cver=1&google_push=AXcoOmQJ6jS08H-Igjt_Vi7d81Qzbm2rMM9jEZvHe0slY1j_-I739Ug4XnVWw-RDKvKG0T-zaUUvcZ68l0xAgR5lrUmn3_5AOf51414

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 18:20:09 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-789-g976496f#rel-ec2-master i-0f37db6ac3f837baf@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=WXUxZFplNkwxUUt0SWU1&google_gid=CAESEBT8NKSvlG2xHx4xBZ0DABw&google_cver=1&google_push=AXcoOmQJ6jS08H-Igjt_Vi7d81Qzbm2rMM9jEZvHe0slY1j_-I739Ug4XnVWw-RDKvKG0T-zaUUvcZ68l0xAgR5lrUmn3_5AOf51414
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 82E7 70 B
265 B 142ms
42ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEGGeWZB7u5I6PsL7HTSRta8&google_cver=1&google_push=AXcoOmT1eprEaaQ9mDMY4CwAdP1qFgSo_-IJevaqV5o0d2jhB2wmmrXvyUEVEBT2JKDbTpU0a9cUDORJjvxbBXV49_foPu7l-dwW--rT
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2736490106&adf=2334466290&pi=t.aa~a.308491958~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=-M&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280&nras=3&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=2115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cltBAE1Jvg&p=https%3A//game.gnlore.com&dtd=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 82E7
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEOfTM2EcZ4wx5LdfYLuMBQg&google_cver=1&google_push=AXcoOmSKNXA33-7NJWSLXlzdb0A2Jk3VrHuDS6VYlS2AGw6-28eIHfygVvQUxsXmb3DXXpAdEmAsUWPVdEk...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmSKNXA33-7NJWSLXlzdb0A2Jk3VrHuDS6VYlS2AGw6-28eIHfygVvQUxsXmb3DXXpAdEmAsUWPVdEk4hLi3ggTFB433TCbF9AqY&google_hm=1_uenND4RdaPKsU1...

170 B
188 B

32ms
31ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmSKNXA33-7NJWSLXlzdb0A2Jk3VrHuDS6VYlS2AGw6-28eIHfygVvQUxsXmb3DXXpAdEmAsUWPVdEk4hLi3ggTFB433TCbF9AqY&google_hm=1_uenND4RdaPKsU19MAS_IU

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmSKNXA33-7NJWSLXlzdb0A2Jk3VrHuDS6VYlS2AGw6-28eIHfygVvQUxsXmb3DXXpAdEmAsUWPVdEk4hLi3ggTFB433TCbF9AqY&google_hm=1_uenND4RdaPKsU19MAS_IU
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 82E7
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECvwASSn103JgOOgKkyyz_U&google_cver=1&google_push=AXcoOmRoJzpYbOZ42a6dkOQbmHzVmHGGdAxrTbn56eMrJXPeiu0Tx9g0WLnIN4MgFgrkkp5WqPpqfpDQur8oH2l1UUwr7PM...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRoJzpYbOZ42a6dkOQbmHzVmHGGdAxrTbn56eMrJXPeiu0Tx9g0WLnIN4MgFgrkkp5WqPpqfpDQur8oH2l1UUwr7PMQHNlvTg0&google_hm=eS1SZkFTb0FSRTJwR25...

170 B
188 B

33ms
33ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRoJzpYbOZ42a6dkOQbmHzVmHGGdAxrTbn56eMrJXPeiu0Tx9g0WLnIN4MgFgrkkp5WqPpqfpDQur8oH2l1UUwr7PMQHNlvTg0&google_hm=eS1SZkFTb0FSRTJwR25VLndzVEhPVU9WcjRhaXFNRzJNY35B

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 24 Sep 2023 18:20:10 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRoJzpYbOZ42a6dkOQbmHzVmHGGdAxrTbn56eMrJXPeiu0Tx9g0WLnIN4MgFgrkkp5WqPpqfpDQur8oH2l1UUwr7PMQHNlvTg0&google_hm=eS1SZkFTb0FSRTJwR25VLndzVEhPVU9WcjRhaXFNRzJNY35B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 82E7
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEOQERKisCWzB_hRJdbCSkkA&google_cver=1&google_push=AXcoOmS6FdzpVrmJ1Hj4OKRr4aDD4m3NsO6d9TSUW8s35xCYwRFvCwA8tW8FcI7FEYVQda2XYF9XAL1X...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEOQERKisCWzB_hRJdbCSkkA&google_cver=1&google_push=AXcoOmS6FdzpVrmJ1Hj4OKRr4aDD4m3NsO6d9TSUW8s35xCYwRFvCwA8tW8FcI7FEYVQda2XYF9...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODY5ODE1MDAyNzU3MTA4MjUwMA&google_push=AXcoOmS6FdzpVrmJ1Hj4OKRr4aDD4m3NsO6d9TSUW8s35xCYwRFvCwA8tW8FcI7FEYVQda2XYF9XAL...

170 B
188 B

29ms
29ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODY5ODE1MDAyNzU3MTA4MjUwMA&google_push=AXcoOmS6FdzpVrmJ1Hj4OKRr4aDD4m3NsO6d9TSUW8s35xCYwRFvCwA8tW8FcI7FEYVQda2XYF9XAL1X-ZfRfVMxvUwQuy8kLA-9Fm8W

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODY5ODE1MDAyNzU3MTA4MjUwMA&google_push=AXcoOmS6FdzpVrmJ1Hj4OKRr4aDD4m3NsO6d9TSUW8s35xCYwRFvCwA8tW8FcI7FEYVQda2XYF9XAL1X-ZfRfVMxvUwQuy8kLA-9Fm8W
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 82E7
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEMwng3erfTYPMQwUqHZ5oH0&google_cver=1&google_push=AXcoOmSWLc8f1gOIXOvAKQUFojydWNq1dsVQaPR4eAuFdbpMc-CPdHIwou689d57ldi1dbe_jympnNjy3qzL...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSWLc8f1gOIXOvAKQUFojydWNq1dsVQaPR4eAuFdbpMc-CPdHIwou689d57ldi1dbe_jympnNjy3qzLhnDa5jdZirrEqkwfTe32

170 B
188 B

34ms
34ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSWLc8f1gOIXOvAKQUFojydWNq1dsVQaPR4eAuFdbpMc-CPdHIwou689d57ldi1dbe_jympnNjy3qzLhnDa5jdZirrEqkwfTe32

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSWLc8f1gOIXOvAKQUFojydWNq1dsVQaPR4eAuFdbpMc-CPdHIwou689d57ldi1dbe_jympnNjy3qzLhnDa5jdZirrEqkwfTe32
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 82E7 0
12 B 30ms
29ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KvI5OoodKfuDaOkxUG__XkE1UxQnKFuekc5dICy6LmnR3rv4AElBVwCTEoHOjJ2UcW4qXL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 984C 22 KB
8 KB 86ms
86ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 280422
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 21 Sep 2023 12:26:28 GMT
expires: Fri, 20 Sep 2024 12:26:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v26/ Frame AAC2 32 KB
32 KB 79ms
78ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat%3A400%2C500%7CGoogle%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 18:17:59 GMT
x-content-type-options: nosniff
age: 259331
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33092
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:51:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 20 Sep 2024 18:17:59 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame AAC2 33 KB
33 KB 70ms
70ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat%3A400%2C500%7CGoogle%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 05:04:01 GMT
x-content-type-options: nosniff
age: 134169
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 22 Sep 2024 05:04:01 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame AAC2
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C8TKp2X0QZbflDcak78EPv42nkA2zx7CjbqCP-K3yC9rZHhABIIzqln5glYKAgJgHoAGumIqiAsgBCakCYTFGH3HfsT6oAwHIA8sEqgTxAU_QRzC3_yp_S0xxlXNjdU5fpdD3Rrg_HcA10M2...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2218438662421790227813%22,%22debug_reporting%22:true,%22destination%22:%22https://xcraft.net%22,%22event_report_window%22:%2...

0
0

55ms
55ms

Fetch
text/css

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2218438662421790227813%22,%22debug_reporting%22:true,%22destination%22:%22https://xcraft.net%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22608341038%22],%224%22:[%2209-24%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2215176676339710286113%22}&andc=true

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:10 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"18438662421790227813","debug_reporting":true,"destination":"https://xcraft.net","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["608341038"],"4":["09-24"],"6":["true"]},"priority":"500","source_event_id":"15176676339710286113"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 24 Sep 2023 18:20:10 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 24 Sep 2023 18:20:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"18438662421790227813","debug_reporting":true,"destination":"https://xcraft.net","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["608341038"],"4":["09-24"],"6":["true"]},"priority":"500","source_event_id":"15176676339710286113"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js Show response
pagead2.googlesyndication.com/bg/ Frame 55EC 37 KB
14 KB 62ms
62ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85de8e1049567f060665a08f4f9784af156edc484723473acd40953eb3bde550

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 07:19:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 385246
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14709
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 07:19:24 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7462 0
20 B 122ms
120ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4268946655198&version=m202309120101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7462 0
20 B 123ms
121ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4268946655198&version=m202309120101&ct=77&x=1&cor=10538905297369637000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7462 16 KB
12 KB 57ms
56ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DQzyxjHjWhrvg4Dshvs6d47FmgzJVkzAjtYAEUOv0M6juiFkAkGPphB14EFMxS5HJRqUIJQ8ATSxK7VeAEbaAoxEE7elC_ksLaTI1mk6a_z-nGU1SLAKldsYe4FQEmBdTzSAv1q69XlsH63gYBcbX3fUOiA52IapKJTkemej0NAF18Djc&cry=1&dbm_d=AKAmf-DRhDopsJDIsMsewhJ2hQYLFhBiypfdtxHHG-f6RaAf6kfkYmngqgQqIBZVWTLCyKxZSfpm2PHcS3RYP4BHYs6Pf6QM84NMNpHY75C0ERBoBCXJYwTvZ_mnnmDCuX0VKHe-W1Wfhl4CGH5ETX2L9iS2u6uD547TgoJNsgSviKv6CMR7G1QjXAIQyP_lM9HrjwXcBYa-WKQAH1Flzi-AgN8HWLNq5SfMd7cEo17hoDNNhYEGZ52fF9pFTOYLQZiNTK4HDSjn5G2eu2CRop9bx6DU4nb0ow-7KUsLG4De358AiNCO-LpxSlHJxJJ4ba4dxx4zspk-Nb2vwuPOGlXm4F01d8pmC3K5YGg8m_9NhdLjGJWqHc5tb1nIzjktNq1NZDjzR6U8OSzhqUJLZmaRXQmtT-7fnm9pvxrxdpS8LpVRMuCwBDDgcK9ehejFjFF778882LIALO8DSig6zCCmzLY723lU8ORMDqryAaSGTTN5e_uUh2l3p-Ad6xHsWUQAoT_LFCINq0j8qhrm5_95ljjGpFQhsjLoZIgLQiZJeiI5Z_zvbrrXrRL8gd3bQTqRmaIRXq6QP0dVlcK6f0nxSCEOnX-wLo-LuioVxWCPu-9FU4FQQQq_4Lmtgav-rxsckFzqsbg9ij0DWpbYlJ37fQm1_ABLGAMJNhpiSIlNROZJ6-3tTcdJHmkJJltg-VN-10OYiG-whT0gZfqlV6iK1XPNFwwUASSPYj7A_by-Z2V5nIl1G2ZBnJ-JX9HLd5ATKxCAWJpwOC8YHVakc8v9Y2HC_6IOfGwfacCqHv-BIEleIPMDNi1XAxU9ZiMpwCkwqaC1F3gSd9B0n-V3q1ds_a6R0HL35Og5t7syOVqJhh2H7QwQ2-n_W3Ld2I_5rAxB-4rJVyuKELMypEUrtuACl1Mlyht1CkwsjxsPq9c-DGnW6grHuTTGrJiur0DzigBu_FpmZa728cnIgwyBn_UpFG3kriCI7P3QYTrXZsmDeH6BCgT_iv7IqYlG6FLOgLs2yiuaOj1WSY-_ilZNJrzK-KmBgvKqpHKB_UiJbrZZwrtafChLSCh1XM88GLs0gPOQccFxv5pXTdba_WaQXinDBOhp7RZbh_xS5HGDWr8FhZQdqPKvNLWUfvBIf7cnpCdxnXNm0Zu5UxH--i-UxRy1Jqo4fPTkEBGadSUsaPWwyx9nfgvU85KRWu2tNOYXLl-ehP67OEEFCpXIHTIGLAMKmk9IjrCt_1Hhtxf136MTnqfyIKM3a31h4kABlDdgDIuxhMEOPfQMU9MuXg6tGJFnLIj1pZS1-Nu9Qmkx8MOyCH8I1ls6gLNqIdD4Ma4RLY7KS2b9HOHU100MJRCOMpQgQooBMr-YRJTzF6bfnqvcur4yirIoD1d_OrKTYiCVfVmwxlE-zxvpTADJssFdw0umc27QruwRQJsWjZ9Zx0ijySdfuGm2owHPJygFAFPkZiD9Ogm6O6YYbJCvusTv_UWSA10gblLLI4qj6ndNo_HqYh7RQETTzXKjJT5sK62kUGP8oTRivQ8Co9VYJluhEd2g0Z2zCHg_djTDTL4gqsxQWjHNOoLHd7z8LksZ8_U2EsESib6T062rVx4aJRN0OqngtdaJ_Rv0l7jMIF-9AaaUmuOGT1gLKu1lm5a_aEeog7aGgxmOiKnVK2Y4v036iYkDMg0FzE24wcOjjVwcKM421p5lyVtOSEO0zXmmBPpn-gTdv1SOruWYeoPmqyZe9gHGSJR0ynoJQrsCY8RXd-XiKMMLw-jIBiZjQLGqzXxv-BMTBY_-xjVeBz3K9Sok2dYknO2dV6kgqPFdy0p9TB2pJGN1ukShkEoUQ8pcGGiaYgHVxt-xetbW1k4TJpnBJ0Uzta4bDNs_lujrXrE_33um09nX7Ud1EyfSEZ0LSVuwdwhRcC7uxy6lGEyUCUBCD26Kl0Z7iJi6eHIyCkQyqRjDTjEIy4oBK1NbUTp-xMkxe0nT_YqcIW3-gTWZ_uOkW2_VRg3EnFdRV8vABzkPnkT-HqoWUj5bnh-jYDobGjyadKZ-0Yd4eoFBr_YQsAx8YzUKXdHkX4_wwQZdIX8l4pbLtTBlb6WsKe81-I62xg8uqpBuoW3hyhvBstYk_Aj8fgfXeOOiwcj772azIz2Dhahx_MU-1GqMXzXQGhIT86KS-r2cdv3o8yXyv11wJNfJZF3RqJBKlZvXTu68fAw28pDOpszNhKY1TpPRVgYJj-4eDc98kHEzS6-ArzrQWWAUQLgvt4hwHY16Ta9NsavSd-C299kN4_X_lrKTbcyOAUAXYwS17mvfvqwRk0W0b-vljNVrMUtxWaC8zWsdUoxHO0n87THlrr1-xqvsuGHV493RDT1QRliW5MhO8WJ0peLXY07rnrF7hB2vzNmX-2NFrmReWVHTZq2DZbqsH7mzV-HP0NU_FmfelllKg0szD53_Ud6oFYz2EHzSQAC9lGWIUwU-qD34unNd5YS3Yc0c4cHP_KwxrYl08EoAmNKhvK2tTMhKjX34Ve0WLGo0ucuZDk8v3iGQLaC7GwTU1LDGDLBN7dBRvHtVA0uqpsi2NdpZKKFWL2sW0HsErYvCWlMoaFTORc68vwsGNFbYHeE2vXpqYjljL06XrrPpfU0EC496qYtkLPLiN1FXexn78TdXTjCuI7FQlLn4ewZvYLmuqVeXLmF3pEB4UJLvCW0gaGdOvTNyHACNWNS4THTWL5jel2t2Ueu4w2krgHUhSAjbrREqsleAtvCG6aP0F-_nW7Fow8B6vpO2DaNcivZSQk0LQGe3Vvvn7U7ggHmrCl51aEHS8Mqbz2pdv9GoOqOm_8rldQ1qlzt7moZ7-UI3Cf4NTETri6RMBAtjhtH4Cka_BC1isvb-P3p--q-x_3YXI_hmR8rYljUbnzvPg7Sd_wJm8_arHRU_Xhu-m_YlIZA3AsOhyWDkjGRoGiRBc9Tn2D0kDJjfIUQVVZV_FHMiD2OHNPz3Xbo_H_gd6SpIEXred4R93DQxbt1y8hYiZ2mTFiCjnPQdmezl0J9ocFQUx986XpY68NfwNMz1inA5EzQmPIou7oFaqmZUmaFsB_JcIrvU66Eqqc7BWgB0cbOeSWoQR_TnPdsdFyKQPoxYL4GMvUmyXQc15W9_Rz5FpgXzTPFvrQgVG7YdcPB8omaZKfDDHYTJ61ktzswNVY8VVa1rt3EvHBurT-xxWRHEpmuNFiPPo_16lltTcKyEYSG3WcD0JvKuVpcZYPwx7-Prb6a7cBJGq4ZHfyrNHAOsitChhF4hnNepQI2OHoQnU-GFcdXJtEBsSdqLgJa4bnX1Ry4A3b6Nq3bkubKBDxvH-3D9CAcht8zt0o6UXMoonV8N4MkStBtCGGhtSV7o6ri2vi5AR8VaiopeaHevnkNHcVy7IOxnie6lX12-NSwDSRJKWL4uKDTzwwY3KjBiYKGMZ_D6k0WGBz0i9pzg4__SDOQIOKDCuHamb-7QOxqV9hXYaefuueYsBI24JxxjNosOm95CnFzPUsTzoImRlpbtJowH-7Iyj_u0h254UntJaGIK5kSRuU-4iDonggX-ChSxfJugs3U4KYM8_rkn6e1HlqAL9iwC8fshpSQTZA83ViS7YAYQD2BSNoW9_fMCMR190dLeofyUnI3pnYTX-YvFQFvsKSFxPE156W-fIhfk6kz14QEHLdjyjDzbpZXg_z7pObVPqJnzxZWAxgS5y12pQBN7ogUWmhLfI-yBV3HpjZtxFttEORdJlbhM6A4901w&cid=CAQSPABpAlJWuZt1mkXmzQwW-74JOqvx1e9HPQcu6h5lhSGMWCX7aB-vx1nt25qxFXa7PexAmTsrx67GlE2TQhgB&dv3_ver=m202309120101&rfl=https%3A%2F%2Fgame.gnlore.com%2F&ds=l&xdt=1&iif=1&cor=10538905297369637000&adk=1726166460&idt=234&cac=0&dtd=16

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

104dc64ea270915aeb57dd15f3bec7ca8a498bb76953d044e46ac5945f9f20ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=90&adk=3130937508&adf=226233620&pi=t.aa~a.1154693969~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x90&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250%2C1200x280&nras=5&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2757&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=xuohkQVNe2&p=https%3A//game.gnlore.com&dtd=37
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12012
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/16662252171390610182/ Frame C09C 673 B
436 B 72ms
30ms Document
text/html 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2caf2d84896b40961323a923dbf272b822a3e28466acdac44e75c0fde9364cfe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 408
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 18:20:10 GMT
expires: Mon, 23 Sep 2024 18:20:10 GMT
last-modified: Fri, 01 Sep 2023 16:24:37 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7A28 0
0 150ms
70ms Fetch
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstVUTYo1XOLfwd5b2wnLRWbag19ydN9DFqzBCfleMzS__dYFzF1UNTBYCbiLiHd_yN3Jfphf_upfVTiPdzPspbET2NyVzvG5SZWAYUtcT3UIqDDrdbU2tXM45REaw90iX5O7X_T4n33UxV3Q16LZXAAmjWC2XiQkklYRsbkUYAeDYYISytUxTaB4PomeYDqZPGESORSTOs_yWEetueqXhFVhCHXqLL_0XSxguoRlSUrqVSyV0FHYE2-kNJeVHpxMqt3rTASvitnAxc3rcnBFMfVxXX6UW_Ky_S-VrdJwKscVaZNRuxU-_7DHE1AqdDhw-jxC6i1IzKNWfg9h4BHzPB7vd4-B8KJbO6rS3x6tSds23BpNKbYrpccocak9pbxMWVeTAfiWuFLX8QKHzgtjONiDhnmbyZynuM0bX4uiBqgeWb0JdAaRImUSE5D49tArlTvuEV-W1oipFeATWYx5yFylM6YErR04RYq04DRYJbTIuFxJNTyK1aqhpsMBoL1wnMcK1ftCNzZGUV_-c_fBK2ch45dkuWIfCbyEFFVxZx-54nsPkqwf7rZt2hmReRAbMFW8CI476oK-WW8EnU8VCgM-eiByToMMduuAot4gk-H3Xu8g0082f4wvlGxV1YgjWJKeo-eGUmtUdmmm6mobwZnm3vWhHe2blJKFB5eKzNJpVTeAYv0namAqKIxnd9WHDRn8GgaNHQ1OWMxw6SzsKcS3M__Rn42Tb4-D6TdnA_eIix44r9Tt1McDfzopVv6qf5TA7cTNSPfGbA50PHND_9Hf1jXwp_jf89dHTyU7XXrFrNmbZ3gor_3i1YLwhuSq7v-jlzMA4Ye-9fYQqGO8tUp2ZkUUxpy1eNHMSH_abN-bAL8fYedQHkUIUZN6L7R8M7Q6DG2ocCBCl-yhYO-jGJiRiq1ziAxQm9grLh4h-KrFck24rBPMnk1O_546kJJnu6aEFdKqGeVg8Sjmpn3ivym9NfTEy1rtN54azMIfEb871j00OHtObVogc4zHD7oZLOV3szuGuO8PkehSfokhiSu6mrxwByb66Cpl2xs9CyRp9Lh_M-8jmvDCvkUKQPytHYGRa0ETVUBiHpL5V6CdEGSNLJLZSZtkHh95nWb4lGKA4jS27iT6km6ouzgCPh40FuHB0Zza4KbeuJtnaP1ihEhI5YYKOWnMZOAjHGQ0c1t3vzS94yhY8Zk00wYUvjNRR3TO1V8SY5XAaKFSNZQTeUrNMI-oc9iQ_2kOwlrLrgl53aNv7p9qBd-EYxE6YC6lEyPhOVakScgKUhSGfWSFi3sTR9V&sai=AMfl-YRjKhYe7LvnOIy-u_b23kpX6-XQFmj4QFAGlH7Ciu_0J_coBXwVQWt2jgLE_dakXFoi0HQJG9aVlqRDGg3Mc2OsyKz0XJ4Td77tXUEqPtRGS_1yS_DawKPYrzrslVOkuaS0YmWGE4nwCBadAwsS7C6vsK7EBXsjCw7BgFW9n7z2yRRV1l0r2lBhLUggb9oL1_Q6qZ2vTeOSEovRXEW4SvfIhXKn5QPWWN2Ml93gZtotUIVjMHJYqCYaVRKHv0WuLYyY_CM&sig=Cg0ArKJSzGMbK0YVlISEEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=242&cbvp=1&cstd=231&cisv=r20230920.91228&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 24 Sep 2023 18:20:10 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sun, 24 Sep 2023 18:20:10 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 55ms
55ms Preflight
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 24 Sep 2023 18:20:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js Show response
pagead2.googlesyndication.com/bg/ Frame 984C 37 KB
14 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85de8e1049567f060665a08f4f9784af156edc484723473acd40953eb3bde550

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 07:19:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 385246
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14709
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 07:19:24 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7462 41 KB
13 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DQzyxjHjWhrvg4Dshvs6d47FmgzJVkzAjtYAEUOv0M6juiFkAkGPphB14EFMxS5HJRqUIJQ8ATSxK7VeAEbaAoxEE7elC_ksLaTI1mk6a_z-nGU1SLAKldsYe4FQEmBdTzSAv1q69XlsH63gYBcbX3fUOiA52IapKJTkemej0NAF18Djc&cry=1&dbm_d=AKAmf-DRhDopsJDIsMsewhJ2hQYLFhBiypfdtxHHG-f6RaAf6kfkYmngqgQqIBZVWTLCyKxZSfpm2PHcS3RYP4BHYs6Pf6QM84NMNpHY75C0ERBoBCXJYwTvZ_mnnmDCuX0VKHe-W1Wfhl4CGH5ETX2L9iS2u6uD547TgoJNsgSviKv6CMR7G1QjXAIQyP_lM9HrjwXcBYa-WKQAH1Flzi-AgN8HWLNq5SfMd7cEo17hoDNNhYEGZ52fF9pFTOYLQZiNTK4HDSjn5G2eu2CRop9bx6DU4nb0ow-7KUsLG4De358AiNCO-LpxSlHJxJJ4ba4dxx4zspk-Nb2vwuPOGlXm4F01d8pmC3K5YGg8m_9NhdLjGJWqHc5tb1nIzjktNq1NZDjzR6U8OSzhqUJLZmaRXQmtT-7fnm9pvxrxdpS8LpVRMuCwBDDgcK9ehejFjFF778882LIALO8DSig6zCCmzLY723lU8ORMDqryAaSGTTN5e_uUh2l3p-Ad6xHsWUQAoT_LFCINq0j8qhrm5_95ljjGpFQhsjLoZIgLQiZJeiI5Z_zvbrrXrRL8gd3bQTqRmaIRXq6QP0dVlcK6f0nxSCEOnX-wLo-LuioVxWCPu-9FU4FQQQq_4Lmtgav-rxsckFzqsbg9ij0DWpbYlJ37fQm1_ABLGAMJNhpiSIlNROZJ6-3tTcdJHmkJJltg-VN-10OYiG-whT0gZfqlV6iK1XPNFwwUASSPYj7A_by-Z2V5nIl1G2ZBnJ-JX9HLd5ATKxCAWJpwOC8YHVakc8v9Y2HC_6IOfGwfacCqHv-BIEleIPMDNi1XAxU9ZiMpwCkwqaC1F3gSd9B0n-V3q1ds_a6R0HL35Og5t7syOVqJhh2H7QwQ2-n_W3Ld2I_5rAxB-4rJVyuKELMypEUrtuACl1Mlyht1CkwsjxsPq9c-DGnW6grHuTTGrJiur0DzigBu_FpmZa728cnIgwyBn_UpFG3kriCI7P3QYTrXZsmDeH6BCgT_iv7IqYlG6FLOgLs2yiuaOj1WSY-_ilZNJrzK-KmBgvKqpHKB_UiJbrZZwrtafChLSCh1XM88GLs0gPOQccFxv5pXTdba_WaQXinDBOhp7RZbh_xS5HGDWr8FhZQdqPKvNLWUfvBIf7cnpCdxnXNm0Zu5UxH--i-UxRy1Jqo4fPTkEBGadSUsaPWwyx9nfgvU85KRWu2tNOYXLl-ehP67OEEFCpXIHTIGLAMKmk9IjrCt_1Hhtxf136MTnqfyIKM3a31h4kABlDdgDIuxhMEOPfQMU9MuXg6tGJFnLIj1pZS1-Nu9Qmkx8MOyCH8I1ls6gLNqIdD4Ma4RLY7KS2b9HOHU100MJRCOMpQgQooBMr-YRJTzF6bfnqvcur4yirIoD1d_OrKTYiCVfVmwxlE-zxvpTADJssFdw0umc27QruwRQJsWjZ9Zx0ijySdfuGm2owHPJygFAFPkZiD9Ogm6O6YYbJCvusTv_UWSA10gblLLI4qj6ndNo_HqYh7RQETTzXKjJT5sK62kUGP8oTRivQ8Co9VYJluhEd2g0Z2zCHg_djTDTL4gqsxQWjHNOoLHd7z8LksZ8_U2EsESib6T062rVx4aJRN0OqngtdaJ_Rv0l7jMIF-9AaaUmuOGT1gLKu1lm5a_aEeog7aGgxmOiKnVK2Y4v036iYkDMg0FzE24wcOjjVwcKM421p5lyVtOSEO0zXmmBPpn-gTdv1SOruWYeoPmqyZe9gHGSJR0ynoJQrsCY8RXd-XiKMMLw-jIBiZjQLGqzXxv-BMTBY_-xjVeBz3K9Sok2dYknO2dV6kgqPFdy0p9TB2pJGN1ukShkEoUQ8pcGGiaYgHVxt-xetbW1k4TJpnBJ0Uzta4bDNs_lujrXrE_33um09nX7Ud1EyfSEZ0LSVuwdwhRcC7uxy6lGEyUCUBCD26Kl0Z7iJi6eHIyCkQyqRjDTjEIy4oBK1NbUTp-xMkxe0nT_YqcIW3-gTWZ_uOkW2_VRg3EnFdRV8vABzkPnkT-HqoWUj5bnh-jYDobGjyadKZ-0Yd4eoFBr_YQsAx8YzUKXdHkX4_wwQZdIX8l4pbLtTBlb6WsKe81-I62xg8uqpBuoW3hyhvBstYk_Aj8fgfXeOOiwcj772azIz2Dhahx_MU-1GqMXzXQGhIT86KS-r2cdv3o8yXyv11wJNfJZF3RqJBKlZvXTu68fAw28pDOpszNhKY1TpPRVgYJj-4eDc98kHEzS6-ArzrQWWAUQLgvt4hwHY16Ta9NsavSd-C299kN4_X_lrKTbcyOAUAXYwS17mvfvqwRk0W0b-vljNVrMUtxWaC8zWsdUoxHO0n87THlrr1-xqvsuGHV493RDT1QRliW5MhO8WJ0peLXY07rnrF7hB2vzNmX-2NFrmReWVHTZq2DZbqsH7mzV-HP0NU_FmfelllKg0szD53_Ud6oFYz2EHzSQAC9lGWIUwU-qD34unNd5YS3Yc0c4cHP_KwxrYl08EoAmNKhvK2tTMhKjX34Ve0WLGo0ucuZDk8v3iGQLaC7GwTU1LDGDLBN7dBRvHtVA0uqpsi2NdpZKKFWL2sW0HsErYvCWlMoaFTORc68vwsGNFbYHeE2vXpqYjljL06XrrPpfU0EC496qYtkLPLiN1FXexn78TdXTjCuI7FQlLn4ewZvYLmuqVeXLmF3pEB4UJLvCW0gaGdOvTNyHACNWNS4THTWL5jel2t2Ueu4w2krgHUhSAjbrREqsleAtvCG6aP0F-_nW7Fow8B6vpO2DaNcivZSQk0LQGe3Vvvn7U7ggHmrCl51aEHS8Mqbz2pdv9GoOqOm_8rldQ1qlzt7moZ7-UI3Cf4NTETri6RMBAtjhtH4Cka_BC1isvb-P3p--q-x_3YXI_hmR8rYljUbnzvPg7Sd_wJm8_arHRU_Xhu-m_YlIZA3AsOhyWDkjGRoGiRBc9Tn2D0kDJjfIUQVVZV_FHMiD2OHNPz3Xbo_H_gd6SpIEXred4R93DQxbt1y8hYiZ2mTFiCjnPQdmezl0J9ocFQUx986XpY68NfwNMz1inA5EzQmPIou7oFaqmZUmaFsB_JcIrvU66Eqqc7BWgB0cbOeSWoQR_TnPdsdFyKQPoxYL4GMvUmyXQc15W9_Rz5FpgXzTPFvrQgVG7YdcPB8omaZKfDDHYTJ61ktzswNVY8VVa1rt3EvHBurT-xxWRHEpmuNFiPPo_16lltTcKyEYSG3WcD0JvKuVpcZYPwx7-Prb6a7cBJGq4ZHfyrNHAOsitChhF4hnNepQI2OHoQnU-GFcdXJtEBsSdqLgJa4bnX1Ry4A3b6Nq3bkubKBDxvH-3D9CAcht8zt0o6UXMoonV8N4MkStBtCGGhtSV7o6ri2vi5AR8VaiopeaHevnkNHcVy7IOxnie6lX12-NSwDSRJKWL4uKDTzwwY3KjBiYKGMZ_D6k0WGBz0i9pzg4__SDOQIOKDCuHamb-7QOxqV9hXYaefuueYsBI24JxxjNosOm95CnFzPUsTzoImRlpbtJowH-7Iyj_u0h254UntJaGIK5kSRuU-4iDonggX-ChSxfJugs3U4KYM8_rkn6e1HlqAL9iwC8fshpSQTZA83ViS7YAYQD2BSNoW9_fMCMR190dLeofyUnI3pnYTX-YvFQFvsKSFxPE156W-fIhfk6kz14QEHLdjyjDzbpZXg_z7pObVPqJnzxZWAxgS5y12pQBN7ogUWmhLfI-yBV3HpjZtxFttEORdJlbhM6A4901w&cid=CAQSPABpAlJWuZt1mkXmzQwW-74JOqvx1e9HPQcu6h5lhSGMWCX7aB-vx1nt25qxFXa7PexAmTsrx67GlE2TQhgB&dv3_ver=m202309120101&rfl=https%3A%2F%2Fgame.gnlore.com%2F&ds=l&xdt=1&iif=1&cor=10538905297369637000&adk=1726166460&idt=234&cac=0&dtd=16

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 280422
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 20 Sep 2024 12:26:28 GMT

GET
H/1.1 200
OK g72h7lz2c4az Show response
hal9000.redintelligence.net/zone/ Frame 7462 11 KB
4 KB 96ms
25ms Script
text/html 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=&gdpr_consent=&rnd=1695579609345866&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC0Kno2X0QZYqOFb6Wpt8P9Jif6ASm5b2gaYWVnKfJD_AuEAEgjOqWfmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE8wFP0EnJWJfOpv4ep8HezIQ0CwJzH6VtcrqSnpSnyhdF2AsYb9PaITOT7usWtDFeel3X7pPuZhc_2rHiIsO2s6mwyeMp56XXUgRTcVch6AE_fq_9CPbr1hQjVRHbvAMoraQkIcR2arVu2FZSCDROwoTdWdPB7raZKYaElZrBjSbO-fiylhUMUgG9yth5UGlOiq6_OtDQ-PUggVqvNAUin9yG8ax5JIP1zReFtwMROY0NkZomiSOzikN3VBEmJYUyJHzSDdRn5pHXsVXA2HXJ7ZAIvw-2-dPMeNYDcBTHjE5jb-rAQ-l08ePUVKwq7IBNJj6QqQXABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIyt62ou7DgQMVPovpBR10zAdNEAEYASAAEgI6APD_BwE%26num%3D1%26cid%3DCAQSPABpAlJWuZt1mkXmzQwW-74JOqvx1e9HPQcu6h5lhSGMWCX7aB-vx1nt25qxFXa7PexAmTsrx67GlE2TQhgB%26sig%3DAOD64_21DzGGx7JTKycj17f5_pKUcgw4-Q%26client%3Dca-pub-2612637296234729%26dbm_c%3DAKAmf-AITIO62hGhx5cP5LIuc3XXP8G6o4EvacMYcGi1Wv9RrwjHakBIkvwB3AW8t_5DYVVw0sYrk42qRWTGm7cVZ9ruJf2GyFGbyNFk0BAocy4bCm0lB2mrJSUBFiFPypnWIg8Q7bFLkja9VGl1uAep4RZKrzVP9HaN7YnKc6dhvi1JlBJCCYg%26cry%3D1%26dbm_d%3DAKAmf-D0MG9JDk8mQWArA2o6Bud93Qp6ZNCYwOGcfke6gWZgLE-sOpWARL3mkCxq1nV4yeHpPBb5FRLklofQxJlnDoM3C1P4i0ecNz_1mViNuHM793EUNDZ7PBEAyMGbb4n17EbHUCFAr81SUaoYSmXXDZ3nhzMEg4XSocSLa55QjXeV50VqZCE5S4IjE4L0bGbLL3Tg6VWcQ59qTnfJ0E_TNAXbXQGp-JpI715cAiKFqEw5CHt15bC-5cjvbyLW7qF2Ny24nyVG15rZlfscN7qwadx_VLNHV_Ikl9lI3ju_Wuqn-_3wTITUSNKb7ygp68wUpaT8jZyfn8mT6mVUB6hHMZqJEOnKUYv7PfZgPgPvg6ZhyDbEKEBS3ZmJ-y2cvBqq7CqNBSwJo7Qxd7QxTLKZxCP49LfpemIKCCF0MnuZ9W4L8uMjOlcJ3MRLLl1zUmXo4XNYTKG-ftxNs4dl1SPVWo3VWSKqEyGnEVmjlXa-S1_jPdlCTVk11M1vZz1QRRkBJqzGBUrtZAb8fiL14qrhU0Uwj7gDBw%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=90&adk=3130937508&adf=226233620&pi=t.aa~a.1154693969~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x90&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250%2C1200x280&nras=5&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2757&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=xuohkQVNe2&p=https%3A//game.gnlore.com&dtd=37
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: 0ccc340d0d04e25a27c698928dbe2aaa20e477b4e39b5008691079ba5d2bf29e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:10 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4168
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame C09C 120 KB
41 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 08:25:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35707
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 25 Sep 2023 08:25:03 GMT

GET
H3 200 template-489be870.js Show response
s0.2mdn.net/sadbundle/16662252171390610182/ Frame C09C 40 KB
14 KB 31ms
30ms Script
application/x-javascript 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16662252171390610182/template-489be870.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfcce6fbc676bcdc4c9f2e2cbdd40cee40a4b9066f829f4e9e400cbe142183f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 16:25:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179710
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14187
x-xss-protection: 0
last-modified: Fri, 01 Sep 2023 16:24:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 21 Sep 2024 16:25:00 GMT

GET
H3 200 index-be1f7599.css
s0.2mdn.net/sadbundle/16662252171390610182/ Frame C09C 4 KB
1 KB 23ms
23ms Stylesheet
text/css 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16662252171390610182/index-be1f7599.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be1f75994e53be710e621d9552d7cc796a347e85622acc435325d94e076b6996

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 16:25:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179710
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1385
x-xss-protection: 0
last-modified: Fri, 01 Sep 2023 16:24:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 21 Sep 2024 16:25:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4C21 22 KB
8 KB 20ms
20ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 280422
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 21 Sep 2023 12:26:28 GMT
expires: Fri, 20 Sep 2024 12:26:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7A28 0
0 60ms
59ms Fetch
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstVUTYo1XOLfwd5b2wnLRWbag19ydN9DFqzBCfleMzS__dYFzF1UNTBYCbiLiHd_yN3Jfphf_upfVTiPdzPspbET2NyVzvG5SZWAYUtcT3UIqDDrdbU2tXM45REaw90iX5O7X_T4n33UxV3Q16LZXAAmjWC2XiQkklYRsbkUYAeDYYISytUxTaB4PomeYDqZPGESORSTOs_yWEetueqXhFVhCHXqLL_0XSxguoRlSUrqVSyV0FHYE2-kNJeVHpxMqt3rTASvitnAxc3rcnBFMfVxXX6UW_Ky_S-VrdJwKscVaZNRuxU-_7DHE1AqdDhw-jxC6i1IzKNWfg9h4BHzPB7vd4-B8KJbO6rS3x6tSds23BpNKbYrpccocak9pbxMWVeTAfiWuFLX8QKHzgtjONiDhnmbyZynuM0bX4uiBqgeWb0JdAaRImUSE5D49tArlTvuEV-W1oipFeATWYx5yFylM6YErR04RYq04DRYJbTIuFxJNTyK1aqhpsMBoL1wnMcK1ftCNzZGUV_-c_fBK2ch45dkuWIfCbyEFFVxZx-54nsPkqwf7rZt2hmReRAbMFW8CI476oK-WW8EnU8VCgM-eiByToMMduuAot4gk-H3Xu8g0082f4wvlGxV1YgjWJKeo-eGUmtUdmmm6mobwZnm3vWhHe2blJKFB5eKzNJpVTeAYv0namAqKIxnd9WHDRn8GgaNHQ1OWMxw6SzsKcS3M__Rn42Tb4-D6TdnA_eIix44r9Tt1McDfzopVv6qf5TA7cTNSPfGbA50PHND_9Hf1jXwp_jf89dHTyU7XXrFrNmbZ3gor_3i1YLwhuSq7v-jlzMA4Ye-9fYQqGO8tUp2ZkUUxpy1eNHMSH_abN-bAL8fYedQHkUIUZN6L7R8M7Q6DG2ocCBCl-yhYO-jGJiRiq1ziAxQm9grLh4h-KrFck24rBPMnk1O_546kJJnu6aEFdKqGeVg8Sjmpn3ivym9NfTEy1rtN54azMIfEb871j00OHtObVogc4zHD7oZLOV3szuGuO8PkehSfokhiSu6mrxwByb66Cpl2xs9CyRp9Lh_M-8jmvDCvkUKQPytHYGRa0ETVUBiHpL5V6CdEGSNLJLZSZtkHh95nWb4lGKA4jS27iT6km6ouzgCPh40FuHB0Zza4KbeuJtnaP1ihEhI5YYKOWnMZOAjHGQ0c1t3vzS94yhY8Zk00wYUvjNRR3TO1V8SY5XAaKFSNZQTeUrNMI-oc9iQ_2kOwlrLrgl53aNv7p9qBd-EYxE6YC6lEyPhOVakScgKUhSGfWSFi3sTR9V&sai=AMfl-YRjKhYe7LvnOIy-u_b23kpX6-XQFmj4QFAGlH7Ciu_0J_coBXwVQWt2jgLE_dakXFoi0HQJG9aVlqRDGg3Mc2OsyKz0XJ4Td77tXUEqPtRGS_1yS_DawKPYrzrslVOkuaS0YmWGE4nwCBadAwsS7C6vsK7EBXsjCw7BgFW9n7z2yRRV1l0r2lBhLUggb9oL1_Q6qZ2vTeOSEovRXEW4SvfIhXKn5QPWWN2Ml93gZtotUIVjMHJYqCYaVRKHv0WuLYyY_CM&sig=Cg0ArKJSzGMbK0YVlISEEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=375&vt=11&dtpt=133&dett=3&cstd=231&cisv=r20230920.91228&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 24 Sep 2023 18:20:10 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame BFA4 42 B
64 B 166ms
126ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssTUtb8fWzRdKq4AZwyPxsYDRJp83-o-NVPkenld2-l-HOkygBbfPkkJUEulw2-YZ8LUG7FyZbPq90_t5Mz0Z7modzSpxrbRlXDJicznaV6xDRMm1J1GUOj-Wq4FoZXL2BQTOZLtQN-NK8d&sai=AMfl-YT2p6mYqS_WmQrz_T27gRsQlvDCOM7XyAKl38gqNF3usthaUPqRNhCIqfx8MfNrdEI0Akgi3FcPrXK2&sig=Cg0ArKJSzMLDIa9yw2cSEAE&cid=CAQSGwBpAlJWtJbrDxJqzR0uttsbWFUy_LjtET62xBgB&id=lidar2&mcvt=1005&p=0,0,280,1200&mtos=1005,1005,1005,1005,1005&tos=1005,0,0,0,0&v=20230920&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=935936864&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1695579608426&rpt=932&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js Show response
pagead2.googlesyndication.com/bg/ Frame 4C21 37 KB
14 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85de8e1049567f060665a08f4f9784af156edc484723473acd40953eb3bde550

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 07:19:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 385246
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14709
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 07:19:24 GMT

GET
H/1.1

200
OK

request.php Show response
hal900011.redintelligence.net/ Frame 7462
Redirect Chain

https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=90c7d166c3&subid=&uid=1e8925cde4ef2cf5&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=90c7d166c3&subid=&uid=1e8925cde4ef2cf5&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

182ms
130ms

Script
application/x-javascript

138.201.64.38
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=90c7d166c3&subid=&uid=1e8925cde4ef2cf5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC0Kno2X0QZYqOFb6Wpt8P9Jif6ASm5b2gaYWVnKfJD_AuEAEgjOqWfmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE8wFP0EnJWJfOpv4ep8HezIQ0CwJzH6VtcrqSnpSnyhdF2AsYb9PaITOT7usWtDFeel3X7pPuZhc_2rHiIsO2s6mwyeMp56XXUgRTcVch6AE_fq_9CPbr1hQjVRHbvAMoraQkIcR2arVu2FZSCDROwoTdWdPB7raZKYaElZrBjSbO-fiylhUMUgG9yth5UGlOiq6_OtDQ-PUggVqvNAUin9yG8ax5JIP1zReFtwMROY0NkZomiSOzikN3VBEmJYUyJHzSDdRn5pHXsVXA2HXJ7ZAIvw-2-dPMeNYDcBTHjE5jb-rAQ-l08ePUVKwq7IBNJj6QqQXABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIyt62ou7DgQMVPovpBR10zAdNEAEYASAAEgI6APD_BwE%26num%3D1%26cid%3DCAQSPABpAlJWuZt1mkXmzQwW-74JOqvx1e9HPQcu6h5lhSGMWCX7aB-vx1nt25qxFXa7PexAmTsrx67GlE2TQhgB%26sig%3DAOD64_21DzGGx7JTKycj17f5_pKUcgw4-Q%26client%3Dca-pub-2612637296234729%26dbm_c%3DAKAmf-AITIO62hGhx5cP5LIuc3XXP8G6o4EvacMYcGi1Wv9RrwjHakBIkvwB3AW8t_5DYVVw0sYrk42qRWTGm7cVZ9ruJf2GyFGbyNFk0BAocy4bCm0lB2mrJSUBFiFPypnWIg8Q7bFLkja9VGl1uAep4RZKrzVP9HaN7YnKc6dhvi1JlBJCCYg%26cry%3D1%26dbm_d%3DAKAmf-D0MG9JDk8mQWArA2o6Bud93Qp6ZNCYwOGcfke6gWZgLE-sOpWARL3mkCxq1nV4yeHpPBb5FRLklofQxJlnDoM3C1P4i0ecNz_1mViNuHM793EUNDZ7PBEAyMGbb4n17EbHUCFAr81SUaoYSmXXDZ3nhzMEg4XSocSLa55QjXeV50VqZCE5S4IjE4L0bGbLL3Tg6VWcQ59qTnfJ0E_TNAXbXQGp-JpI715cAiKFqEw5CHt15bC-5cjvbyLW7qF2Ny24nyVG15rZlfscN7qwadx_VLNHV_Ikl9lI3ju_Wuqn-_3wTITUSNKb7ygp68wUpaT8jZyfn8mT6mVUB6hHMZqJEOnKUYv7PfZgPgPvg6ZhyDbEKEBS3ZmJ-y2cvBqq7CqNBSwJo7Qxd7QxTLKZxCP49LfpemIKCCF0MnuZ9W4L8uMjOlcJ3MRLLl1zUmXo4XNYTKG-ftxNs4dl1SPVWo3VWSKqEyGnEVmjlXa-S1_jPdlCTVk11M1vZz1QRRkBJqzGBUrtZAb8fiL14qrhU0Uwj7gDBw%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2612637296234729%26output%3Dhtml%26h%3D90%26adk%3D3130937508%26adf%3D226233620%26pi%3Dt.aa~a.1154693969~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695572409%26rafmt%3D1%26to%3Dqs%26pwprc%3D6114872683%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fgame.gnlore.com%252Fvictoria-3-product%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1695579609146%26bpp%3D1%26bdt%3D2101%26idt%3D0%26shv%3Dr20230920%26mjsv%3Dm202309140101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Dc39bed6084529430-22d9689489de00fe%253AT%253D1695579608%253ART%253D1695579608%253AS%253DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ%26gpic%3DUID%253D00000c834195fde1%253AT%253D1695579608%253ART%253D1695579608%253AS%253DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug%26prev_fmts%3D0x0%252C1200x280%252C333x250%252C1200x280%26nras%3D5%26correlator%3D5085991068093%26frm%3D20%26pv%3D1%26ga_vid%3D1909208556.1695579608%26ga_sid%3D1695579608%26ga_hid%3D37659207%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D2757%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759927%252C44759842%252C44759876%252C42531705%26oid%3D2%26psts%3DAOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt%26pvsid%3D4005920162221254%26tmod%3D655216534%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D5%26uci%3Da!5%26btvi%3D3%26fsb%3D1%26xpc%3DxuohkQVNe2%26p%3Dhttps%253A%2F%2Fgame.gnlore.com%26dtd%3D37&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fgame.gnlore.com&random=3165122228800&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=90&adk=3130937508&adf=226233620&pi=t.aa~a.1154693969~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x90&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250%2C1200x280&nras=5&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2757&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=xuohkQVNe2&p=https%3A//game.gnlore.com&dtd=37
Protocol: HTTP/1.1
Server: 138.201.64.38 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 0c5c7d8e33e5e0febfc017be61a23ebe1e77c7994c27974bf1cebd50b22a6c68

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 18:20:10 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 93569300126359104444550012457011
Connection: close
Content-Length: 1328
Expires: Sun, 24 Sep 2023 19:20:10 +0200

Redirect headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 18:20:10 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=90c7d166c3&subid=&uid=1e8925cde4ef2cf5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC0Kno2X0QZYqOFb6Wpt8P9Jif6ASm5b2gaYWVnKfJD_AuEAEgjOqWfmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE8wFP0EnJWJfOpv4ep8HezIQ0CwJzH6VtcrqSnpSnyhdF2AsYb9PaITOT7usWtDFeel3X7pPuZhc_2rHiIsO2s6mwyeMp56XXUgRTcVch6AE_fq_9CPbr1hQjVRHbvAMoraQkIcR2arVu2FZSCDROwoTdWdPB7raZKYaElZrBjSbO-fiylhUMUgG9yth5UGlOiq6_OtDQ-PUggVqvNAUin9yG8ax5JIP1zReFtwMROY0NkZomiSOzikN3VBEmJYUyJHzSDdRn5pHXsVXA2HXJ7ZAIvw-2-dPMeNYDcBTHjE5jb-rAQ-l08ePUVKwq7IBNJj6QqQXABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIyt62ou7DgQMVPovpBR10zAdNEAEYASAAEgI6APD_BwE%26num%3D1%26cid%3DCAQSPABpAlJWuZt1mkXmzQwW-74JOqvx1e9HPQcu6h5lhSGMWCX7aB-vx1nt25qxFXa7PexAmTsrx67GlE2TQhgB%26sig%3DAOD64_21DzGGx7JTKycj17f5_pKUcgw4-Q%26client%3Dca-pub-2612637296234729%26dbm_c%3DAKAmf-AITIO62hGhx5cP5LIuc3XXP8G6o4EvacMYcGi1Wv9RrwjHakBIkvwB3AW8t_5DYVVw0sYrk42qRWTGm7cVZ9ruJf2GyFGbyNFk0BAocy4bCm0lB2mrJSUBFiFPypnWIg8Q7bFLkja9VGl1uAep4RZKrzVP9HaN7YnKc6dhvi1JlBJCCYg%26cry%3D1%26dbm_d%3DAKAmf-D0MG9JDk8mQWArA2o6Bud93Qp6ZNCYwOGcfke6gWZgLE-sOpWARL3mkCxq1nV4yeHpPBb5FRLklofQxJlnDoM3C1P4i0ecNz_1mViNuHM793EUNDZ7PBEAyMGbb4n17EbHUCFAr81SUaoYSmXXDZ3nhzMEg4XSocSLa55QjXeV50VqZCE5S4IjE4L0bGbLL3Tg6VWcQ59qTnfJ0E_TNAXbXQGp-JpI715cAiKFqEw5CHt15bC-5cjvbyLW7qF2Ny24nyVG15rZlfscN7qwadx_VLNHV_Ikl9lI3ju_Wuqn-_3wTITUSNKb7ygp68wUpaT8jZyfn8mT6mVUB6hHMZqJEOnKUYv7PfZgPgPvg6ZhyDbEKEBS3ZmJ-y2cvBqq7CqNBSwJo7Qxd7QxTLKZxCP49LfpemIKCCF0MnuZ9W4L8uMjOlcJ3MRLLl1zUmXo4XNYTKG-ftxNs4dl1SPVWo3VWSKqEyGnEVmjlXa-S1_jPdlCTVk11M1vZz1QRRkBJqzGBUrtZAb8fiL14qrhU0Uwj7gDBw%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2612637296234729%26output%3Dhtml%26h%3D90%26adk%3D3130937508%26adf%3D226233620%26pi%3Dt.aa~a.1154693969~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695572409%26rafmt%3D1%26to%3Dqs%26pwprc%3D6114872683%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fgame.gnlore.com%252Fvictoria-3-product%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1695579609146%26bpp%3D1%26bdt%3D2101%26idt%3D0%26shv%3Dr20230920%26mjsv%3Dm202309140101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Dc39bed6084529430-22d9689489de00fe%253AT%253D1695579608%253ART%253D1695579608%253AS%253DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ%26gpic%3DUID%253D00000c834195fde1%253AT%253D1695579608%253ART%253D1695579608%253AS%253DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug%26prev_fmts%3D0x0%252C1200x280%252C333x250%252C1200x280%26nras%3D5%26correlator%3D5085991068093%26frm%3D20%26pv%3D1%26ga_vid%3D1909208556.1695579608%26ga_sid%3D1695579608%26ga_hid%3D37659207%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D2757%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759927%252C44759842%252C44759876%252C42531705%26oid%3D2%26psts%3DAOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt%26pvsid%3D4005920162221254%26tmod%3D655216534%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D5%26uci%3Da!5%26btvi%3D3%26fsb%3D1%26xpc%3DxuohkQVNe2%26p%3Dhttps%253A%2F%2Fgame.gnlore.com%26dtd%3D37&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fgame.gnlore.com&random=3165122228800&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Sun, 24 Sep 2023 19:20:10 +0200

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 984C 0
20 B 126ms
125ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BmFnm2X0QZcfjN9G5x_APg7eZEAAAAAA4AeAEAg&bg=!oqGloe7NAAbbC4-Z-ws7ADQBe5WfOIE90uYpG3ipW1zYntmV3j7z4P96_6oPf9PAOTwW_QiPGGVsUdAXU5S9gzGbv4uAAgAAAGVSAAAABWgBB5kDGQWv4_SSVEK9aVUgO4iLG7xTBUP8ULMluNdnZ54bxe36GcJlpvJM3qhXd75gbHQFuhmLUIKxDwFs6pbYQa4ormi5I3F7Y-rof1_QAE1Hq3prZg5pc-3-7qL5rTx1YABlJASPU8WECNFgjym8JeOwRN5bLFvdkAQAcKeAijKH8sw9ScTIMwtiRJURgp7RR3nqfjRiCvZZ6dB2KA-kITIuwZlu11xGDkl6LOoRpmFaJtxlmFb7hyO3czhYnfumX9HLis4hNndH83VL-y0jWBO_d3YLhs84PZjWJQdU3ZSLaIxQRUTfgqSOfjhK8HXRu3pHpN6ZYd8pSEB8ttImk5l1Ib7orAn9r1wAsYs5ftqN-lgWykXxb_YjU-PZ2hZ-PcOUBRcHBTFElAMv9SPAfDOTseYrvs13u8InQeu9lD5iG98kKEpH4QhA5joqErDkPnjqGg2nuUCtYUo521T2rbyDakc5Nxw-WLi7thuml6Z3CPz1QCXm9RTgJCeFwGW1JyI3UtGoYARwIQIQN0xbVxnOsxwHlQ-9wrX6yTFNuBzrS0ZbJdm5yVHPEt2NW39kMcfZritQO5eq0rE8co_JttO94Af2aF5w7dp_ctz4D3VJp0Td7uNfxUgOsC0nQZd0-mBM6mFH_Wxx3T1roOwaW1SPiWxw5aht6ggLC0Xp3PvdOIamgv978AgJ8iVCesI3COJ-0h42xTcWa62eE5b9wVob3BX45VwuEyYFCvkXGQEmUzAcsOcd3uCDhV5pun-40oA0Ls0mUgySyJJMdLn7lIpZqgw_a8O0fUmGekYEzJTBIij7YWKcCYSsw5Z-nhOkOtPAI9ybXxn63cza2bhfBFKuKOQJAtz69T4iHFYr4j9N1vq0fXUF-FYO8YPLruqQQaDWw2L7c62vcBiMWbeowz91tN_VwFJu_tnPLdNU5mPG7z-YpSVmO0PzjBH28lkOhQnB3v4tYJrEc06yUJj_wDUWdE5sKHzsI3y6K6j-fJ8gqcr1DUcjyLKszUNN9mrExyyI3cEbSwEjyxDzGHJoTu6xHFHz2gjn53fs-j0

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame C09C 7 KB
6 KB 63ms
62ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

76db4cd0f4ed0cab40ce55838d9e88c6129a5ce1290b802afaba51a0949f0209

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5663
x-xss-protection: 0

GET
H3 200 kacheln-homespot-100-1.png
s0.2mdn.net/4528404/ Frame C09C 26 KB
27 KB 22ms
21ms Image
image/png 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/kacheln-homespot-100-1.png

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f24047e809a4cbe19f718fbaeee8a99ef93bedc5dec8fdf00488cd6fa196e71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:49:39 GMT
x-content-type-options: nosniff
age: 19831
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27134
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 22:30:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 25 Sep 2023 12:49:39 GMT

GET
H3 200 Fikayo_Motiv_5_mit_Controller_RGB-1.png
s0.2mdn.net/4528404/ Frame C09C 4 MB
4 MB 26ms
25ms Image
image/png 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/Fikayo_Motiv_5_mit_Controller_RGB-1.png

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0293af2477f26ae7516ff91ec1bb72c73dbab540baa2445310ae2f1fbe255c23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 04:31:03 GMT
x-content-type-options: nosniff
age: 49747
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4158780
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 22:30:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 25 Sep 2023 04:31:03 GMT

GET
H3 200 logo.svg
s0.2mdn.net/4528404/1687521602712/ Frame C09C 5 KB
2 KB 25ms
24ms Image
image/svg+xml 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687521602712/logo.svg

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d80991c6e4b62d5c77985c1e293aad44cc120e03aee7ae6936c79d25a0e467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 07:11:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40117
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1913
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 12:00:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 25 Sep 2023 07:11:33 GMT

GET
H3 200 cta_mit-pfeil_01.svg
s0.2mdn.net/4528404/1687937402098/ Frame C09C 2 KB
1 KB 24ms
23ms Image
image/svg+xml 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687937402098/cta_mit-pfeil_01.svg

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a9cba16c5a30dc7cc3bdcbba2a45e9e2e28ec4437894302c6676369ed0ec732

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 15:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11979
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1134
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 07:30:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 25 Sep 2023 15:00:31 GMT

GET
H3 200 stoerer-jetz-25-gb-extra-01.svg
s0.2mdn.net/4528404/1691101802634/ Frame C09C 3 KB
1 KB 23ms
22ms Image
image/svg+xml 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1691101802634/stoerer-jetz-25-gb-extra-01.svg

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6ba2d25deda5219cb6c8230393264ab7b102473c2ffc5fd4c947c427b12af643

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:49:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19824
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1497
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 22:30:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 25 Sep 2023 12:49:46 GMT

GET
H3 200 logo-d0d80991.svg
s0.2mdn.net/sadbundle/16662252171390610182/ Frame C09C 5 KB
2 KB 25ms
24ms Image
image/svg+xml 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16662252171390610182/logo-d0d80991.svg

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d80991c6e4b62d5c77985c1e293aad44cc120e03aee7ae6936c79d25a0e467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 16:25:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179710
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1913
x-xss-protection: 0
last-modified: Fri, 01 Sep 2023 16:24:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 21 Sep 2024 16:25:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame C09C 17 KB
6 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 24 Sep 2023 18:20:10 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4C21 0
20 B 127ms
127ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B52kM2n0QZe_bDMqS1PIPxcGp6AwAAAAAOAHgBAI&bg=!tbaltvnNAAbbC4-Z-ws7ADQBe5WfOAM20DYTHRy0dLmGIeDzqpTrnfYy1LiOl0a7_wMW6xQk04E4OGbjA5YK5wqBVKiHAgAAAFhSAAAABmgBB5kDBYdBaqMkBr-1mBA7pt3qd3Hz2V85tSgtWFCAAZ6EZ4cNLfpjdX4oHxPcmTE7CRTUl26GOglXco5UqQukbGNu3VYmYvMq7-fOw9qImk-lXE9HPxkb70tjZNEEh4ufJr1aXd_fLjO26RbVL5VppsKjb9Ry5M6vRiGsXj13RlrMxEvHvx4BPSKuatynKQM0XgM2eYNt-uOwCH43ST41w7KYOCWF1VXWjLbd8AtL0ySF9UpSG7z8a2p_HVtJWhuvdSQxyDWWObqskW2vMbSNH1jcZmXPcA2vZQxmhuk6rpaGDNIeAmSDuKgLDGY1xzY040xmINrE-OWnTtv4uiWXrJoI0EoycYXy1pkSWArjRrJvSNetJc4FVeDQEMjue9JsJUvZThXjZHa3WxrXlAeBfYhX97d7q3dBt5HYMan0BmykRFAzw97P2lNfLKAqfG8mxZgpUhukJBkIieP7C7p2bcJ1GaBzE5EQfssxEim0BA86vxG41Zs0aE3vmxuHPESrah3ZE2eXk3kZmRC9LXYktOulMUAsqeGfnxfMFuZs67rTNcec0L4iiDLxwL9TcbFY3Zs-GpLO0UnlM47bAgTTesM3uoRudL9vjTF4MCPr90eD_rSF0wxSA9EqEukH33eKEG3qwATEi2gVWpCi-Xtn4fgvWHpjavJzJXTg2hoRMVld5GVaRv264oQcnnJ18dNn9ckxAhZLzVWaGlAvFcpS6UF8sV7kWGD6HRZ6QCtQHR4hF0a8qENEHmKQakUinVBnNwR4NwJI87-A1aRQdiMXUOcKH-iyexlSM1pEsQr4RJiL8XvR47TDgBiL848ODngvsxkB98GbvXwM-gFZsbOr7ryi8dqC34hbRwN5oVFf-S4NaLRr8J-PLBjLH2WZD6kqHN7niR2YX2GMU4XupX1DM9ybBCq9i0A2EeK1AXgYmf_D0Xdcns2D_QQEuoPTsHp_X2aSlSwoilMWkvlAZffWoqEafmp9PwVp4zWSlaGr-BVSONXekZX2GvAq2mb_TSoRTRb5ArBzXIjV

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 tGcDLxZnxcZjneq6ZTfMhLSKmVRaNAcBIKHxIKG0fIc.js Show response
pagead2.googlesyndication.com/bg/ Frame 1174 37 KB
14 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/tGcDLxZnxcZjneq6ZTfMhLSKmVRaNAcBIKHxIKG0fIc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b467032f1667c5c6639deaba6537cc84b48a99545a34070120a1f120a1b47c87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:32:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6477
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14772
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 23 Sep 2024 16:32:13 GMT

GET
H3 200 InterstateRegular-Bold.woff2
s0.2mdn.net/creatives/assets/4925812/ Frame C09C 29 KB
29 KB 21ms
21ms Font
font/woff2 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4925812/InterstateRegular-Bold.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16662252171390610182/index-be1f7599.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d52c7c5050b088109075328a9e830e4bfdf6446c763b9e69c637d5c0e11d599

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/16662252171390610182/index-be1f7599.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:13:48 GMT
x-content-type-options: nosniff
age: 382
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29232
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 09:13:13 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 24 Sep 2023 18:28:48 GMT

GET
H3 200 InterstateCondensedBlack.woff2
s0.2mdn.net/creatives/assets/4925812/ Frame C09C 14 KB
14 KB 20ms
19ms Font
font/woff2 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4925812/InterstateCondensedBlack.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16662252171390610182/index-be1f7599.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3b7bf416424abed17314649bb71a1de7a3afc6af66840d04b730e69652e27ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/16662252171390610182/index-be1f7599.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:15:56 GMT
x-content-type-options: nosniff
age: 254
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14644
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 09:13:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 24 Sep 2023 18:30:56 GMT

GET
H3 200 InterstateCondensed.woff2
s0.2mdn.net/creatives/assets/4925812/ Frame C09C 28 KB
28 KB 20ms
20ms Font
font/woff2 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4925812/InterstateCondensed.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16662252171390610182/index-be1f7599.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

241bb801b29748e542884f7b902c02f12f6a318ba97f70224986634926dbc433

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/16662252171390610182/index-be1f7599.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:09:01 GMT
x-content-type-options: nosniff
age: 669
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28596
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 09:13:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 24 Sep 2023 18:24:01 GMT

GET
H3 200 kacheln-homespot-100-1.png
s0.2mdn.net/4528404/ Frame C09C 26 KB
27 KB 20ms
19ms Image
image/png 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/kacheln-homespot-100-1.png

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f24047e809a4cbe19f718fbaeee8a99ef93bedc5dec8fdf00488cd6fa196e71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:49:39 GMT
x-content-type-options: nosniff
age: 19831
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27134
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 22:30:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 25 Sep 2023 12:49:39 GMT

GET
H3 200 Fikayo_Motiv_5_mit_Controller_RGB-1.png
s0.2mdn.net/4528404/ Frame C09C 4 MB
4 MB 21ms
20ms Image
image/png 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/Fikayo_Motiv_5_mit_Controller_RGB-1.png

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0293af2477f26ae7516ff91ec1bb72c73dbab540baa2445310ae2f1fbe255c23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16662252171390610182/index.html?e=69&leftOffset=0&topOffset=0&c=mjgmNPMlji&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 04:31:03 GMT
x-content-type-options: nosniff
age: 49747
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4158780
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 22:30:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 25 Sep 2023 04:31:03 GMT

GET
H2 200 dc_oe=ChMIh7TZou7DgQMV0dwRCB2DWwYCEAAYACD2we5cQhMIrsetou7DgQMVlts7Ah2r0A_C;stragg=1;&timestamp=1695579610695;str=nextSlide;strtype=1
ade.googlesyndication.com/ddm/activity/ Frame 7A28 42 B
401 B 140ms
58ms Image
image/gif 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIh7TZou7DgQMV0dwRCB2DWwYCEAAYACD2we5cQhMIrsetou7DgQMVlts7Ah2r0A_C;stragg=1;&timestamp=1695579610695;str=nextSlide;strtype=1

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMIh7TZou7DgQMV0dwRCB2DWwYCEAAYACD2we5cQhMIrsetou7DgQMVlts7Ah2r0A_C;stragg=1;&timestamp=1695579610696;str=nextSlide;strtype=1
ade.googlesyndication.com/ddm/activity/ Frame 7A28 42 B
107 B 139ms
59ms Image
image/gif 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIh7TZou7DgQMV0dwRCB2DWwYCEAAYACD2we5cQhMIrsetou7DgQMVlts7Ah2r0A_C;stragg=1;&timestamp=1695579610696;str=nextSlide;strtype=1

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK e99aace94e6e5873881d3400993e1e7e Show response
pv.medialead.de/trck/epv/ Frame 12A2 0
467 B 745ms
634ms Document
application/javascript 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=93569300126359104444550012457011&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=90c7d166c3&subid=&uid=1e8925cde4ef2cf5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC0Kno2X0QZYqOFb6Wpt8P9Jif6ASm5b2gaYWVnKfJD_AuEAEgjOqWfmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE8wFP0EnJWJfOpv4ep8HezIQ0CwJzH6VtcrqSnpSnyhdF2AsYb9PaITOT7usWtDFeel3X7pPuZhc_2rHiIsO2s6mwyeMp56XXUgRTcVch6AE_fq_9CPbr1hQjVRHbvAMoraQkIcR2arVu2FZSCDROwoTdWdPB7raZKYaElZrBjSbO-fiylhUMUgG9yth5UGlOiq6_OtDQ-PUggVqvNAUin9yG8ax5JIP1zReFtwMROY0NkZomiSOzikN3VBEmJYUyJHzSDdRn5pHXsVXA2HXJ7ZAIvw-2-dPMeNYDcBTHjE5jb-rAQ-l08ePUVKwq7IBNJj6QqQXABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIyt62ou7DgQMVPovpBR10zAdNEAEYASAAEgI6APD_BwE%26num%3D1%26cid%3DCAQSPABpAlJWuZt1mkXmzQwW-74JOqvx1e9HPQcu6h5lhSGMWCX7aB-vx1nt25qxFXa7PexAmTsrx67GlE2TQhgB%26sig%3DAOD64_21DzGGx7JTKycj17f5_pKUcgw4-Q%26client%3Dca-pub-2612637296234729%26dbm_c%3DAKAmf-AITIO62hGhx5cP5LIuc3XXP8G6o4EvacMYcGi1Wv9RrwjHakBIkvwB3AW8t_5DYVVw0sYrk42qRWTGm7cVZ9ruJf2GyFGbyNFk0BAocy4bCm0lB2mrJSUBFiFPypnWIg8Q7bFLkja9VGl1uAep4RZKrzVP9HaN7YnKc6dhvi1JlBJCCYg%26cry%3D1%26dbm_d%3DAKAmf-D0MG9JDk8mQWArA2o6Bud93Qp6ZNCYwOGcfke6gWZgLE-sOpWARL3mkCxq1nV4yeHpPBb5FRLklofQxJlnDoM3C1P4i0ecNz_1mViNuHM793EUNDZ7PBEAyMGbb4n17EbHUCFAr81SUaoYSmXXDZ3nhzMEg4XSocSLa55QjXeV50VqZCE5S4IjE4L0bGbLL3Tg6VWcQ59qTnfJ0E_TNAXbXQGp-JpI715cAiKFqEw5CHt15bC-5cjvbyLW7qF2Ny24nyVG15rZlfscN7qwadx_VLNHV_Ikl9lI3ju_Wuqn-_3wTITUSNKb7ygp68wUpaT8jZyfn8mT6mVUB6hHMZqJEOnKUYv7PfZgPgPvg6ZhyDbEKEBS3ZmJ-y2cvBqq7CqNBSwJo7Qxd7QxTLKZxCP49LfpemIKCCF0MnuZ9W4L8uMjOlcJ3MRLLl1zUmXo4XNYTKG-ftxNs4dl1SPVWo3VWSKqEyGnEVmjlXa-S1_jPdlCTVk11M1vZz1QRRkBJqzGBUrtZAb8fiL14qrhU0Uwj7gDBw%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2612637296234729%26output%3Dhtml%26h%3D90%26adk%3D3130937508%26adf%3D226233620%26pi%3Dt.aa~a.1154693969~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695572409%26rafmt%3D1%26to%3Dqs%26pwprc%3D6114872683%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fgame.gnlore.com%252Fvictoria-3-product%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1695579609146%26bpp%3D1%26bdt%3D2101%26idt%3D0%26shv%3Dr20230920%26mjsv%3Dm202309140101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Dc39bed6084529430-22d9689489de00fe%253AT%253D1695579608%253ART%253D1695579608%253AS%253DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ%26gpic%3DUID%253D00000c834195fde1%253AT%253D1695579608%253ART%253D1695579608%253AS%253DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug%26prev_fmts%3D0x0%252C1200x280%252C333x250%252C1200x280%26nras%3D5%26correlator%3D5085991068093%26frm%3D20%26pv%3D1%26ga_vid%3D1909208556.1695579608%26ga_sid%3D1695579608%26ga_hid%3D37659207%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D2757%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759927%252C44759842%252C44759876%252C42531705%26oid%3D2%26psts%3DAOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt%26pvsid%3D4005920162221254%26tmod%3D655216534%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D5%26uci%3Da!5%26btvi%3D3%26fsb%3D1%26xpc%3DxuohkQVNe2%26p%3Dhttps%253A%2F%2Fgame.gnlore.com%26dtd%3D37&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fgame.gnlore.com&random=3165122228800&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Content-Length: 0
Content-Type: application/javascript; charset=utf-8
Date: Sun, 24 Sep 2023 18:20:11 GMT
Host: pv.medialead.de
Proxy-Host: pv.medialead.de
Server: nginx
Strict-Transport-Security: max-age=15768000
Vary: Origin
X-IPLB-Instance: 40027
X-IPLB-Request-ID: D972D785:DD32_91EFC182:01BB_65107DDA_181BA48B:22024

GET
H2 200 / Show response
adv.office-partner.de/ Frame BB2A 930 B
931 B 117ms
29ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=90c7d166c3&subid=&uid=1e8925cde4ef2cf5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC0Kno2X0QZYqOFb6Wpt8P9Jif6ASm5b2gaYWVnKfJD_AuEAEgjOqWfmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE8wFP0EnJWJfOpv4ep8HezIQ0CwJzH6VtcrqSnpSnyhdF2AsYb9PaITOT7usWtDFeel3X7pPuZhc_2rHiIsO2s6mwyeMp56XXUgRTcVch6AE_fq_9CPbr1hQjVRHbvAMoraQkIcR2arVu2FZSCDROwoTdWdPB7raZKYaElZrBjSbO-fiylhUMUgG9yth5UGlOiq6_OtDQ-PUggVqvNAUin9yG8ax5JIP1zReFtwMROY0NkZomiSOzikN3VBEmJYUyJHzSDdRn5pHXsVXA2HXJ7ZAIvw-2-dPMeNYDcBTHjE5jb-rAQ-l08ePUVKwq7IBNJj6QqQXABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIyt62ou7DgQMVPovpBR10zAdNEAEYASAAEgI6APD_BwE%26num%3D1%26cid%3DCAQSPABpAlJWuZt1mkXmzQwW-74JOqvx1e9HPQcu6h5lhSGMWCX7aB-vx1nt25qxFXa7PexAmTsrx67GlE2TQhgB%26sig%3DAOD64_21DzGGx7JTKycj17f5_pKUcgw4-Q%26client%3Dca-pub-2612637296234729%26dbm_c%3DAKAmf-AITIO62hGhx5cP5LIuc3XXP8G6o4EvacMYcGi1Wv9RrwjHakBIkvwB3AW8t_5DYVVw0sYrk42qRWTGm7cVZ9ruJf2GyFGbyNFk0BAocy4bCm0lB2mrJSUBFiFPypnWIg8Q7bFLkja9VGl1uAep4RZKrzVP9HaN7YnKc6dhvi1JlBJCCYg%26cry%3D1%26dbm_d%3DAKAmf-D0MG9JDk8mQWArA2o6Bud93Qp6ZNCYwOGcfke6gWZgLE-sOpWARL3mkCxq1nV4yeHpPBb5FRLklofQxJlnDoM3C1P4i0ecNz_1mViNuHM793EUNDZ7PBEAyMGbb4n17EbHUCFAr81SUaoYSmXXDZ3nhzMEg4XSocSLa55QjXeV50VqZCE5S4IjE4L0bGbLL3Tg6VWcQ59qTnfJ0E_TNAXbXQGp-JpI715cAiKFqEw5CHt15bC-5cjvbyLW7qF2Ny24nyVG15rZlfscN7qwadx_VLNHV_Ikl9lI3ju_Wuqn-_3wTITUSNKb7ygp68wUpaT8jZyfn8mT6mVUB6hHMZqJEOnKUYv7PfZgPgPvg6ZhyDbEKEBS3ZmJ-y2cvBqq7CqNBSwJo7Qxd7QxTLKZxCP49LfpemIKCCF0MnuZ9W4L8uMjOlcJ3MRLLl1zUmXo4XNYTKG-ftxNs4dl1SPVWo3VWSKqEyGnEVmjlXa-S1_jPdlCTVk11M1vZz1QRRkBJqzGBUrtZAb8fiL14qrhU0Uwj7gDBw%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2612637296234729%26output%3Dhtml%26h%3D90%26adk%3D3130937508%26adf%3D226233620%26pi%3Dt.aa~a.1154693969~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695572409%26rafmt%3D1%26to%3Dqs%26pwprc%3D6114872683%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fgame.gnlore.com%252Fvictoria-3-product%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1695579609146%26bpp%3D1%26bdt%3D2101%26idt%3D0%26shv%3Dr20230920%26mjsv%3Dm202309140101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Dc39bed6084529430-22d9689489de00fe%253AT%253D1695579608%253ART%253D1695579608%253AS%253DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ%26gpic%3DUID%253D00000c834195fde1%253AT%253D1695579608%253ART%253D1695579608%253AS%253DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug%26prev_fmts%3D0x0%252C1200x280%252C333x250%252C1200x280%26nras%3D5%26correlator%3D5085991068093%26frm%3D20%26pv%3D1%26ga_vid%3D1909208556.1695579608%26ga_sid%3D1695579608%26ga_hid%3D37659207%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D2757%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759927%252C44759842%252C44759876%252C42531705%26oid%3D2%26psts%3DAOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt%26pvsid%3D4005920162221254%26tmod%3D655216534%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D5%26uci%3Da!5%26btvi%3D3%26fsb%3D1%26xpc%3DxuohkQVNe2%26p%3Dhttps%253A%2F%2Fgame.gnlore.com%26dtd%3D37&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fgame.gnlore.com&random=3165122228800&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Sun, 24 Sep 2023 18:20:10 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Sun, 01 Oct 2023 18:20:10 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 link.html Show response
track.webgains.com/ Frame 7462 2 KB
2 KB 182ms
91ms Script
text/html 18.134.234.224
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=93569300126359104444550012457011&nw=1
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.134.234.224 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-134-234-224.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 39f0a19d3bfc30bae852bbf707f0e2668b9844da6db7bb40ba6f3cba01a967dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:10 GMT
last-modified: Sun, 24 Sep 2023 18:20:10 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Sun, 24 Sep 2023 18:21:10 GMT

GET
H2

200

activityi;dc_pre=CLXtlaPuw4EDFerhOwIdEoEFLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=196151741010.29974 Show response
8019191.fls.doubleclick.net/ Frame B059
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=196151741010.29974?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CLXtlaPuw4EDFerhOwIdEoEFLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=196151741010.29974?

392 B
328 B

65ms
64ms

Document
text/html

142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CLXtlaPuw4EDFerhOwIdEoEFLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=196151741010.29974?

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

105912ad68ca36e220a4a2e5132d08f1536197e1a2d576b44c8eccff9f112332

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 219
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 18:20:10 GMT
expires: Sun, 24 Sep 2023 18:20:10 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 18:20:10 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CLXtlaPuw4EDFerhOwIdEoEFLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=196151741010.29974?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900011.redintelligence.net/ Frame ACB0 7 KB
2 KB 80ms
26ms Document
text/html 138.201.64.38
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900011.redintelligence.net/request_content.php?s=93569300126359104444550012457011&a=8fc18f8a
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=90c7d166c3&subid=&uid=1e8925cde4ef2cf5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC0Kno2X0QZYqOFb6Wpt8P9Jif6ASm5b2gaYWVnKfJD_AuEAEgjOqWfmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE8wFP0EnJWJfOpv4ep8HezIQ0CwJzH6VtcrqSnpSnyhdF2AsYb9PaITOT7usWtDFeel3X7pPuZhc_2rHiIsO2s6mwyeMp56XXUgRTcVch6AE_fq_9CPbr1hQjVRHbvAMoraQkIcR2arVu2FZSCDROwoTdWdPB7raZKYaElZrBjSbO-fiylhUMUgG9yth5UGlOiq6_OtDQ-PUggVqvNAUin9yG8ax5JIP1zReFtwMROY0NkZomiSOzikN3VBEmJYUyJHzSDdRn5pHXsVXA2HXJ7ZAIvw-2-dPMeNYDcBTHjE5jb-rAQ-l08ePUVKwq7IBNJj6QqQXABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIyt62ou7DgQMVPovpBR10zAdNEAEYASAAEgI6APD_BwE%26num%3D1%26cid%3DCAQSPABpAlJWuZt1mkXmzQwW-74JOqvx1e9HPQcu6h5lhSGMWCX7aB-vx1nt25qxFXa7PexAmTsrx67GlE2TQhgB%26sig%3DAOD64_21DzGGx7JTKycj17f5_pKUcgw4-Q%26client%3Dca-pub-2612637296234729%26dbm_c%3DAKAmf-AITIO62hGhx5cP5LIuc3XXP8G6o4EvacMYcGi1Wv9RrwjHakBIkvwB3AW8t_5DYVVw0sYrk42qRWTGm7cVZ9ruJf2GyFGbyNFk0BAocy4bCm0lB2mrJSUBFiFPypnWIg8Q7bFLkja9VGl1uAep4RZKrzVP9HaN7YnKc6dhvi1JlBJCCYg%26cry%3D1%26dbm_d%3DAKAmf-D0MG9JDk8mQWArA2o6Bud93Qp6ZNCYwOGcfke6gWZgLE-sOpWARL3mkCxq1nV4yeHpPBb5FRLklofQxJlnDoM3C1P4i0ecNz_1mViNuHM793EUNDZ7PBEAyMGbb4n17EbHUCFAr81SUaoYSmXXDZ3nhzMEg4XSocSLa55QjXeV50VqZCE5S4IjE4L0bGbLL3Tg6VWcQ59qTnfJ0E_TNAXbXQGp-JpI715cAiKFqEw5CHt15bC-5cjvbyLW7qF2Ny24nyVG15rZlfscN7qwadx_VLNHV_Ikl9lI3ju_Wuqn-_3wTITUSNKb7ygp68wUpaT8jZyfn8mT6mVUB6hHMZqJEOnKUYv7PfZgPgPvg6ZhyDbEKEBS3ZmJ-y2cvBqq7CqNBSwJo7Qxd7QxTLKZxCP49LfpemIKCCF0MnuZ9W4L8uMjOlcJ3MRLLl1zUmXo4XNYTKG-ftxNs4dl1SPVWo3VWSKqEyGnEVmjlXa-S1_jPdlCTVk11M1vZz1QRRkBJqzGBUrtZAb8fiL14qrhU0Uwj7gDBw%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2612637296234729%26output%3Dhtml%26h%3D90%26adk%3D3130937508%26adf%3D226233620%26pi%3Dt.aa~a.1154693969~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695572409%26rafmt%3D1%26to%3Dqs%26pwprc%3D6114872683%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fgame.gnlore.com%252Fvictoria-3-product%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1695579609146%26bpp%3D1%26bdt%3D2101%26idt%3D0%26shv%3Dr20230920%26mjsv%3Dm202309140101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253Dc39bed6084529430-22d9689489de00fe%253AT%253D1695579608%253ART%253D1695579608%253AS%253DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ%26gpic%3DUID%253D00000c834195fde1%253AT%253D1695579608%253ART%253D1695579608%253AS%253DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug%26prev_fmts%3D0x0%252C1200x280%252C333x250%252C1200x280%26nras%3D5%26correlator%3D5085991068093%26frm%3D20%26pv%3D1%26ga_vid%3D1909208556.1695579608%26ga_sid%3D1695579608%26ga_hid%3D37659207%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D2757%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759927%252C44759842%252C44759876%252C42531705%26oid%3D2%26psts%3DAOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt%26pvsid%3D4005920162221254%26tmod%3D655216534%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D5%26uci%3Da!5%26btvi%3D3%26fsb%3D1%26xpc%3DxuohkQVNe2%26p%3Dhttps%253A%2F%2Fgame.gnlore.com%26dtd%3D37&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fgame.gnlore.com&random=3165122228800&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.64.38 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 9906b24ab8f99a25d50912624c74717358c027be456a398295cf27bc8758e85c

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2068
Content-Type: text/html; charset=utf-8
Date: Sun, 24 Sep 2023 18:20:10 GMT
Expires: Sun, 24 Sep 2023 19:20:10 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame 7462
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=93569300126359104444550012457011&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=93569300126359104444550012457011&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
482 B

1086ms
1018ms

Image
image/gif

145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=93569300126359104444550012457011&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:11 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx
Host: pv.medialead.de
X-IPLB-Request-ID: D972D785:DD40_91EFC182:01BB_65107DDA_1834765F:B82C
X-IPLB-Instance: 40028
Vary: Origin
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Access-Control-Allow-Credentials: true
Content-Length: 43
Proxy-Host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=93569300126359104444550012457011&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Sun, 24 Sep 2023 18:20:10 GMT
server: nginx
content-length: 154
content-type: text/html

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 7462 43 B
702 B 279ms
183ms Image
image/gif 104.64.118.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=93569300126359104444550012457011&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.64.118.247 , United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-64-118-247.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 18:20:11 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame CA7E 1 KB
643 B 25ms
20ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 81201
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 19:46:49 GMT
etag: 48472445140208031
expires: Sun, 24 Sep 2023 19:46:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7462 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5531f47328e64fa8620c39558751c9b591bd3127dda12cacba88aa23fd8f8241

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame CA7E 0
103 B 36ms
35ms Image
text/plain 2a02:fa8:8806:20::2040
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEGxF44JtWwFaqK-WyNE3rHE&google_cver=1&google_push=AXcoOmQJhlYhlVP0Da7cysAYjbTkI10--kRYDUpXRY6by-3ejayZWmv0pqIr5oELuKS6DYPUHJ_AJ_n8M7XCiMEDhPGHc1I3eC0x5w
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=90&adk=3130937508&adf=226233620&pi=t.aa~a.1154693969~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x90&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250%2C1200x280&nras=5&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2757&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=xuohkQVNe2&p=https%3A//game.gnlore.com&dtd=37
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:20::2040 , Sweden, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CA7E
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESECxsM_d5RZhgCoOpdbbNYtQ&google_push=AXcoOmQPIEygkjQd0LDs8yBFh1MsgjenEZzAy7OXXTeFz7yw7Ma16YFRTW...

170 B
188 B

30ms
30ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESECxsM_d5RZhgCoOpdbbNYtQ&google_push=AXcoOmQPIEygkjQd0LDs8yBFh1MsgjenEZzAy7OXXTeFz7yw7Ma16YFRTWzXIN-aU_IxnFU0NRsB6Sj10c24Zee8s9eN7xu_tEkC4SQ

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230047-FRA
pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1695579611.890692,VS0,VE88
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESECxsM_d5RZhgCoOpdbbNYtQ&google_push=AXcoOmQPIEygkjQd0LDs8yBFh1MsgjenEZzAy7OXXTeFz7yw7Ma16YFRTWzXIN-aU_IxnFU0NRsB6Sj10c24Zee8s9eN7xu_tEkC4SQ
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CA7E
Redirect Chain

https://ipac.ctnsnet.com/int/cm?exc=1&acc=crimtan_au&google_gid=CAESEAfPGqmF27zObgLsWJp1iHw&google_cver=1&google_push=AXcoOmSqMWnjju7CPpnG2Zj6GMluCPMnIjtRCdfQBg62gR0oDQ5a18ah_rgUxEvcEmrp1ptHVM28hgH...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=AXcoOmSqMWnjju7CPpnG2Zj6GMluCPMnIjtRCdfQBg62gR0oDQ5a18ah_rgUxEvcEmrp1ptHVM28hgHLJhU8F4ZsiN46zEF33ljubhg&google_hm=1_uenND4RdaPKs...

170 B
188 B

30ms
30ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=AXcoOmSqMWnjju7CPpnG2Zj6GMluCPMnIjtRCdfQBg62gR0oDQ5a18ah_rgUxEvcEmrp1ptHVM28hgHLJhU8F4ZsiN46zEF33ljubhg&google_hm=1_uenND4RdaPKsU19MAS_IU

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=AXcoOmSqMWnjju7CPpnG2Zj6GMluCPMnIjtRCdfQBg62gR0oDQ5a18ah_rgUxEvcEmrp1ptHVM28hgHLJhU8F4ZsiN46zEF33ljubhg&google_hm=1_uenND4RdaPKsU19MAS_IU
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sync
x.bidswitch.net/ Frame CA7E 43 B
145 B 21ms
20ms Image
image/gif 18.196.96.246
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESELaZ0BNMpZQhHQgAORcrO00&google_cver=1&google_push=AXcoOmSUbZn49YC9Hy2XDHzO0FLW6XdxAwkY0k6Z2Z4qaIKLNcHI_9oYECP-IVEgzTyeppvO2KssShNsJt6DeZuI4Ib5bfymxGNzlPY
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=90&adk=3130937508&adf=226233620&pi=t.aa~a.1154693969~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x90&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250%2C1200x280&nras=5&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2757&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=xuohkQVNe2&p=https%3A//game.gnlore.com&dtd=37
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.196.96.246 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-96-246.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:10 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame CA7E 43 B
362 B 30ms
29ms Image
image/gif 178.250.7.11
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQnsuDAD6-gewWVe5igE5AGZFs27jIyDR_XMz1XmGYEnB3VUx6i8aSBiBHH958brQ2vqqT4wyacABGCDcjahHwDtaATBxYBYY4&google_gid=CAESENtho8D6YBaEPFYj8r1e2nE&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.7.11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 178395
expires: Sun, 24 Sep 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CA7E
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEPk4gjJJP9K48bboATejwCU&google_cver=1&google_push=AXcoOmSjUyaGPyuL5Vq8-n4ljyWz33qsJJDoOEgaPKlerNMnEDts_GYNmLqgh9HGQWecwQiVUblTm5pH...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODY5ODE1MDAyNzU3MTA4MjUwMA&google_push=AXcoOmSjUyaGPyuL5Vq8-n4ljyWz33qsJJDoOEgaPKlerNMnEDts_GYNmLqgh9HGQWecwQiVUblTm5...

170 B
188 B

31ms
31ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODY5ODE1MDAyNzU3MTA4MjUwMA&google_push=AXcoOmSjUyaGPyuL5Vq8-n4ljyWz33qsJJDoOEgaPKlerNMnEDts_GYNmLqgh9HGQWecwQiVUblTm5pH6fm8aX02_D-vQOoeUb5ynnU

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODY5ODE1MDAyNzU3MTA4MjUwMA&google_push=AXcoOmSjUyaGPyuL5Vq8-n4ljyWz33qsJJDoOEgaPKlerNMnEDts_GYNmLqgh9HGQWecwQiVUblTm5pH6fm8aX02_D-vQOoeUb5ynnU
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 trk
ag.innovid.com/ Frame CA7E 43 B
296 B 200ms
37ms Image
image/gif 2a05:d01c:1d8:8102:d9e9:4576:4b39:3a88
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEA6ObJSzCC53WHznbekp8TM&google_cver=1&google_push=AXcoOmRV0ghhY8d6K3wOlROxb_pC1et3TnhFCgE_dghIuQS3plBF5HJEoR462KqLJfEqcBaO6kO0ZkCvx0B3_M1jJVtLB06Sd0fcc_c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=90&adk=3130937508&adf=226233620&pi=t.aa~a.1154693969~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x90&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250%2C1200x280&nras=5&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2757&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=xuohkQVNe2&p=https%3A//game.gnlore.com&dtd=37
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8102:d9e9:4576:4b39:3a88 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sun, 24 Sep 2023 18:20:10 GMT
cache-control: no-cache
content-length: 43
request-time: 1
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame CA7E 0
12 B 30ms
29ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Jp0osRxW_Kf1vCfqhMlCXS7bcOtU-bwUxolUxxL3q7oyBEjzh8N-HurWGB3829QGLtE0TD

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:10 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 css
fonts.googleapis.com/ Frame ACB0 2 KB
434 B 30ms
29ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=93569300126359104444550012457011&a=8fc18f8a

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bf5b911ce6645add415b3dbf40d50dc8cda426f38f5300525bf4793c4131b2c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900011.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 24 Sep 2023 18:20:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 17:00:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 24 Sep 2023 18:20:10 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame ACB0 10 KB
10 KB 164ms
116ms Image
image/png 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-627x627.jpg
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=93569300126359104444550012457011&a=8fc18f8a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: 3767edf9df0edce119a8e778046a57f7b97d1024af3dc02f929edf7177851205

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900011.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:10 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 9891
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame ACB0 9 KB
9 KB 170ms
123ms Image
image/png 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/627x627_Office-Partner.jpg
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=93569300126359104444550012457011&a=8fc18f8a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: 1327f4f8cb0d48c5b28a75030355272387c365b0cd119e01cf6e2c39439617bb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900011.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:10 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 9249
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame ACB0 7 KB
7 KB 170ms
122ms Image
image/png 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native4.png
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=93569300126359104444550012457011&a=8fc18f8a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: b82816f3883cf64ca12070ae4c7f0923528798ecd60f03d6262de6d7712dbf57

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900011.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:10 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 7116
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame BB2A 171 KB
62 KB 32ms
31ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

aa36c8464b2f1f0f420ec485ac2334a0714829d17cdea168fcd47e6ebabfec11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63317
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 24 Sep 2023 18:20:10 GMT

GET
H/1.1 200
OK viewability Show response
hal900011.redintelligence.net/ Frame ACB0 0
150 B 74ms
26ms Script
text/html 138.201.64.38
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900011.redintelligence.net/viewability?s=93569300126359104444550012457011&a=1f3df7b1&vb=m
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=93569300126359104444550012457011&a=8fc18f8a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.64.38 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900011.redintelligence.net/request_content.php?s=93569300126359104444550012457011&a=8fc18f8a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 18:20:10 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 7462 51 KB
18 KB 195ms
30ms Script
text/javascript 52.222.139.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=93569300126359104444550012457011&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.139.78 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-139-78.ams50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 43c969dd91796954ee5b0d995fddf5dc9b008844db541a4103c1d95b28ef2f74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 02:14:38 GMT
content-encoding: gzip
via: 1.1 4f516e51d4c38a41272c9098bf829774.cloudfront.net (CloudFront)
last-modified: Mon, 07 Aug 2023 14:11:27 GMT
server: AmazonS3
x-amz-cf-pop: AMS50-C1
age: 57939
etag: W/"cb7accb6a6fc086cd831549a78a2fe42"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: G0vaDrPtaef-cJw-PYQwapPNbgXwcBbAsZlfEBzRMbjvnzmBWTaCxw==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame 7462 3 KB
3 KB 94ms
22ms Image
image/png 99.86.4.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1695579910&Signature=aG29sV3-U6VUC1jp3NniWU48lZchpQI~HOYspKC38wMp9ltR-4Yll3nfj9gqttcWd8lLj~K8funacZOQDqOOh7zb9IqAi3e~ZzHQ3H-Yb0nDCutWlS5HrjRUifDCpf8rK053wAnH0AU~KNkaWIfSSGMmM1dafyMjDD~~6uMihwrTlzyxEFrHPh4B~AFHJHlTr-9O4MaGmc4VhU6zgWsodOdY6KUocto7mKBaZHlQCtm14zzVKrrVx5tdmcO65Oc4wtoavrpaoYNGaJBLpnXU4pWbyGYdsYi504O~DqSaaelg79vTACl6HIJiYW1686PjtyiwYYOG11j8mIv4KtYU9g__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=90&adk=3130937508&adf=226233620&pi=t.aa~a.1154693969~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695572409&rafmt=1&to=qs&pwprc=6114872683&format=1200x90&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695579609146&bpp=1&bdt=2101&idt=0&shv=r20230920&mjsv=m202309140101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc39bed6084529430-22d9689489de00fe%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ&gpic=UID%3D00000c834195fde1%3AT%3D1695579608%3ART%3D1695579608%3AS%3DALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug&prev_fmts=0x0%2C1200x280%2C333x250%2C1200x280&nras=5&correlator=5085991068093&frm=20&pv=1&ga_vid=1909208556.1695579608&ga_sid=1695579608&ga_hid=37659207&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2757&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759842%2C44759876%2C42531705&oid=2&psts=AOrYGsm-Bxnu0i1byKuJleKbtZCWww-IwkZVUSgPmkABULb585jU9ZpRHa3tukZ7JPcjj_THMvFpPN6evadnZcGTf-aLZQkt&pvsid=4005920162221254&tmod=655216534&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=xuohkQVNe2&p=https%3A//game.gnlore.com&dtd=37
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.53 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-53.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

x-amz-version-id: null
date: Sun, 24 Sep 2023 09:15:56 GMT
via: 1.1 2f0580a0593ad9d3fb82aee9226d8178.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 32654
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: m-nv5jZ8Scydoq6ZXKBYT1FWTWBTdfFgvoacvT6bEBrmuoWwWPzNww==

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame BB2A 271 KB
91 KB 30ms
30ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cd948bda526cc61bd91d5be64597daaa24a4adfdb7d8e11b9d3b4638392f66da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:10 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92715
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 24 Sep 2023 18:20:10 GMT

GET
H2 200 dc_pre=CLXtlaPuw4EDFerhOwIdEoEFLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=196151741010.29974
adservice.google.com/ddm/fls/z/ Frame B059 42 B
401 B 135ms
59ms Image
image/gif 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CLXtlaPuw4EDFerhOwIdEoEFLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=196151741010.29974

Requested by

Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=CLXtlaPuw4EDFerhOwIdEoEFLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=196151741010.29974?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8019191.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7A28 0
20 B 122ms
121ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=930786289113&version=m202309120101&ct=76&x=1&cor=15348802603310012000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 7462 16 B
209 B 86ms
86ms Fetch
application/json 3.8.252.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.8.252.32 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-8-252-32.eu-west-2.compute.amazonaws.com

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 24 Sep 2023 18:20:12 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 153ms
35ms Preflight 3.8.252.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.8.252.32 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-8-252-32.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Sun, 24 Sep 2023 18:20:11 GMT
server: nginx

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 72ms
72ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230920&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d01b94d89c2d0138697970db2a3ec843f6695b2d57e7d25e7369271d930d4de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12094
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 24 Sep 2023 18:20:12 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 321D 13 KB
5 KB 21ms
19ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://game.gnlore.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2463
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 17:39:09 GMT
expires: Mon, 23 Sep 2024 17:39:09 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 6F65 829 B
561 B 30ms
29ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b9ca1a6dd73b7ed3ad9a9d99f26f172e1cfb3ac11cbed0f13200e69cc0329416

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-L0GIZP5NS80YJPPTzXfvDA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://game.gnlore.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-L0GIZP5NS80YJPPTzXfvDA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 18:20:12 GMT
expires: Sun, 24 Sep 2023 18:20:12 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 tGcDLxZnxcZjneq6ZTfMhLSKmVRaNAcBIKHxIKG0fIc.js Show response
pagead2.googlesyndication.com/bg/ Frame 321D 37 KB
14 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/tGcDLxZnxcZjneq6ZTfMhLSKmVRaNAcBIKHxIKG0fIc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b467032f1667c5c6639deaba6537cc84b48a99545a34070120a1f120a1b47c87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:32:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6479
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14772
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 23 Sep 2024 16:32:13 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 6F65 0
0 122ms
121ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230920&jk=4005920162221254&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 321D 0
10 B 19ms
19ms Image
text/plain 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?7EysRg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 18:20:12 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 127ms
126ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230920&jk=4005920162221254&bg=!_v2l_bLNAAYrDsWMCw47ADQBe5WfOGh8CQAdoBzPBH0OIKFMKwsKQq4TJrkmDO4k7EtKH1GVdwI0QSzg67P0eUzJHtScAgAAAENSAAAABWgBB5kCsVIZpzSaSjbuW6Pc06NwcTIpaxRgGrVAr2Gk9AU3cK1QQFJTRZw6NRPPv86W9eIFjx9km9rLFSnIDHjJnYz_E2LgTn0GCQegBYeaAcffH6vJG8wqzD19GjPp7cNaBQT31erGrttShar4FKiY-LimZzkadF4oQ9GqOk_n-i_r9lzyznOQjaguh8C3ZoYq1ProWh_roymKgv605q5OXJ69LXy1QV0SlquR02IK2X9o_5D3B64rhrop_mlDK-_0bi7nIRH1CKVLCESkMB5rRFjS7vRN8nOTpH8fPoNXPiRmU73gq6XTpdzFhzeKkvfm7GjNKv1xob4El38BiNWv1_5VdY0jA0NJu3MW87uTTSHGhF8wOb4zxZb9NEqyllpQOKox2JUiS9Gh6x5ylHFyCTH59qKrIMCz5Lqfy-QsGhyzWmEtTZXIUUWf2uUrNGgnN_82Lh-hjXpmC2va0HRMtpcVn85c8CYyJi-o1iejC8k8pKENsDbv_pcwK1X4uvKZE1TTlSTO67cTRy49Jki2kckN_Q2zDw8gPqP0YS1nYzDALFf114f-FeLqBwaOjnhQJljsWLduvMeRDZ8Y511eeMBwnvFZaaF6OlHtt3WpN3NVvhHbMxnBkLunSR6axmHHnAfQZ8JoQm9SVEF5eIV8i_Pyr7d0aS05yM0LSIufXaCUmbqhPt7EObno-cn9oFToHZxJcCi5EvO9qvQtRnhMKTwOcROGsRXqyn4ndeXOm1HXUHiCtfzcmTd6omQs7y4ypl3vA-xINH7rR_q9NB51MU-i9vdmU_euyGnisfGTGDkKT90-DJS1wxLz3PhUpJI9P30haoVP3EwCMQOrfXmwU7NjGB0pnaKmsY15H5j6F1w0X65sZAj8PGqJkiXs_3eTdCTAS--aPFlV6YoaXBhbhw-d4w-T
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://game.gnlore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7462 0
20 B 123ms
123ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4268946655198&version=m202309120101&ct=77&x=1&cor=10538905297369637000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 18:20:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: googlecm.hit.gemius.pl
URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEJZQ3YqX6gz3Ymf99aPiXZM&google_cver=1&google_push=AXcoOmSWGSlW-I9yByHAZeLOXMzuB4P9cDU1CupaZYfN5LP1m5XxfTUlJdcVfC40gW4-mL0-qxqpWthgxh1ugTFO3AX49FIz4qb7GDaF

Verdicts & Comments Add Verdict or Comment

52 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

29 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.gnlore.com/	1970-01-21 00:35:39	Name: _ga_MPE22XYXHL Value: GS1.1.1695579608.1.0.1695579608.60.0.0
.gnlore.com/	1970-01-21 00:35:39	Name: _ga Value: GA1.2.1909208556.1695579608
.gnlore.com/	1970-01-20 15:01:06	Name: _gid Value: GA1.2.934134892.1695579608
.gnlore.com/	1970-01-20 14:59:39	Name: _gat_gtag_UA_134610508_1 Value: 1
.gnlore.com/	1970-01-21 00:21:15	Name: __gads Value: ID=c39bed6084529430-22d9689489de00fe:T=1695579608:RT=1695579608:S=ALNI_MZMfNL5lQ7Rtxz18pxOz3aWGKYpUQ
.gnlore.com/	1970-01-21 00:21:15	Name: __gpi Value: UID=00000c834195fde1:T=1695579608:RT=1695579608:S=ALNI_MbRvUhGqFJYZUCHOX_zUcTsbc4Fug
.googleadservices.com/	1970-01-20 17:09:15	Name: ar_debug Value: 1
.adnxs.com/	1970-01-20 17:09:15	Name: uuid2 Value: 7974797415510723405
.casalemedia.com/	1970-01-20 23:45:15	Name: CMID Value: ZRB92R7NijsLMpH9ipPWMAAA
.casalemedia.com/	1970-01-20 17:09:15	Name: CMPS Value: 3391
.casalemedia.com/	1970-01-20 17:09:15	Name: CMPRO Value: 3391
.doubleclick.net/	1970-01-21 00:21:15	Name: IDE Value: AHWqTUn1NHzNJx2S1o6vwBqJc2mqgHww3_1VlukTCkpQO2fB9yz7KBz1Xb2BGCs1Rvw
.doubleclick.net/	1970-01-20 19:18:51	Name: APC Value: AfxxVi7LNFl5d0WBYAv71R9r4pdq2p86ryZEQrGdvLQd1oc2tAfTLw
.simpli.fi/	1970-01-20 23:46:42	Name: suid Value: 41F3CDC676584E19AF349086F837717E
.adnxs.com/	1970-01-20 17:09:15	Name: anj Value: dTM7k!M41.D>6NRF']wIg2GVPLm3_M!A#F7.TOKKnyW<U1`VROYQM-:>Pbh5>7V7v:b?EiG9]Iw>9EAq?WOwOm_r8j<QG=%9sk@3@'s>T>W<P%
.w55c.net/	1970-01-20 15:42:51	Name: matchgoogle Value: 5
.w55c.net/	1970-01-21 00:29:54	Name: wfivefivec Value: Yu1dZe6L1QKtIe5
.ctnsnet.com/	1970-01-20 23:45:15	Name: gid_CAESEOfTM2EcZ4wx5LdfYLuMBQg Value: 1
.adform.net/	1970-01-20 15:42:51	Name: C Value: 1
.adform.net/	1970-01-20 16:26:03	Name: uid Value: 8698150027571082500
.yahoo.com/	1970-01-20 23:45:37	Name: A3 Value: d=AQABBNp9EGUCEDZ9Fy6K8l5AYDk4rVUw_GsFEgEBAQHPEWUaZQAAAAAA_eMAAA&S=AQAAAuCrYQuGhSwsORaZbWyOG6Y
.redintelligence.net/	1970-01-20 17:09:15	Name: 8lcfmzhxc8d6_uid Value: 8b7ba9df7401ada4
.ctnsnet.com/	1970-01-20 23:45:15	Name: gid_CAESEAfPGqmF27zObgLsWJp1iHw Value: 1
.ctnsnet.com/	1970-01-20 23:45:15	Name: cid Value: d7fb9e9cd0f845d68f2ac535f4c012fc
.office-partner.de/	1970-01-21 00:35:39	Name: source Value: {"webgains_webgains":{"timestamp":1695579610967,"clickCookie":false}}
.everesttech.net/	1970-01-20 23:45:15	Name: everest_g_v2 Value: g_surferid~ZRB92gAAAeU5XQA4
.innovid.com/	1970-01-20 17:09:15	Name: uuid Value: 316eae47-151f-4804-915b-6e1a37abe341-20230924 14:20:10
.awin1.com/	1970-01-20 15:09:44	Name: awpv11601 Value: 113440\|1695579610\|ff796020-5b06-11ee-898e-223287d3f473
.awin1.com/	1969-12-31 23:59:59	Name: AWSESS Value: 357526:3266505

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAXcoOmTjLxGcHK7HFiHi_W3_NJKoMoc_hv9wN3Oy4IT-jg95DsMLkq85DrEHUWYUP3Rd5jEOBWb4isNjk7b52f-ilq9xiv7-e0pjfQ&google_gid=CAESEAG-bNltrVgCzjb2jOoBtzQ&google_cver=1 Message: Failed to load resource: the server responded with a status of 451 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8019191.fls.doubleclick.net
ade.googlesyndication.com
adservice.google.com
adv.office-partner.de
ag.innovid.com
analytics.webgains.io
api.webgains.io
c1.adform.net
cdn.track.production.webgains.team
cm.g.doubleclick.net
dclk-match.dotomi.com
dis.criteo.com
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
game.gnlore.com
gcm.ctnsnet.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
googlecm.hit.gemius.pl
hal9000.redintelligence.net
hal900011.redintelligence.net
i.ytimg.com
ib.adnxs.com
id.rlcdn.com
ipac.ctnsnet.com
match.adsrvr.org
medialead.de
onetag-sys.com
pagead2.googlesyndication.com
partner.googleadservices.com
pm.w55c.net
pr-bh.ybp.yahoo.com
pv.medialead.de
region1.analytics.google.com
s0.2mdn.net
stats.g.doubleclick.net
sync-tm.everesttech.net
tpc.googlesyndication.com
track.webgains.com
um.simpli.fi
www.awin1.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
googlecm.hit.gemius.pl
104.18.27.193
104.64.118.247
138.201.64.38
142.250.181.230
142.250.185.162
142.250.185.98
144.76.238.55
145.239.193.130
151.101.66.49
167.88.125.7
178.250.7.11
18.134.234.224
18.196.96.246
185.89.210.244
2001:4860:4802:34::36
216.58.206.34
2a00:1450:4001:806::2001
2a00:1450:4001:806::2002
2a00:1450:4001:809::2002
2a00:1450:4001:80e::200a
2a00:1450:4001:811::2003
2a00:1450:4001:812::2016
2a00:1450:4001:813::2003
2a00:1450:4001:81c::2002
2a00:1450:4001:81c::2006
2a00:1450:4001:827::2002
2a00:1450:4001:827::2004
2a00:1450:4001:82a::2003
2a00:1450:4001:82a::2008
2a00:1450:4001:82f::2002
2a00:1450:4001:830::200e
2a00:1450:400c:c02::9d
2a02:fa8:8806:20::2040
2a05:d018:d29:3602:92bc:acd1:fb60:2d82
2a05:d01c:1d8:8102:d9e9:4576:4b39:3a88
2a0b:4d07:102::1
3.8.252.32
35.157.117.145
35.186.193.173
35.204.74.118
35.244.174.68
35.71.131.137
37.157.4.29
51.75.86.98
52.222.139.78
94.23.99.218
99.86.4.53
01860d2273448228ae1e9f7b7150e82bdcf98896938cccd44815f4c1c856204c
0293af2477f26ae7516ff91ec1bb72c73dbab540baa2445310ae2f1fbe255c23
041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51
096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c5c7d8e33e5e0febfc017be61a23ebe1e77c7994c27974bf1cebd50b22a6c68
0ccc340d0d04e25a27c698928dbe2aaa20e477b4e39b5008691079ba5d2bf29e
0eff32133eb996e2b45f523ac9210d4b408f34e05868e592112f9abc322306eb
104dc64ea270915aeb57dd15f3bec7ca8a498bb76953d044e46ac5945f9f20ec
105912ad68ca36e220a4a2e5132d08f1536197e1a2d576b44c8eccff9f112332
116e513225e7dee39b12dd4f04d26898b29b72f5ff8fa8248ad7fba8c2ef5c89
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
1288b0b3d62836988db4905996cbf8e317badae2d54eae1b3afc1b65a9874c75
1293f8310bfc9697dcd9d64de42e332ff59e594eca1bc3e255474c0693167d23
1327f4f8cb0d48c5b28a75030355272387c365b0cd119e01cf6e2c39439617bb
1a9cba16c5a30dc7cc3bdcbba2a45e9e2e28ec4437894302c6676369ed0ec732
1ec3329dcfc4df212ec718a1fb1dec020642ae68f353c61bb042d2fc1f11df2c
232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98
241bb801b29748e542884f7b902c02f12f6a318ba97f70224986634926dbc433
27bac3f44c763f47592e531c40a0bd481af3a01201fcd55bd33ec885cb7c62f3
2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2caf2d84896b40961323a923dbf272b822a3e28466acdac44e75c0fde9364cfe
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e15e49379e85a43b49374fb7dbb9de56109527f63ec0d1efbe096adacd2a295
2e68f8a31e7a3fdc27d8a03ab8d37c4f69d4a49af7579dad9fc9c7b520523950
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b
3767edf9df0edce119a8e778046a57f7b97d1024af3dc02f929edf7177851205
384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7
39f0a19d3bfc30bae852bbf707f0e2668b9844da6db7bb40ba6f3cba01a967dc
3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280
3fbe8e26c3139fc2d45811c9996c402841780837b3a6cb74b43304c0340c342d
43c969dd91796954ee5b0d995fddf5dc9b008844db541a4103c1d95b28ef2f74
44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22
47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40
4a31a8733940d9d2cb4e98b82b96ecb180ce1de0fc2a8e6397e6bba48aa33c46
4accbcd793680c2ea0a65714771ef37d5eeb42bdaedba9882dd0d78eae09e00e
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b8d4277763eff0a0c1bb80e77f469202acc196824f637aadf408501ca5bf494
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
521e8d0a51454628b8fc84e91049e5d52945d1b61848436266c05af3a60a2904
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
543ceb846af6fbfff9fc58f1e53994f3f191116c51ca95de3ce75d675c50ea66
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5531f47328e64fa8620c39558751c9b591bd3127dda12cacba88aa23fd8f8241
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5b62609de41fe28668ba6b2a1fca5abd5c5537fb32ada667ddefe70ad8e7c8f2
5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164
5eb77d84bdf5a71d624df5525860b4e44896fab951c84084e63d09b136e9167d
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98
67447c3656caad630373253691f3e8f64467eafd6e7305c9b0e98111b0b41694
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6ba2d25deda5219cb6c8230393264ab7b102473c2ffc5fd4c947c427b12af643
6f24047e809a4cbe19f718fbaeee8a99ef93bedc5dec8fdf00488cd6fa196e71
7558855ee5a48c98018f73c01b91b9ae06da4be88f8ed7fd5b0b252b16c106c7
76db4cd0f4ed0cab40ce55838d9e88c6129a5ce1290b802afaba51a0949f0209
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7a6bf080d151eb6301c6b0a5f87c3dded4d89852545c03d5a5d800f3ac6a86e9
85de8e1049567f060665a08f4f9784af156edc484723473acd40953eb3bde550
8736be1070fc66462690b8f676308abbab086d487bbe0eb9ac741b4b03da89a5
8a62d099c6a1cd9ac8e1e416175a998ba3ed34cd2bc249194f12675d30e619d5
8d01b94d89c2d0138697970db2a3ec843f6695b2d57e7d25e7369271d930d4de
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8f9d88352b286107f60c320c4c088f718c2a3a273818cd61901edb7f235a9339
98548c06857417fc015a98d2227d0cc41596ce3bda32bffc85f8ca3d006805dc
9906b24ab8f99a25d50912624c74717358c027be456a398295cf27bc8758e85c
9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9d52c7c5050b088109075328a9e830e4bfdf6446c763b9e69c637d5c0e11d599
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a128b287f920a5042d84a49c11b89788a712523a2be5ef4b911566823dac6d72
a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678
a8c2b783dfb2a8ae80f75f9b271024777ef513e93fe8b220c0df95ed8fe3a4a0
aa36c8464b2f1f0f420ec485ac2334a0714829d17cdea168fcd47e6ebabfec11
aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed
abca6b3f5e3a4af083ea3e72fdae1e310f4a40c999ddd0e268a8fafdeaca3497
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b467032f1667c5c6639deaba6537cc84b48a99545a34070120a1f120a1b47c87
b82816f3883cf64ca12070ae4c7f0923528798ecd60f03d6262de6d7712dbf57
b8ab5f91903d3ffacb3291e6c04e255b777d32970c2ac56f48e527089044b234
b9ca1a6dd73b7ed3ad9a9d99f26f172e1cfb3ac11cbed0f13200e69cc0329416
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
bb6c99b4c07e0ac204245abaf2275d8d3a6b9ffed0645add3a4570ad50c0aea4
bdf689384688979a215ce372d64fbc91e99563f051b6ba3c8d76186e0d1877be
be1f75994e53be710e621d9552d7cc796a347e85622acc435325d94e076b6996
bf5b911ce6645add415b3dbf40d50dc8cda426f38f5300525bf4793c4131b2c2
c136c054b97ce28bd0b2b02e33bb3056dc150bb7363a8e03cca840b67137760f
c3b7bf416424abed17314649bb71a1de7a3afc6af66840d04b730e69652e27ac
c5e1a1e8982becdc83263b687951cfc5c5976af5b5d67eab53451cb72ac78925
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
cb0fafab9d9cc65a1359edadd9ef67ff71d09a84348eaf37e9a0b55cc98f6c9b
cd948bda526cc61bd91d5be64597daaa24a4adfdb7d8e11b9d3b4638392f66da
cfc321df846749615922046a2efff3649c5b994e917f7ed58a02f660d68c8e9a
cfcce6fbc676bcdc4c9f2e2cbdd40cee40a4b9066f829f4e9e400cbe142183f2
d0d80991c6e4b62d5c77985c1e293aad44cc120e03aee7ae6936c79d25a0e467
d41b693d59fcbc01996c3cdae8bba9035b2156f8c08bb2927bea96dc7a7b2ee4
d6b6b77c0d3ef41ecf8ba29f5351171104e466910fa007d590a7c62004efeb6a
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6
d94639f71e76d54bd933786e8356c15e8023ac53ab8bb8ea399a0da9fe7e9b6c
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de9348830d5048e11ee17758288022a42f088c10667a4e4d7445130a0068e011
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e401b72553ea85689b6a2ee010d65bd1d41bd99d765ca892c49589e9a170634b
e4f8bf028d52dffe3f2027afe94818d76348ba33f1c708763feb126260634871
e529245e8867300ffd2b6f6c1e5b36d41ce8c71a9eb7cbdec52360c0be7b0017
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef7598634d8232665e2db4caf316bc781a604cc8434dd831132928a6efd932a8
f0f6af6d31950271742da0d62e63bd2907c0bc0a238ba972c97f222d70b8e3fc
fedf6af2935e1c30de75cc8f879ca86bd81dff8accd1c943c8a94440013115fa

game.gnlore.com Open in urlscan Pro 167.88.125.7 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

195 Requests

87 %HTTPS

45 %IPv6

36 Domains

50 Subdomains

40 IPs

10 Countries

10921 kBTransfer

13457 kBSize

29 Cookies

2 Outgoing links

Redirected requests

195 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

game.gnlore.com Open in urlscan Pro
167.88.125.7 Public Scan

Screenshot
Live screenshot

Full Image

195
Requests

87 %
HTTPS

45 %
IPv6

36
Domains

50
Subdomains

40
IPs

10
Countries

10921 kB
Transfer

13457 kB
Size

29
Cookies

195 HTTP transactions
8 data transactions