hizlitrenbiletisatis.com Open in urlscan Pro
185.216.113.60 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://hizlitrenbiletisatis.com/
Effective URL:
https://hizlitrenbiletisatis.com/
Submission: On October 11 via manual (October 11th 2023, 2:49:27 pm UTC) from TR — Scanned from DE

Summary HTTP 172 Redirects Behaviour Indicators

Summary

This website contacted 36 IPs in 8 countries across 30 domains to perform 172 HTTP transactions. The main IP is 185.216.113.60, located in Turkey and belongs to AS49126, TR. The main domain is hizlitrenbiletisatis.com.
TLS certificate: Issued by R3 on September 20th 2023. Valid for: 3 months.

This is the only time hizlitrenbiletisatis.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 6	185.216.113.60 185.216.113.60	49126 (AS49126) (AS49126)
33	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:813::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
3 13	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0a::9b	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:800::200a	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
41	2a00:1450:400... 2a00:1450:4001:806::2001	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1 4	2a00:1450:400... 2a00:1450:4001:82b::2004	15169 (GOOGLE) (GOOGLE)
6	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
3 12	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE)
2 4	104.18.26.193 104.18.26.193	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 4	68.67.160.186 68.67.160.186	29990 (ASN-APPNEX) (ASN-APPNEX)
1	142.250.186.38 142.250.186.38	15169 (GOOGLE) (GOOGLE)
3 3	3.126.78.53 3.126.78.53	16509 (AMAZON-02) (AMAZON-02)
2	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
1	34.96.105.8 34.96.105.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	3.65.107.250 3.65.107.250	16509 (AMAZON-02) (AMAZON-02)
1 1	2a05:d018:d29... 2a05:d018:d29:3602:77fc:3cf3:5701:3122	16509 (AMAZON-02) (AMAZON-02)
2	178.250.1.9 178.250.1.9	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2 2	37.157.6.237 37.157.6.237	198622 (ADFORM) (ADFORM)
5	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
4	46.4.10.49 46.4.10.49	24940 (HETZNER-AS) (HETZNER-AS)
1 4	138.201.63.116 138.201.63.116	() ()
3	145.239.193.130 145.239.193.130	() ()
1	2a0b:4d07:101::1 2a0b:4d07:101::1	() ()
1	92.123.148.9 92.123.148.9	() ()
1	18.135.175.58 18.135.175.58	() ()
1 2	142.250.185.134 142.250.185.134	() ()
1	2620:116:800d... 2620:116:800d:21:7eb1:3826:be7e:d981	() ()
1 1	35.204.74.118 35.204.74.118	() ()
1 1	35.190.0.66 35.190.0.66	() ()
1	18.66.122.12 18.66.122.12	() ()
1	99.86.4.94 99.86.4.94	() ()
1	2a00:1450:400... 2a00:1450:4001:80f::2002	() ()
2	52.56.171.192 52.56.171.192	() ()
172	36

6 185.216.113.60 (Turkey) 1 redirects

ASN49126 (AS49126, TR)
PTR: ns1.ihsdnsx50.com

hizlitrenbiletisatis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0a::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

41 2a00:1450:4001:806::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 172.217.16.194 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.18.26.193 (None, ) 2 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 68.67.160.186 (New York, United States) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.38 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.126.78.53 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-78-53.eu-central-1.compute.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.71.131.137 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.105.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.105.96.34.bc.googleusercontent.com

tr.blismedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.65.107.250 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-65-107-250.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:d29:3602:77fc:3cf3:5701:3122 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.1.9 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.6.237 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 46.4.10.49 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.49.10.4.46.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.63.116 (None, ) 1 redirects

ASN- ()

hal90004.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 145.239.193.130 (None, )

ASN- ()

pv.medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a0b:4d07:101::1 (None, )

ASN- ()

adv.office-partner.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 92.123.148.9 (None, )

ASN- ()

www.awin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.135.175.58 (None, )

ASN- ()

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.134 (None, ) 1 redirects

ASN- ()

5994599.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:7eb1:3826:be7e:d981 (None, )

ASN- ()

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.204.74.118 (None, ) 1 redirects

ASN- ()

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.0.66 (None, ) 1 redirects

ASN- ()

ads.travelaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.122.12 (None, )

ASN- ()

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.4.94 (None, )

ASN- ()

cdn.track.production.webgains.team	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2002 (None, )

ASN- ()

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.56.171.192 (None, )

ASN- ()

api.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
74	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 108 tpc.googlesyndication.com — Cisco Umbrella Rank: 157	748 KB
29	doubleclick.net 7 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 45 stats.g.doubleclick.net — Cisco Umbrella Rank: 98 cm.g.doubleclick.net — Cisco Umbrella Rank: 255 ad.doubleclick.net — Cisco Umbrella Rank: 173 5994599.fls.doubleclick.net	205 KB
14	gstatic.com www.gstatic.com fonts.gstatic.com	164 KB
8	redintelligence.net 1 redirects hal9000.redintelligence.net — Cisco Umbrella Rank: 41903 hal90004.redintelligence.net	57 KB
7	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1200 www.googleadservices.com — Cisco Umbrella Rank: 153	613 B
6	hizlitrenbiletisatis.com 1 redirects hizlitrenbiletisatis.com	63 KB
5	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2 adservice.google.com	1 KB
5	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 223	294 KB
5	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 49	4 KB
4	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 261	3 KB
4	casalemedia.com 2 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 716	2 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 56	293 KB
3	webgains.io analytics.webgains.io api.webgains.io	18 KB
3	medialead.de pv.medialead.de	1 KB
3	w55c.net 3 redirects pm.w55c.net — Cisco Umbrella Rank: 1069	3 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 42 region1.google-analytics.com — Cisco Umbrella Rank: 2250	21 KB
2	adform.net 2 redirects c1.adform.net — Cisco Umbrella Rank: 643	1 KB
2	criteo.com dis.criteo.com — Cisco Umbrella Rank: 648	725 B
2	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 402	297 B
1	webgains.team cdn.track.production.webgains.team	437 B
1	travelaudience.com 1 redirects ads.travelaudience.com	556 B
1	simpli.fi 1 redirects um.simpli.fi	716 B
1	quantserve.com cms.quantserve.com	465 B
1	webgains.com track.webgains.com	2 KB
1	awin1.com www.awin1.com	705 B
1	office-partner.de adv.office-partner.de	931 B
1	yahoo.com 1 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 491	713 B
1	bidswitch.net x.bidswitch.net — Cisco Umbrella Rank: 387	146 B
1	blismedia.com tr.blismedia.com — Cisco Umbrella Rank: 2268	173 B
0	gemius.pl Failed googlecm.hit.gemius.pl Failed
172	30

	Domain	Requested by
41	tpc.googlesyndication.com	googleads.g.doubleclick.net www.gstatic.com tpc.googlesyndication.com ad.doubleclick.net pagead2.googlesyndication.com
33	pagead2.googlesyndication.com	hizlitrenbiletisatis.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
13	googleads.g.doubleclick.net	3 redirects pagead2.googlesyndication.com googleads.g.doubleclick.net
12	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net hizlitrenbiletisatis.com
9	www.gstatic.com	googleads.g.doubleclick.net
6	www.googleadservices.com	googleads.g.doubleclick.net hizlitrenbiletisatis.com
6	hizlitrenbiletisatis.com	1 redirects hizlitrenbiletisatis.com
5	fonts.gstatic.com	fonts.googleapis.com
5	www.googletagservices.com	googleads.g.doubleclick.net
5	fonts.googleapis.com	googleads.g.doubleclick.net hal90004.redintelligence.net
4	hal90004.redintelligence.net	1 redirects googleads.g.doubleclick.net hal90004.redintelligence.net
4	hal9000.redintelligence.net	googleads.g.doubleclick.net hal90004.redintelligence.net
4	ib.adnxs.com	3 redirects googleads.g.doubleclick.net
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	www.google.com	1 redirects googleads.g.doubleclick.net tpc.googlesyndication.com
4	www.googletagmanager.com	hizlitrenbiletisatis.com www.googletagmanager.com adv.office-partner.de
3	pv.medialead.de	hal90004.redintelligence.net
3	pm.w55c.net	3 redirects
2	api.webgains.io	analytics.webgains.io
2	5994599.fls.doubleclick.net	1 redirects googleads.g.doubleclick.net
2	c1.adform.net	2 redirects
2	dis.criteo.com	googleads.g.doubleclick.net
2	match.adsrvr.org	googleads.g.doubleclick.net
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	adservice.google.com	5994599.fls.doubleclick.net
1	cdn.track.production.webgains.team	googleads.g.doubleclick.net
1	analytics.webgains.io	track.webgains.com
1	ads.travelaudience.com	1 redirects
1	um.simpli.fi	1 redirects
1	cms.quantserve.com	googleads.g.doubleclick.net
1	track.webgains.com	googleads.g.doubleclick.net
1	www.awin1.com	hal90004.redintelligence.net
1	adv.office-partner.de	hal90004.redintelligence.net
1	pr-bh.ybp.yahoo.com	1 redirects
1	x.bidswitch.net	googleads.g.doubleclick.net
1	tr.blismedia.com	googleads.g.doubleclick.net
1	ad.doubleclick.net	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	region1.google-analytics.com	www.googletagmanager.com
0	googlecm.hit.gemius.pl Failed	googleads.g.doubleclick.net
172	41

This site contains no links.

Subject Issuer	Validity	Valid
hizlitrenbiletisatis.com R3	`2023-09-20` - `2023-12-19`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
tr.blismedia.com GTS CA 1D4	`2023-10-04` - `2024-01-02`	3 months	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2023-03-23` - `2024-03-23`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2023-12-23`	3 months	crt.sh
redintelligence.net R3	`2023-10-10` - `2024-01-08`	3 months	crt.sh
pv.medialead.de R3	`2023-08-13` - `2023-11-11`	3 months	crt.sh
adv.office-partner.de R3	`2023-08-29` - `2023-11-27`	3 months	crt.sh
www.awin1.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-10` - `2024-03-09`	a year	crt.sh
*.webgains.com Amazon RSA 2048 M01	`2023-05-15` - `2024-06-13`	a year	crt.sh
quantserve.com R3	`2023-08-29` - `2023-11-27`	3 months	crt.sh
*.webgains.io Amazon RSA 2048 M01	`2023-07-24` - `2024-08-22`	a year	crt.sh
cdn.track.production.webgains.team Amazon RSA 2048 M03	`2023-08-30` - `2024-09-27`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh

This page contains 26 frames:

Primary Page: https://hizlitrenbiletisatis.com/
Frame ID: 5B3B8D4BD1F8013F4BF6A9697EB40049
Requests: 29 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20190131/zrt_lookup.html
Frame ID: 3D8CD0C2F749B848E98CFADC131A26E3
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&adk=1812271804&adf=3025194257&lmt=1697028560&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=188x675_l%7C188x675_r&format=0x0&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035759492&bpp=15&bdt=2511&idt=619&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=390441101575&frm=20&pv=2&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=664
Frame ID: 1BA0EA0FB86E6893028A98D4EA17ADE0
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=280&slotname=5949653418&adk=884195032&adf=1992085446&pi=t.ma~as.5949653418&w=1200&fwrn=4&fwrnh=100&lmt=1697028560&rafmt=1&format=1200x280&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035759507&bpp=2&bdt=2525&idt=657&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=140&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=9TWBZmaFiD&p=https%3A//hizlitrenbiletisatis.com&dtd=672
Frame ID: 6B9AA97D6274AC13215522E41E969DAE
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=280&adk=933129145&adf=264647053&pi=t.aa~a.1127516034~i.6~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1697028560&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=2252401314&ad_type=text_image&format=1200x280&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rh=200&rw=1200&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035760943&bpp=1&bdt=3961&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280&nras=2&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1290&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cN0esWBxRE&p=https%3A//hizlitrenbiletisatis.com&dtd=49
Frame ID: 608F0EC5061EB06F273D24F99DBE702D
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=90&adk=4007679122&adf=1902911653&pi=t.aa~a.2836415199~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1697028561&rafmt=1&to=qs&pwprc=2252401314&format=1200x90&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035761013&bpp=1&bdt=4032&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280%2C1200x280&nras=3&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1923&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ikt1naLgoN&p=https%3A//hizlitrenbiletisatis.com&dtd=10
Frame ID: 02B262B12D7715EB190A9A3C96D87322
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1
Frame ID: 674F4CA5660CAB912E929021BF146A07
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1
Frame ID: 5181E9D9A819D513A0BB51D5E88988E2
Requests: 13 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 159C134FA9F0A8BE8558ADECA73E9493
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 3B76EA4535B44D781C5288B101AF4431
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html
Frame ID: 4750FB2C802D3F7E101BD4E8608B9B1C
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNWLxjCc0RQMqHWzhDrESMztgsTAc8PqY6WeL8lt-HQBx8YcZ01--aICAhnO0NJIYyWxc4f3taLtj1rz136MT2ef2TLhNAtadkqYfgVxNg-M4xP5oskIDbZTeNaM3nYvQrAZyq8a6Rytv-g3n-rhAffcw928NgYFQRckkbzyFjqJDVBhPaY
Frame ID: DA9738267434D731EA73A58439423D77
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: E9DA60DAA76651F1F6B758B0E13E968F
Requests: 22 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 3D7F30E12DE75A20E3787D6E9892833D
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js
Frame ID: 747779C20940E38E789A81B1B03B18D0
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js
Frame ID: 622BB3B2B99046014AFA416A5EB29466
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 6B9282F85413D78D8C63BB58D68D8286
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js
Frame ID: 72C24D81092D1A6E3DB08322998374C5
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js
Frame ID: 6330FED6B1FD190EFE2AEB5338C79276
Requests: 1 HTTP requests in this frame

Frame: https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=34265700073041104444550012474004&t=htlp&gdpr=1&consent=1&gdpr_consent=
Frame ID: 158EE304391C89DF0A2206D1B955F662
Requests: 1 HTTP requests in this frame

Frame: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Frame ID: 9322E127EB8A77789CC9CDFBB0D0EFB4
Requests: 3 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=CNnjk--e7oEDFW9EwgodUUYPGQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5510468895751.816
Frame ID: 939B1F8518C05B01FAEF25F25CACFA1E
Requests: 2 HTTP requests in this frame

Frame: https://hal90004.redintelligence.net/request_content.php?s=34265700073041104444550012474004&a=c51ff915
Frame ID: 228E0E3AD83412DEC55607D19DB9AAEB
Requests: 6 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 73824CB9CB5E96C52A8E0989F1181D7E
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 34D967CDF5B53433CAB0FE750BD213AB
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: ACAA4D41C4696F9E0DA5E56796D54EB2
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

TCDD Hızlı Tren Bileti Satış 2023 YHT Fiyatları

Page URL History Show full URLs

http://hizlitrenbiletisatis.com/ HTTP 301
https://hizlitrenbiletisatis.com/ Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Webgains (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

analytics\.webgains\.io

Page Statistics

172
Requests

91 %
HTTPS

43 %
IPv6

30
Domains

41
Subdomains

36
IPs

8
Countries

1871 kB
Transfer

4667 kB
Size

26
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://hizlitrenbiletisatis.com/ HTTP 301
https://hizlitrenbiletisatis.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 64

https://googleads.g.doubleclick.net/pagead/adview?ai=Cr6ZW8LUmZYniD-7An88Ptu2b2A7Jl5TDc7zVuYnVEdrZHhABINWu7BBgleKTgqAHoAGky7DhA8gBCakCICezlv7FsT6oAwHIA0iqBNoBT9AzhdJOzvu-zP5o1GELs4AmI8AvORIMmeeb5JqiA3ha_ICW8Ce6ITErB4dBWp4FwPq4FywbcloR6ody7GE_wVzXNmOzTKjWCwshldCBg_IlskP-6kWQfKG1p6rIjzZCbzvHDJffa77bgK0CD4MrrhmJW3lzuy3pxYG_bZ7T4Lac3JETxrI3k7YF6k2qZcD095ygORopeRdyn4orudW5Z3sjc5lksYR1pEdXw7K_2lBE7vaQiwH9knxKDwNOw241d69JzuDo-dZwnWQvjD5JdUVwbDOnmKU9lgDABMzl0P2HBIgF3umN-DmSBQQIBBgBkgUECAUYBKAGLoAHxLTPHqgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEIekEdIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqaCYsDaHR0cHM6Ly93d3cuYmFobi5kZS9hbmdlYm90L3NwYXJwcmVpcy1mbGV4cHJlaXMvc3BhcnByZWlzLWdydXBwZT9kYmthbmFsXzAwMT1MMDFfUzAxX0QwMDFfS1NFMDAwMV9HMTMwNTBfMTAyMV9GVl9BV0FSX1NQQVJfU3BhcnByZWlzLUdydXBwZV9HRE4xX1RoZW1lbi1Zb3VuZy0xMC0yMDIzX0xaMDEmZXh0UHJvdklkPTUmZXh0UHU9MTQwNTgtZ2F3JmV4dExpPTE1NTUyNzA1NzU4JmV4dENyPTEzOTU4MTQ2OTM4OC02NzYzMjY5ODQxMjImZXh0U2k9aGl6bGl0cmVuYmlsZXRpc2F0aXMuY29tJmV4dFRnPSUyRnRyYXZlbCUyMCUyNiUyMHRyYW5zcG9ydGF0aW9uJTJGdHJhbnNwb3J0YXRpb24lMkZsb25nJTIwZGlzdGFuY2UlMjBidXMlMjAlMjYlMjByYWlsJmtleXdvcmQ9JmV4dEFQPSZleHRNVD2ACgHICwHYEwrQFQGYFgGAFwGyFxwKGggAEhRwdWItOTUwMzMxOTY5OTcxMjkyNhgA&sigh=cMywOpx7n2g&uach_m=[UACH]&ase=2&nis=4&cid=CAQSSwDICaaNNDOHryGPF_6gWwlrad1nJf6EgsAE15dvLLFxkr1V0iIIi6uLxlN7vTrnktxobzR4hkTjDyZfy1zV3IjcwENlG1MUwgaKnhgB&template_id=419&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%224138171885236683130%22,%22debug_reporting%22:true,%22destination%22:%22https://bahn.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%221009526180%22],%224%22:[%2210-11%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225536755255497409793%22}&andc=true

Request Chain 97

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxguC7Xv8C86KRQomXB1j0&google_cver=1

Request Chain 98

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZSa18h8U9fqHPksYS11NOAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxguC7Xv8C86KRQomXB1j0&google_cver=1

Request Chain 99

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFG-xTbiLALmBXSOb7SQLto&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFG-xTbiLALmBXSOb7SQLto%26google_cver%3D1

Request Chain 100

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIwNDM0ODEyNzk3MTAxNDQwNA%3D%3D

Request Chain 101

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 106

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEGiVaaOOC5WpkwuGlnQ-EV4&google_cver=1&google_push=AXcoOmTiZwIz6KkytarX2Q4HdqW5MZDtwgbltH_AyPl78rLQxDuObYQ__D3Xj21FGmuGH3_6leY4SRY-EO6Fl5njFVUsAOXAEslzMgk HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEGiVaaOOC5WpkwuGlnQ-EV4&google_cver=1&google_push=AXcoOmTiZwIz6KkytarX2Q4HdqW5MZDtwgbltH_AyPl78rLQxDuObYQ__D3Xj21FGmuGH3_6leY4SRY-EO6Fl5njFVUsAOXAEslzMgk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=V3pqTDRhZVUxUVFBd3k1&google_gid=CAESEGiVaaOOC5WpkwuGlnQ-EV4&google_cver=1&google_push=AXcoOmTiZwIz6KkytarX2Q4HdqW5MZDtwgbltH_AyPl78rLQxDuObYQ__D3Xj21FGmuGH3_6leY4SRY-EO6Fl5njFVUsAOXAEslzMgk

Request Chain 110

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECKDbfwQcsuNXtxOFwFwZH0&google_cver=1&google_push=AXcoOmQYXU639-fq6eMu3tY_c3uw-qPIv03WZ-LnUkqKhicTAPJWE3nh5OrIYZepW2cu7Qpem6gFG9NhZonoKfM4lXIsK-i2Z_i0Nw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQYXU639-fq6eMu3tY_c3uw-qPIv03WZ-LnUkqKhicTAPJWE3nh5OrIYZepW2cu7Qpem6gFG9NhZonoKfM4lXIsK-i2Z_i0Nw&google_hm=eS12VU5GTDM5RTJwRU1VM2FUaVFRVDlsY3AyWGdaWkxuZ35B

Request Chain 112

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEO_9HTypQ2POsFeMW0DMs_c&google_cver=1&google_push=AXcoOmR_Nh339pf8_-PpxxNra0WA_GvnGV-fLcVdxUbFZQKWHdwNl1HwnY_zP64F-o7DzjpVbD-jeU-ydcjK75W9BlHELSFY0Q6Tpg HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEO_9HTypQ2POsFeMW0DMs_c&google_cver=1&google_push=AXcoOmR_Nh339pf8_-PpxxNra0WA_GvnGV-fLcVdxUbFZQKWHdwNl1HwnY_zP64F-o7DzjpVbD-jeU-ydcjK75W9BlHELSFY0Q6Tpg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTY5NDkwOTc5NTIyNDY1Mzg0Ng&google_push=AXcoOmR_Nh339pf8_-PpxxNra0WA_GvnGV-fLcVdxUbFZQKWHdwNl1HwnY_zP64F-o7DzjpVbD-jeU-ydcjK75W9BlHELSFY0Q6Tpg

Request Chain 126

https://googleads.g.doubleclick.net/pagead/adview?ai=CW3nn8bUmZazjA8-oiQaG7br4BPXx-qVyuK_Kh6wR6ISUmEMQASDVruwQYJXik4KgB6AB--TfmAPIAQmpAiAns5b-xbE-qAMByAPLBKoE5gFP0HPP0GsWnsk9sZ2aEF0zFfcAk5a_kzfp9gLh4A64bxavA1KIFXHx_fbyfuUKCvS-hQr3VBxkrdjHiwe2I4RmkdkU4kSS9lbVrCVcLsW9T-aXTwqBvKDBRm8XBYi4zzNNcFmZxJ1A_YcqyqLVFfvQtbuohtVZ1l_eoQfYebDQ_ntFtcTxNAalGdMpT2EX1EavegDNV2IthVXIUQZjYz7OV-dFxogJIw2jGBZRZnCxH6iCc4yRQ5UhQUaNp3uB98PaVw73G7oDFeXH_yzjvVbHVUE2AkkcMgaHotNDLRT4E_uAVtUUpsAEmqHM5YUEiAXQ64nhOZIFBAgEGAGSBQQIBRgEoAYugAftmqBnqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQ37kD0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOpoJ-AFodHRwczovL3d3dy5lbnBhbC5kZS9hcnRpa2VsMi9kYXMtc29sbHRlbi1zaWUtdm9yLWRlbS1rYXVmLWVpbmVyLXNvbGFyYW5sYWdlLXdpc3Nlbj91dG1fc291cmNlPUdvb2dsZSUyMERpc3BsYXkmdXRtX2NhbXBhaWduPTE1NTA0NDA1OTY4JnV0bV90ZXJtPTEzODk5NDE5MjUzOCZ1dG1fY29udGVudD02NjYzODM3NjYzNzAmdXRtX3BsYWNlbWVudD1oaXpsaXRyZW5iaWxldGlzYXRpcy5jb20mdXRtX2RldmljZT1jJmRldmljZW1vZGVsPYAKAcgLAbgT5APYEwyIFAHQFQGYFgGAFwGyFxwKGggAEhRwdWItOTUwMzMxOTY5OTcxMjkyNhgA&sigh=iKObnDJ81KE&uach_m=[UACH]&ase=2&nis=4&cid=CAQSOwDICaaNp062Iz5klulmDJ34zTyaKzd2SncJbli2pa1zbBgLKqwX056IZFzP1RPTa9QNEu9r1olMWBlHGAE&template_id=484&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%225927052780835567528%22,%22debug_reporting%22:true,%22destination%22:%22https://enpal.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22857207419%22],%224%22:[%2210-11%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%22275719327073111265%22}&andc=true

Request Chain 129

https://hal90004.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=c8ffbd92cb&subid=&uid=f4c49f48f6e7cc0a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fad.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvjpY8bUmZa7CBLOi-cAP2LG0mA6m5b2gaYWVnKfJD_AuEAEg1a7sEGCV4pOCoAfIAQmpAiAns5b-xbE-qAMByAObBKoE9wFP0PnNdY25h73oacRrScALoHNz3ctu_lkkxwbaLscpYZx15aVAlvlrFSOtu7_K_KI7s9ttzsjY0gcjuhGhsJV8QuJRdLdOEordKk0IGCxJqOzvSQoieqMhdhJMPY0lZOgicvpWCHsgblHDBgANMkwRLtaaNicmInp5fYSSnSJ3VJxKea6CUFa-IR-JHKrYk-kwFTKxOw8Zeh-QfpF7AqzbnCf_O7JTrIApUmEj_shvHSCk5yAjGegIhH3azDsCz4QCOKsnEYq3iHxFDgmrgfjr6rEIIppTqrFBwx-2opfL_NNYsJV2-wPyjpdtr5kthlhmBuiBRVnpwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB8yAqoCOgKAQEi9_cE6gAoBmAsByAsBgAwBqg0CREXIDQGwE8yc2RLQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26gclid%3DEAIaIQobChMI7v7W7Z7ugQMVM1EeAh3YGA3jEAEYASAAEgJ96_D_BwE%26num%3D1%26cid%3DCAQSOwDICaaNxYDYzK8SYCkhlNgeuKiFakMR8WuWUnsj5weIWnAC1geyrPM1XHBqPBDMmSm2Znx_c6TdHBBSGAE%26sig%3DAOD64_1jg8uL6lxxKSCzRNu9SRuQZDPGYg%26client%3Dca-pub-9503319699712926%26dbm_c%3DAKAmf-CVQXTgA3AKj428V8dufiA0HaVB1-8YBEYzHFiXThwRGwd6CtKBDJqw3jxZ9usSXIaAPWPaOr4qGaOZINY_430HsRzj5X056nY5lZ3pDvKz3o3P3ODn7_981PjnkkgveFD-DVWv1aZzE0uk1BgO92m1uO1RxwnFZLnX6su01Mrrcjl5Uo8%26cry%3D1%26dbm_d%3DAKAmf-A5NwheYPPpypUvDLy_JMFhYEIMGgyPo1p59qGjVo8sGEjDEi2CYZfzIK8vgt9jy-LUQT8L_RDWPqkAIGw3dxAe5IC0aRbziHNy9Lwv0KVaHCA6v-Ek3BX1YYcabt_hamhNeLUzqI-kho1HA0iyW_2krhXusaj4qYPIJnSdmoE4WuyJZ1XYZm5sn0Ij6eq33CED7prQQAIgL8EtIGif1302RC5Lo33HzwG3NaiS8MrAdVDffS0DuOl0kuVlVb5XhjNn_eHsezmc-NJrcqu0Xgj4v1ZGeldT-dHgL1PHHyCTgqSo_0L3ZRmsvdSrWIcqZ7etR4uRvj4XK-RRdzXHcRGNDOAG3_L0fZ7S1SDwFgab0zP4pAGk2xc0w4PjYm_ICMtlnmbt1BlVqVaMbbdhr-6fIGqJbZG0nshsXawiGLl8XpEfzNIpfIC3tKhZQRu6R6OwWytdQ1K0dqy1ukrXSqr8ZE4dNIi1zC8-gCeqHr-6eBCC_8Hoa9f2qZi0N8QRd8h3N2QyCCvZagR7TY8HVatGxXyqpj84qLEwWs4bSC1GyXs5KVupuUthemxKUWQfrbqdyPov%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-9503319699712926%26output%3Dhtml%26h%3D90%26adk%3D4007679122%26adf%3D1902911653%26pi%3Dt.aa~a.2836415199~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1697028561%26rafmt%3D1%26to%3Dqs%26pwprc%3D2252401314%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fhizlitrenbiletisatis.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1697035761013%26bpp%3D1%26bdt%3D4032%26idt%3D1%26shv%3Dr20231004%26mjsv%3Dm202310030101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D36f369bc50818345-22fd4bad43df0042%253AT%253D1697035760%253ART%253D1697035760%253AS%253DALNI_MZGzwMz73MJf8FV5SbfdydYad676w%26gpic%3DUID%253D00000da5d61795de%253AT%253D1697035760%253ART%253D1697035760%253AS%253DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw%26prev_fmts%3D0x0%252C1200x280%252C1200x280%26nras%3D3%26correlator%3D390441101575%26frm%3D20%26pv%3D1%26ga_vid%3D918218546.1697035760%26ga_sid%3D1697035760%26ga_hid%3D282395861%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D1923%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C31077327%252C44804783%252C44805099%252C31078297%252C31078557%26oid%3D2%26pvsid%3D777396027689374%26tmod%3D82866107%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D2%26fsb%3D1%26xpc%3Dikt1naLgoN%26p%3Dhttps%253A%2F%2Fhizlitrenbiletisatis.com%26dtd%3D10&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fhizlitrenbiletisatis.com&random=5071629461249&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal90004.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=c8ffbd92cb&subid=&uid=f4c49f48f6e7cc0a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fad.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvjpY8bUmZa7CBLOi-cAP2LG0mA6m5b2gaYWVnKfJD_AuEAEg1a7sEGCV4pOCoAfIAQmpAiAns5b-xbE-qAMByAObBKoE9wFP0PnNdY25h73oacRrScALoHNz3ctu_lkkxwbaLscpYZx15aVAlvlrFSOtu7_K_KI7s9ttzsjY0gcjuhGhsJV8QuJRdLdOEordKk0IGCxJqOzvSQoieqMhdhJMPY0lZOgicvpWCHsgblHDBgANMkwRLtaaNicmInp5fYSSnSJ3VJxKea6CUFa-IR-JHKrYk-kwFTKxOw8Zeh-QfpF7AqzbnCf_O7JTrIApUmEj_shvHSCk5yAjGegIhH3azDsCz4QCOKsnEYq3iHxFDgmrgfjr6rEIIppTqrFBwx-2opfL_NNYsJV2-wPyjpdtr5kthlhmBuiBRVnpwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB8yAqoCOgKAQEi9_cE6gAoBmAsByAsBgAwBqg0CREXIDQGwE8yc2RLQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26gclid%3DEAIaIQobChMI7v7W7Z7ugQMVM1EeAh3YGA3jEAEYASAAEgJ96_D_BwE%26num%3D1%26cid%3DCAQSOwDICaaNxYDYzK8SYCkhlNgeuKiFakMR8WuWUnsj5weIWnAC1geyrPM1XHBqPBDMmSm2Znx_c6TdHBBSGAE%26sig%3DAOD64_1jg8uL6lxxKSCzRNu9SRuQZDPGYg%26client%3Dca-pub-9503319699712926%26dbm_c%3DAKAmf-CVQXTgA3AKj428V8dufiA0HaVB1-8YBEYzHFiXThwRGwd6CtKBDJqw3jxZ9usSXIaAPWPaOr4qGaOZINY_430HsRzj5X056nY5lZ3pDvKz3o3P3ODn7_981PjnkkgveFD-DVWv1aZzE0uk1BgO92m1uO1RxwnFZLnX6su01Mrrcjl5Uo8%26cry%3D1%26dbm_d%3DAKAmf-A5NwheYPPpypUvDLy_JMFhYEIMGgyPo1p59qGjVo8sGEjDEi2CYZfzIK8vgt9jy-LUQT8L_RDWPqkAIGw3dxAe5IC0aRbziHNy9Lwv0KVaHCA6v-Ek3BX1YYcabt_hamhNeLUzqI-kho1HA0iyW_2krhXusaj4qYPIJnSdmoE4WuyJZ1XYZm5sn0Ij6eq33CED7prQQAIgL8EtIGif1302RC5Lo33HzwG3NaiS8MrAdVDffS0DuOl0kuVlVb5XhjNn_eHsezmc-NJrcqu0Xgj4v1ZGeldT-dHgL1PHHyCTgqSo_0L3ZRmsvdSrWIcqZ7etR4uRvj4XK-RRdzXHcRGNDOAG3_L0fZ7S1SDwFgab0zP4pAGk2xc0w4PjYm_ICMtlnmbt1BlVqVaMbbdhr-6fIGqJbZG0nshsXawiGLl8XpEfzNIpfIC3tKhZQRu6R6OwWytdQ1K0dqy1ukrXSqr8ZE4dNIi1zC8-gCeqHr-6eBCC_8Hoa9f2qZi0N8QRd8h3N2QyCCvZagR7TY8HVatGxXyqpj84qLEwWs4bSC1GyXs5KVupuUthemxKUWQfrbqdyPov%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-9503319699712926%26output%3Dhtml%26h%3D90%26adk%3D4007679122%26adf%3D1902911653%26pi%3Dt.aa~a.2836415199~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1697028561%26rafmt%3D1%26to%3Dqs%26pwprc%3D2252401314%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fhizlitrenbiletisatis.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1697035761013%26bpp%3D1%26bdt%3D4032%26idt%3D1%26shv%3Dr20231004%26mjsv%3Dm202310030101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D36f369bc50818345-22fd4bad43df0042%253AT%253D1697035760%253ART%253D1697035760%253AS%253DALNI_MZGzwMz73MJf8FV5SbfdydYad676w%26gpic%3DUID%253D00000da5d61795de%253AT%253D1697035760%253ART%253D1697035760%253AS%253DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw%26prev_fmts%3D0x0%252C1200x280%252C1200x280%26nras%3D3%26correlator%3D390441101575%26frm%3D20%26pv%3D1%26ga_vid%3D918218546.1697035760%26ga_sid%3D1697035760%26ga_hid%3D282395861%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D1923%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C31077327%252C44804783%252C44805099%252C31078297%252C31078557%26oid%3D2%26pvsid%3D777396027689374%26tmod%3D82866107%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D2%26fsb%3D1%26xpc%3Dikt1naLgoN%26p%3Dhttps%253A%2F%2Fhizlitrenbiletisatis.com%26dtd%3D10&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fhizlitrenbiletisatis.com&random=5071629461249&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 130

https://googleads.g.doubleclick.net/pagead/adview?ai=CLcIg8LUmZcfBDpysiQbboqf4DfGaxr1zpb7g_uoRt-mivcABEAEg1a7sEGCV4pOCoAegAc_chKwCyAEJqQLVy2t5T11jPqgDAcgDywSqBOIBT9AB-8ZiMu-fVCyJK31t6nzY0MQA_gXoNuJs7rMU7w_6yp_D1uUQDWMKpXI9g_QEa3N5W2iChaSWBUhgqsskLse6-KwYQ6Z7vwNiXhipW817EnJ1Ae0Gogzhzw-js6AxvxfBVN94gKJRpDodc-dZtb6uJWcfu8PncpMgcUhhfCeB4-mTc7mwgNJ2pN5KbS54Cedew8zLAkF2Btk1-CsB_qoS1ZUNZgMn_2E22IN4VBPIEUZqD7gOMgAHnpDa09xFYLPhc2s_HGGEw1m6GEghLSmmppc6mfZP6uNVpqQUMh2yYcAE6p7TgK0EiAWZ-fnpTJIFBAgEGAGSBQQIBRgEoAYugAfK0vvTAagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcFEJDawAHSCBYIgOGAEBABGB8yAqoCOgKAQEi9_cE6mglxaHR0cHM6Ly9zdXJ5YXBpYW50YWx5YS5jb20udHIvdHI_dXRtX3NvdXJjZT1nb29nbGUmdXRtX21lZGl1bT1jcGMmdXRtX2NhbXBhaWduPXBtYXhfYW50YWx5YXN1aXRlc19la2ltMjNfZ3VyYmV0Y2mACgHICwG4E-QD2BMM0BUBgBcBshccChoIABIUcHViLTk1MDMzMTk2OTk3MTI5MjYYAA&sigh=kk67QE9USyY&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTADICaaNYewYf53bARHugcTTHEe7W-r1xPrwVwj7F0NY45zgMU_Y4WCY6S_7WwTYKvc0Wf8_GArd5bLXkKSue5YDG9CpaJf0JHC9ex4YAQ&template_id=484&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%223062383837059546945%22,%22debug_reporting%22:true,%22destination%22:%22https://suryapiantalya.com.tr%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22629222991%22],%224%22:[%2210-11%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%229292214637711986657%22}&andc=true

Request Chain 144

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5510468895751.816 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CNnjk--e7oEDFW9EwgodUUYPGQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5510468895751.816

Request Chain 154

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEFbFIQ9t5BOxpkE2zf97tYI&google_cver=1&google_push=AXcoOmQFfIS0kaE1eDk1NFbgHtFwCBk4_Xs9dMUUe4_QRv_df2mIOEQ1PNQb-ySiKggJVWbRHMEBJPTJuNErpPcnS_Tp1R0arBQY4w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=V3pqTDRhZVUxUVFBd3k1&google_gid=CAESEFbFIQ9t5BOxpkE2zf97tYI&google_cver=1&google_push=AXcoOmQFfIS0kaE1eDk1NFbgHtFwCBk4_Xs9dMUUe4_QRv_df2mIOEQ1PNQb-ySiKggJVWbRHMEBJPTJuNErpPcnS_Tp1R0arBQY4w

Request Chain 155

https://um.simpli.fi/gp_match?google_gid=CAESEKAnSa8GKdK7FeBQCV65hg8&google_cver=1&google_push=AXcoOmT5KFf5ttwyNFZHaxmy1GW8Y4LX5PtKTkrbLRzWlNStqiDouU5VlARrnTB6Gv1FP4TcJJmmWWm7auNgiOutPFswOpKN9mxd6g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=1B4AA6C9032C49BCB08ACC2D7EAC04FE&google_push=AXcoOmT5KFf5ttwyNFZHaxmy1GW8Y4LX5PtKTkrbLRzWlNStqiDouU5VlARrnTB6Gv1FP4TcJJmmWWm7auNgiOutPFswOpKN9mxd6g

Request Chain 157

https://ads.travelaudience.com/google_pixel?google_gid=CAESEE-R5lqd-G7sx2E4eLNcLnM&google_cver=1&google_push=AXcoOmQW7iNTM2pVD-yqPJDZBLCSktfkxZQeadvg1Rg5VD7jtH7r3VD_NGWHPP_ZcbPwGZV2jrMtGQ1w-abIV4j_EvHTSpgQq_YbMA HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=URdjU_-aQ4s2yZGvxHmuZg&google_push=AXcoOmQW7iNTM2pVD-yqPJDZBLCSktfkxZQeadvg1Rg5VD7jtH7r3VD_NGWHPP_ZcbPwGZV2jrMtGQ1w-abIV4j_EvHTSpgQq_YbMA

172 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
hizlitrenbiletisatis.com/
Redirect Chain

http://hizlitrenbiletisatis.com/
https://hizlitrenbiletisatis.com/

8 KB
3 KB

280ms
93ms

Document
text/html

185.216.113.60
AS49126

General

Check archive.org

Show headers Download Go to

Full URL: https://hizlitrenbiletisatis.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.216.113.60 , Turkey, ASN49126 (AS49126, TR),
Reverse DNS: ns1.ihsdnsx50.com
Software: LiteSpeed / PleskLin
Resource Hash: eabbeb79a10a5cc1851b20a1c56a051495ff884edecc7e9cf5af185a29ed6117

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 11 Oct 2023 14:49:16 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: LiteSpeed
vary: Accept-Encoding
x-powered-by: PleskLin

Redirect headers

Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-length: 707
content-type: text/html
date: Wed, 11 Oct 2023 14:49:16 GMT
location: https://hizlitrenbiletisatis.com/
server: LiteSpeed
x-powered-by: PleskLin

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 145 KB
51 KB 2275ms
1302ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9503319699712926

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc855df5f96c6e1a018719c3e3cb045a8355222b5ff8615c870163f0727b0612

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hizlitrenbiletisatis.com/
Origin: https://hizlitrenbiletisatis.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51429
x-xss-protection: 0
server: cafe
etag: 14288027859167718504
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 11 Oct 2023 14:49:19 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 132 KB
51 KB 2274ms
1295ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-32775258-2

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

454b60927b9163b1e8c3f715ef77eac0616b48c8440f0f32a61876a04dbb25ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 51746
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 11 Oct 2023 14:49:19 GMT

GET
H2 200 css_min.css
hizlitrenbiletisatis.com/ 11 KB
3 KB 321ms
306ms Stylesheet
text/css 185.216.113.60
AS49126

General

Check archive.org

Show headers Download Go to

Full URL: https://hizlitrenbiletisatis.com/css_min.css
Requested by: Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.216.113.60 , Turkey, ASN49126 (AS49126, TR),
Reverse DNS: ns1.ihsdnsx50.com
Software: LiteSpeed / PleskLin
Resource Hash: 777bee19cd171a780de1b42ebcf5c63dae897faf69b750ce65d324f4d68f9270

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:17 GMT
content-encoding: br
last-modified: Sat, 06 May 2023 19:20:50 GMT
server: LiteSpeed
etag: "2b83-6456a892-faaa19dd5e2feced;br"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 2638
expires: Fri, 10 Nov 2023 14:49:17 GMT

GET
H2 200 hizli-tren-bileti.webp
hizlitrenbiletisatis.com/images/ 50 KB
51 KB 379ms
379ms Image
image/webp 185.216.113.60
AS49126

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hizlitrenbiletisatis.com/images/hizli-tren-bileti.webp
Requested by: Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.216.113.60 , Turkey, ASN49126 (AS49126, TR),
Reverse DNS: ns1.ihsdnsx50.com
Software: LiteSpeed / PleskLin
Resource Hash: 49b294716e336dbc654131cde9cd0f23941b3193e64f04019118c188113de0fc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:17 GMT
last-modified: Wed, 09 Feb 2022 21:32:47 GMT
server: LiteSpeed
etag: "c978-620432ff-efded3bf5ad553c1;;;"
x-powered-by: PleskLin
content-type: image/webp
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 51576
expires: Wed, 18 Oct 2023 14:49:17 GMT

GET
H2 200 hizli-tren-bileti-logo.webp
hizlitrenbiletisatis.com/images/ 3 KB
3 KB 142ms
141ms Image
image/webp 185.216.113.60
AS49126

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hizlitrenbiletisatis.com/images/hizli-tren-bileti-logo.webp
Requested by: Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/css_min.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.216.113.60 , Turkey, ASN49126 (AS49126, TR),
Reverse DNS: ns1.ihsdnsx50.com
Software: LiteSpeed / PleskLin
Resource Hash: a98edd99a102f9b0de155a7fccae56553ecb454c6dcefb977dda6c4b905581be

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/css_min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:17 GMT
last-modified: Fri, 05 May 2023 18:26:38 GMT
server: LiteSpeed
etag: "d38-64554a5e-99f15cc43b1e5550;;;"
x-powered-by: PleskLin
content-type: image/webp
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 3384
expires: Wed, 18 Oct 2023 14:49:17 GMT

GET
H2 200 tcdd.webp
hizlitrenbiletisatis.com/images/ 2 KB
2 KB 142ms
142ms Image
image/webp 185.216.113.60
AS49126

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hizlitrenbiletisatis.com/images/tcdd.webp
Requested by: Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/css_min.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.216.113.60 , Turkey, ASN49126 (AS49126, TR),
Reverse DNS: ns1.ihsdnsx50.com
Software: LiteSpeed / PleskLin
Resource Hash: 3af6f2f6faafb2b524d44723591d3598b88e09c4668a83a5deab02b93416cc7e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/css_min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:17 GMT
last-modified: Fri, 05 May 2023 18:51:36 GMT
server: LiteSpeed
etag: "996-64555038-31f2dc57a5a99521;;;"
x-powered-by: PleskLin
content-type: image/webp
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 2454
expires: Wed, 18 Oct 2023 14:49:17 GMT

GET
DATA 200
OK truncated
/ 266 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 260 KB
88 KB 99ms
78ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-LFKKHQFG5B&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-32775258-2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

794051fd3bf99ded63ae9d9eeb32f4f86fe11711e0621453495da61d5ce2ca23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 90359
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 11 Oct 2023 14:49:19 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 256ms
117ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-32775258-2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 11 Oct 2023 13:49:42 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 3577
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 11 Oct 2023 15:49:42 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310030101/ 391 KB
133 KB 309ms
98ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310030101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9503319699712926&plah=hizlitrenbiletisatis.com&bust=31078557

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9503319699712926

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

172f1d0631af65a71f1c84c7cb6737058a9e7133e23573ee84102f75e4f87b61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 135749
x-xss-protection: 0
server: cafe
etag: 3824142580075754577
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 11 Oct 2023 14:49:19 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231004/r20190131/ Frame 3D8C 10 KB
5 KB 256ms
28ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231004/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9503319699712926

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hizlitrenbiletisatis.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1250
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 11 Oct 2023 14:28:29 GMT
etag: 2603938475786422795
expires: Wed, 25 Oct 2023 14:28:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
212 B 44ms
42ms XHR
text/plain 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=282395861&t=pageview&_s=1&dl=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&ul=en-us&de=UTF-8&dt=TCDD%20H%C4%B1zl%C4%B1%20Tren%20Bileti%20Sat%C4%B1%C5%9F%202023%20YHT%20Fiyatlar%C4%B1&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=99500451&gjid=708614270&cid=918218546.1697035760&tid=UA-32775258-2&_gid=1275344022.1697035760&_r=1&gtm=457e3a90&jsscut=1&z=846829419

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://hizlitrenbiletisatis.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://hizlitrenbiletisatis.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
259 B 222ms
63ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-LFKKHQFG5B&gtm=45je3a90&_p=282395861&cid=918218546.1697035760&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAAI&_s=1&sid=1697035759&sct=1&seg=0&dl=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&dt=TCDD%20H%C4%B1zl%C4%B1%20Tren%20Bileti%20Sat%C4%B1%C5%9F%202023%20YHT%20Fiyatlar%C4%B1&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LFKKHQFG5B&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:20 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://hizlitrenbiletisatis.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
351 B 211ms
64ms XHR
text/plain 2a00:1450:400c:c0a::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-32775258-2&cid=918218546.1697035760&jid=99500451&gjid=708614270&_gid=1275344022.1697035760&_u=YEBAAUAAAAAAACAAI~&z=252774977

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0a::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://hizlitrenbiletisatis.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 11 Oct 2023 14:49:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://hizlitrenbiletisatis.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 415 B
613 B 148ms
52ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=hizlitrenbiletisatis.com&callback=_gfp_s_&client=ca-pub-9503319699712926

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310030101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9503319699712926&plah=hizlitrenbiletisatis.com&bust=31078557

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f614bd61bd075edf0d404d4ad101744a06ed0674049e2769e824d84d21974b27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 262
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1BA0 346 KB
80 KB 627ms
626ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&adk=1812271804&adf=3025194257&lmt=1697028560&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=188x675_l%7C188x675_r&format=0x0&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035759492&bpp=15&bdt=2511&idt=619&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=390441101575&frm=20&pv=2&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=664

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6235f3507b8a254505ca262606bfc55d0b46f6c3d52c14a042b118cc16634e17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hizlitrenbiletisatis.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 82110
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 11 Oct 2023 14:49:20 GMT
expires: Wed, 11 Oct 2023 14:49:20 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6B9A 120 KB
40 KB 1347ms
1346ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=280&slotname=5949653418&adk=884195032&adf=1992085446&pi=t.ma~as.5949653418&w=1200&fwrn=4&fwrnh=100&lmt=1697028560&rafmt=1&format=1200x280&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035759507&bpp=2&bdt=2525&idt=657&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=140&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=9TWBZmaFiD&p=https%3A//hizlitrenbiletisatis.com&dtd=672

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5ca25457129f5aaadd68b570e04fc7d92b9117220bcfbff681aaf0e881f926f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hizlitrenbiletisatis.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 41160
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 11 Oct 2023 14:49:21 GMT
expires: Wed, 11 Oct 2023 14:49:21 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310030101/ 156 KB
53 KB 71ms
70ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310030101/reactive_library_fy2021.js?bust=31078557

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a725c7709a5d03c4fd4d925e20647233aa661f22f192882ff960026f1168622d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:20 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54484
x-xss-protection: 0
server: cafe
etag: 13646680337143982291
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 11 Oct 2023 14:49:20 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 122ms
121ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=265984271865981&num=0&dvc=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 608F 122 KB
42 KB 432ms
431ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=280&adk=933129145&adf=264647053&pi=t.aa~a.1127516034~i.6~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1697028560&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=2252401314&ad_type=text_image&format=1200x280&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rh=200&rw=1200&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035760943&bpp=1&bdt=3961&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280&nras=2&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1290&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cN0esWBxRE&p=https%3A//hizlitrenbiletisatis.com&dtd=49

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

82edadf1a4e203c779a869000ff61cefdc08c8d8df630dde045e3fcdb0716021

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hizlitrenbiletisatis.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 42720
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 11 Oct 2023 14:49:21 GMT
expires: Wed, 11 Oct 2023 14:49:21 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 135ms
129ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2642280176513885&num=0&dvc=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 139ms
132ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2642280176513885&num=1&dvc=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 135ms
128ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2642280176513885&num=2&dvc=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 138ms
131ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2642280176513885&num=3&dvc=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 136ms
129ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2642280176513885&num=4&dvc=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 140ms
134ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2642280176513885&num=5&dvc=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 140ms
134ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2642280176513885&num=6&dvc=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 141ms
135ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2642280176513885&num=7&dvc=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 02B2 31 KB
13 KB 460ms
459ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=90&adk=4007679122&adf=1902911653&pi=t.aa~a.2836415199~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1697028561&rafmt=1&to=qs&pwprc=2252401314&format=1200x90&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035761013&bpp=1&bdt=4032&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280%2C1200x280&nras=3&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1923&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ikt1naLgoN&p=https%3A//hizlitrenbiletisatis.com&dtd=10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d42a4ff56dbc7b7d2bcd5fecfa5b6416fdef6a43550a1fefd8f7d93889b8a62f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hizlitrenbiletisatis.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 13215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 11 Oct 2023 14:49:21 GMT
expires: Wed, 11 Oct 2023 14:49:21 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 144ms
143ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_success&c=2&wpc=ca-pub-9503319699712926&warn=13&w=1600&h=1200&pp=0&ppp=0&eatf=false&eatfAbg=true&reatf=true&a=6%2C1%2C5%2C7&apv=20231009_103556&sat=1696980240668&afm=0&as_count=1&d_count=0&ng_count=0&am_count=2&atf_count=1&mdns=0.122&alldns=0.284&allp=14&fd=(0%2C12%2C8)%2C(2%2C1%2C1)&pgh=2289&abl=false&rr=n&su=hizlitrenbiletisatis.com&pvc=777396027689374&r=0.1&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/ Frame 674F 10 KB
4 KB 22ms
22ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hizlitrenbiletisatis.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 86122
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 10 Oct 2023 14:53:59 GMT
etag: 2603938475786422795
expires: Tue, 24 Oct 2023 14:53:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/ Frame 5181 10 KB
4 KB 34ms
29ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hizlitrenbiletisatis.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 86122
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 10 Oct 2023 14:53:59 GMT
etag: 2603938475786422795
expires: Tue, 24 Oct 2023 14:53:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame 674F 4 KB
1 KB 106ms
39ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 11 Oct 2023 14:49:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 11 Oct 2023 13:47:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 11 Oct 2023 14:49:21 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 674F 205 B
296 B 137ms
69ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 01:08:26 GMT
x-content-type-options: nosniff
age: 567655
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 04 Oct 2024 01:08:26 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 674F 604 B
920 B 130ms
64ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 09 Oct 2023 14:55:08 GMT
x-content-type-options: nosniff
age: 172453
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 08 Oct 2024 14:55:08 GMT

GET
H2 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/elements/html/ Frame 674F 15 KB
7 KB 116ms
55ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

729bb9007929a8af5c6f300c99e7c5899043ed1734d39fd6f4e0361b94d1adbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 16:13:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81372
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6551
x-xss-protection: 0
server: cafe
etag: 6101707970674548951
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 24 Oct 2023 16:13:09 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/elements/html/ Frame 674F 20 KB
8 KB 116ms
56ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f8d937ac3c24cd9099dccaeb3e160dba15d6396b7f8ada3ca95f9ef24633aee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 13:39:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4197
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8566
x-xss-protection: 0
server: cafe
etag: 11420928434021954480
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 13:39:24 GMT

GET
H2 200 88cf7d8f92971695aa333eeba8ca195d.js Show response
www.gstatic.com/mysidia/ Frame 5181 9 KB
4 KB 83ms
33ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/88cf7d8f92971695aa333eeba8ca195d.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac4a4d48faf1670dd95aac541fd22c6728ab6528d9fbacfdbd2e58ab5cbc83c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 12:45:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 525837
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3923
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:46:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 03 Jan 2024 12:45:24 GMT

GET
H2 200 e68f8ec74926968a541734be8897a625.js Show response
www.gstatic.com/mysidia/ Frame 5181 36 KB
14 KB 112ms
62ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/e68f8ec74926968a541734be8897a625.js?tag=html5_display_upload/html5_exit_api

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4755a52910466d3bd7b706550f76af98eeb94b7092368df86e6e0c914eff2756

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 03:18:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 559845
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14678
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:46:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 03 Jan 2024 03:18:36 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 5181 2 KB
972 B 75ms
33ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 13:37:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4323
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 13:37:18 GMT

GET
H2 200 ef1f6d24bef59513d7c49e9cf5bba5ca.js Show response
www.gstatic.com/mysidia/ Frame 5181 22 KB
9 KB 95ms
49ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ef1f6d24bef59513d7c49e9cf5bba5ca.js?tag=exit_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

19aaa87c8184f65551d5c44d78d03aa8230d28c7c04d142f731f0fa129fd9cdb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 05:13:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 552964
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9440
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:46:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 03 Jan 2024 05:13:17 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/ Frame 5181 23 KB
9 KB 76ms
36ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0309fd597700b89310de557575438fb73dbee569cf734340057c0884ce91c20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 13:36:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4390
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9151
x-xss-protection: 0
server: cafe
etag: 7930219084593097114
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 13:36:11 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 5181 3 KB
1 KB 74ms
34ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 08:33:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22546
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 08:33:35 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 5181 20 KB
9 KB 70ms
31ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50a61db1134643f3360d0e1ff16c4e48fdf700090052d0fcf9301e95884ae9d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 13:36:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4392
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8339
x-xss-protection: 0
server: cafe
etag: 16954770952846736976
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 13:36:09 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5181 187 KB
59 KB 156ms
58ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab546eb3c1f0d36c9af7d2aac30b3dff73c93691b4bade217df522a260d4b138

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 59959
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1696851335058330"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 11 Oct 2023 14:49:21 GMT

GET
H2 200 f20a2b7dfb9062a0a08db52babdaa11c.js Show response
www.gstatic.com/mysidia/ Frame 5181 37 KB
15 KB 76ms
34ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f20a2b7dfb9062a0a08db52babdaa11c.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9bb40cefe87d2b65103b30be083f0dc8f963f3c930f230d905b811b6eb82f47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 18:09:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 419962
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15586
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:46:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 04 Jan 2024 18:09:59 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 159C 14 KB
1 KB 45ms
42ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 11 Oct 2023 14:49:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 11 Oct 2023 14:21:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 11 Oct 2023 14:49:21 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 159C 2 KB
926 B 42ms
20ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 13:37:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4323
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 13:37:18 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/ Frame 159C 23 KB
9 KB 44ms
22ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0309fd597700b89310de557575438fb73dbee569cf734340057c0884ce91c20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 13:36:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4390
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9151
x-xss-protection: 0
server: cafe
etag: 7930219084593097114
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 13:36:11 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3B76 143 B
166 B 57ms
26ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2463
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 11 Oct 2023 14:08:18 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 159C 3 KB
1 KB 49ms
29ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 08:33:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22546
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 08:33:35 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 159C 20 KB
8 KB 45ms
25ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50a61db1134643f3360d0e1ff16c4e48fdf700090052d0fcf9301e95884ae9d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 13:36:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4392
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8339
x-xss-protection: 0
server: cafe
etag: 16954770952846736976
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 13:36:09 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 159C 187 KB
59 KB 63ms
43ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab546eb3c1f0d36c9af7d2aac30b3dff73c93691b4bade217df522a260d4b138

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 59959
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1696851335058330"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 11 Oct 2023 14:49:21 GMT

GET
H2 200 f20a2b7dfb9062a0a08db52babdaa11c.js Show response
www.gstatic.com/mysidia/ Frame 159C 37 KB
15 KB 55ms
36ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f20a2b7dfb9062a0a08db52babdaa11c.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9bb40cefe87d2b65103b30be083f0dc8f963f3c930f230d905b811b6eb82f47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 18:09:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 419962
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15586
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:46:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 04 Jan 2024 18:09:59 GMT

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/ Frame 4750 10 KB
4 KB 54ms
27ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/e68f8ec74926968a541734be8897a625.js?tag=html5_display_upload/html5_exit_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb877802d3ffbc6b7dd0314a46b48f7747a592dab0a04a223179e1edd8c67318

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 2434
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3025
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Wed, 11 Oct 2023 14:08:47 GMT
expires: Thu, 10 Oct 2024 14:08:47 GMT
last-modified: Fri, 06 Oct 2023 08:09:28 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 5181 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b3c1195df8f1265e23f8d49d65cacf66da91aa583df3d2ba7e48430f0d2ab53e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 608F 4 KB
655 B 36ms
34ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=280&adk=933129145&adf=264647053&pi=t.aa~a.1127516034~i.6~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1697028560&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=2252401314&ad_type=text_image&format=1200x280&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rh=200&rw=1200&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035760943&bpp=1&bdt=3961&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280&nras=2&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1290&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cN0esWBxRE&p=https%3A//hizlitrenbiletisatis.com&dtd=49

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 11 Oct 2023 14:49:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 11 Oct 2023 13:36:00 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 11 Oct 2023 14:49:21 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 608F 2 KB
892 B 29ms
27ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 13:37:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4323
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 13:37:18 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/ Frame 608F 23 KB
9 KB 55ms
54ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0309fd597700b89310de557575438fb73dbee569cf734340057c0884ce91c20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 13:36:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4390
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9151
x-xss-protection: 0
server: cafe
etag: 7930219084593097114
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 13:36:11 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 608F 3 KB
1 KB 57ms
55ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 08:33:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22546
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 08:33:35 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 608F 20 KB
8 KB 30ms
28ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50a61db1134643f3360d0e1ff16c4e48fdf700090052d0fcf9301e95884ae9d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 13:36:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4392
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8339
x-xss-protection: 0
server: cafe
etag: 16954770952846736976
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 13:36:09 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 608F 0
0 155ms
69ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQCBYmefnmJWSZO4heX1QSpsRmPQHKIMoYpoWfAr-OPTz-S7Cfxl_LmzjJ9PFiRsF3-Kfb3-Il8cDF3dGVh8r_hGQlOnw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=280&adk=933129145&adf=264647053&pi=t.aa~a.1127516034~i.6~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1697028560&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=2252401314&ad_type=text_image&format=1200x280&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rh=200&rw=1200&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035760943&bpp=1&bdt=3961&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280&nras=2&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1290&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cN0esWBxRE&p=https%3A//hizlitrenbiletisatis.com&dtd=49
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 608F 187 KB
59 KB 62ms
60ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab546eb3c1f0d36c9af7d2aac30b3dff73c93691b4bade217df522a260d4b138

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 59959
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1696851335058330"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 11 Oct 2023 14:49:21 GMT

GET
H3 200 f20a2b7dfb9062a0a08db52babdaa11c.js Show response
www.gstatic.com/mysidia/ Frame 608F 37 KB
15 KB 57ms
56ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f20a2b7dfb9062a0a08db52babdaa11c.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9bb40cefe87d2b65103b30be083f0dc8f963f3c930f230d905b811b6eb82f47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 18:09:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 419962
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15586
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:46:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 04 Jan 2024 18:09:59 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 5181
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=Cr6ZW8LUmZYniD-7An88Ptu2b2A7Jl5TDc7zVuYnVEdrZHhABINWu7BBgleKTgqAHoAGky7DhA8gBCakCICezlv7FsT6oAwHIA0iqBNoBT9AzhdJOzvu-zP5o1GELs4AmI8AvORIMmeeb5Jq...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%224138171885236683130%22,%22debug_reporting%22:true,%22destination%22:%22https://bahn.de%22,%22event_report_window%22:%22259...

0
0

178ms
96ms

Fetch
text/css

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%224138171885236683130%22,%22debug_reporting%22:true,%22destination%22:%22https://bahn.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%221009526180%22],%224%22:[%2210-11%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225536755255497409793%22}&andc=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:22 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"4138171885236683130","debug_reporting":true,"destination":"https://bahn.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1009526180"],"4":["10-11"],"6":["true"]},"priority":"500","source_event_id":"5536755255497409793"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 11 Oct 2023 14:49:22 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 11 Oct 2023 14:49:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"4138171885236683130","debug_reporting":true,"destination":"https://bahn.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1009526180"],"4":["10-11"],"6":["true"]},"priority":"500","source_event_id":"5536755255497409793"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame 6B9A 4 KB
655 B 69ms
66ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=280&slotname=5949653418&adk=884195032&adf=1992085446&pi=t.ma~as.5949653418&w=1200&fwrn=4&fwrnh=100&lmt=1697028560&rafmt=1&format=1200x280&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035759507&bpp=2&bdt=2525&idt=657&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=140&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=9TWBZmaFiD&p=https%3A//hizlitrenbiletisatis.com&dtd=672

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 11 Oct 2023 14:49:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 11 Oct 2023 14:41:20 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 11 Oct 2023 14:49:21 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 6B9A 2 KB
892 B 24ms
20ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 13:37:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4323
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 13:37:18 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/ Frame 6B9A 23 KB
9 KB 63ms
52ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0309fd597700b89310de557575438fb73dbee569cf734340057c0884ce91c20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 13:36:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4390
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9151
x-xss-protection: 0
server: cafe
etag: 7930219084593097114
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 13:36:11 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 6B9A 3 KB
1 KB 76ms
65ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 08:33:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22546
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 08:33:35 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame 6B9A 20 KB
8 KB 24ms
22ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50a61db1134643f3360d0e1ff16c4e48fdf700090052d0fcf9301e95884ae9d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 13:36:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4392
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8339
x-xss-protection: 0
server: cafe
etag: 16954770952846736976
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 13:36:09 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6B9A 187 KB
59 KB 60ms
58ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab546eb3c1f0d36c9af7d2aac30b3dff73c93691b4bade217df522a260d4b138

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 59959
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1696851335058330"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 11 Oct 2023 14:49:21 GMT

GET
H3 200 ccbada329de78be299cbea1a52c9a584.js Show response
www.gstatic.com/mysidia/ Frame 6B9A 35 KB
14 KB 73ms
62ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ccbada329de78be299cbea1a52c9a584.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

003fffcd4e614a4719da6f886bd221851da79915061393b248af55fe0ddf9476

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 09 Oct 2023 21:16:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 149587
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14787
x-xss-protection: 0
last-modified: Mon, 09 Oct 2023 21:02:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 07 Jan 2024 21:16:14 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame DA97 624 B
245 B 128ms
102ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNWLxjCc0RQMqHWzhDrESMztgsTAc8PqY6WeL8lt-HQBx8YcZ01--aICAhnO0NJIYyWxc4f3taLtj1rz136MT2ef2TLhNAtadkqYfgVxNg-M4xP5oskIDbZTeNaM3nYvQrAZyq8a6Rytv-g3n-rhAffcw928NgYFQRckkbzyFjqJDVBhPaY

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=90&adk=4007679122&adf=1902911653&pi=t.aa~a.2836415199~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1697028561&rafmt=1&to=qs&pwprc=2252401314&format=1200x90&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035761013&bpp=1&bdt=4032&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280%2C1200x280&nras=3&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1923&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ikt1naLgoN&p=https%3A//hizlitrenbiletisatis.com&dtd=10

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=90&adk=4007679122&adf=1902911653&pi=t.aa~a.2836415199~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1697028561&rafmt=1&to=qs&pwprc=2252401314&format=1200x90&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035761013&bpp=1&bdt=4032&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280%2C1200x280&nras=3&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1923&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ikt1naLgoN&p=https%3A//hizlitrenbiletisatis.com&dtd=10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 11 Oct 2023 14:49:21 GMT
expires: Wed, 11 Oct 2023 14:49:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame E9DA 89 KB
31 KB 137ms
136ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:21 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 11 Oct 2023 14:49:21 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame E9DA 3 KB
1 KB 60ms
29ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 08:33:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22546
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 08:33:35 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/ Frame E9DA 20 KB
8 KB 95ms
56ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231004/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50a61db1134643f3360d0e1ff16c4e48fdf700090052d0fcf9301e95884ae9d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 13:36:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4392
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8339
x-xss-protection: 0
server: cafe
etag: 16954770952846736976
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Oct 2023 13:36:09 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame E9DA 0
0 130ms
68ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSFrZ78G5o1X92iR7Xc5dWbkLjX3MAb-6N60u0ss7L79nCYNGYHTwBZf2nqqE50Sgk2G-JGlQXBch7pqAgOgto5xhuzGA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=90&adk=4007679122&adf=1902911653&pi=t.aa~a.2836415199~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1697028561&rafmt=1&to=qs&pwprc=2252401314&format=1200x90&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035761013&bpp=1&bdt=4032&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280%2C1200x280&nras=3&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1923&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ikt1naLgoN&p=https%3A//hizlitrenbiletisatis.com&dtd=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E9DA 187 KB
59 KB 112ms
72ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab546eb3c1f0d36c9af7d2aac30b3dff73c93691b4bade217df522a260d4b138

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 59959
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1696851335058330"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 11 Oct 2023 14:49:21 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E9DA 42 B
63 B 177ms
137ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BOYvgv-mlQuJyk3_qTI5Ca2vQHfbJfDJ9Cu89joYWk3m5o119ES3FLqPHRGf0ztsZAiOYsLIG18WK265Ydk6PpTGBR2077zi1CSgyzV26Fcp2ewqY

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E9DA 0
20 B 162ms
138ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=6356465890994535709&x=1&ct=77

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 4750 6 KB
3 KB 75ms
58ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6f4813e4fe6dd891838e421479bf603f6d3f0d2a55b90517b875a77050471d4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 10:14:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16463
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2551
x-xss-protection: 0
server: cafe
etag: 4618035238173732404
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 12 Oct 2023 10:14:58 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 4750 34 KB
13 KB 81ms
64ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 13:31:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4680
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 12 Oct 2023 13:31:21 GMT

GET
H3 200 junior_bg1.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/ Frame 4750 14 KB
14 KB 39ms
37ms Image
image/jpeg 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/junior_bg1.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78b71b79ae790119f4e33c03c39f582aa0cd2862ec262e0b612bae6f7663aacc

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Wed, 11 Oct 2023 14:08:20 GMT
x-content-type-options: nosniff
age: 2462
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14035
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 08:09:28 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 10 Oct 2024 14:08:20 GMT

GET
H3 200 junior_bg2.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/ Frame 4750 6 KB
6 KB 43ms
39ms Image
image/jpeg 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/junior_bg2.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fec8e17c18093016b75bcc3d62b52f6d758d9a7cae88c857f2c5bc8a82ff649a

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Wed, 11 Oct 2023 14:08:48 GMT
x-content-type-options: nosniff
age: 2434
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5762
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 08:09:28 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 10 Oct 2024 14:08:48 GMT

GET
H3 200 junior_bg3.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/ Frame 4750 2 KB
2 KB 44ms
39ms Image
image/jpeg 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/junior_bg3.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c251ad610dd52a133121c65835dec6963294bd41e776ae4c1076980331c47769

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Wed, 11 Oct 2023 14:08:48 GMT
x-content-type-options: nosniff
age: 2434
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1595
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 08:09:28 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 10 Oct 2024 14:08:48 GMT

GET
H3 200 junior_logo.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/ Frame 4750 3 KB
3 KB 46ms
43ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/junior_logo.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e47228780ee5592a708ceb1fc3c9201715ab77166589661310925555458f3a35

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Wed, 11 Oct 2023 14:08:21 GMT
x-content-type-options: nosniff
age: 2461
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2770
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 08:09:28 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 10 Oct 2024 14:08:21 GMT

GET
H3 200 junior_stoerer.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/ Frame 4750 15 KB
15 KB 48ms
45ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/junior_stoerer.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bed51c15d9b149e50219b406bddaa5a205b8dd8816c465eb20bbaa51e7bff7aa

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Wed, 11 Oct 2023 14:08:48 GMT
x-content-type-options: nosniff
age: 2434
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15017
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 08:09:28 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 10 Oct 2024 14:08:48 GMT

GET
H3 200 junior_cta.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/ Frame 4750 2 KB
2 KB 53ms
50ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/junior_cta.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5727cfaeaec106ad25ff50f9a3c223a041c021a019bb17846fef7993cc49c6a

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Wed, 11 Oct 2023 14:08:48 GMT
x-content-type-options: nosniff
age: 2434
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2013
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 08:09:28 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 10 Oct 2024 14:08:48 GMT

GET
H3 200 junior_txt1.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/ Frame 4750 4 KB
4 KB 49ms
46ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/junior_txt1.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2eecb10987686704a8c7ca6dde3754d3a2de0c6700922d5c2bf0de5c9a865b7a

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Wed, 11 Oct 2023 14:08:48 GMT
x-content-type-options: nosniff
age: 2434
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4101
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 08:09:28 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 10 Oct 2024 14:08:48 GMT

GET
H3 200 junior_txt2.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/ Frame 4750 5 KB
5 KB 46ms
43ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/junior_txt2.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e2d8bbaad11ab9ab4e22f2f444e98fac11bf62e899679d26b96f2da7a152ca1

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Wed, 11 Oct 2023 14:08:48 GMT
x-content-type-options: nosniff
age: 2434
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4806
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 08:09:28 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 10 Oct 2024 14:08:48 GMT

GET
H3 200 junior_txt3.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/ Frame 4750 3 KB
3 KB 46ms
44ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/img/junior_txt3.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de3a29c65cd67216c62d60c69ed9af9fc37b31f7e07e470472b4eaef7f9ca146

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9785351920912614019/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Wed, 11 Oct 2023 14:08:48 GMT
x-content-type-options: nosniff
age: 2434
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2724
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 08:09:28 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 10 Oct 2024 14:08:48 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3D7F 1 KB
643 B 69ms
56ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 58391
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 10 Oct 2023 22:36:10 GMT
etag: 48472445140208031
expires: Wed, 11 Oct 2023 22:36:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/17692704356696115273/ Frame 608F 105 KB
105 KB 70ms
68ms Image
image/jpeg 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17692704356696115273/14763004658117789537

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c0c0c5d0b029b32cf5c81c3b73dd75cb7d0ba56f6d8908342a5ec19ed3dbb8d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 04:16:10 GMT
x-content-type-options: nosniff
age: 469991
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 107544
x-xss-protection: 0
last-modified: Fri, 21 Jul 2023 15:03:42 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 05 Oct 2024 04:16:10 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/4140046757392509342/ Frame 608F 744 B
771 B 72ms
69ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4140046757392509342/14763004658117789537?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b312c55e3afef18f18cf6e7d3e97e7ab879ddf6c72228270a558bc25fd764c49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sat, 07 Oct 2023 05:20:24 GMT
x-content-type-options: nosniff
age: 379737
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 744
x-xss-protection: 0
last-modified: Sun, 26 Jun 2022 00:53:40 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 06 Oct 2024 05:20:24 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 202ms
69ms Preflight
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 11 Oct 2023 14:49:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/8846335869344243167/ Frame 6B9A 52 KB
52 KB 42ms
36ms Image
image/jpeg 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8846335869344243167/14763004658117789537?w=600&h=314

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

02c2596eb2531597968eb78fedfe7dee6f02d6aee8b15bb163156e83540902f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 08 Oct 2023 07:04:56 GMT
x-content-type-options: nosniff
age: 287065
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53451
x-xss-protection: 0
last-modified: Sun, 08 Oct 2023 04:55:04 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 07 Oct 2024 07:04:56 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/2760759756807102382/ Frame 6B9A 1 KB
2 KB 44ms
39ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2760759756807102382/14763004658117789537?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cff79cf3ccb589fe725677915342a1f145677cafc09eb65e31705a01bdec75b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 15:28:25 GMT
x-content-type-options: nosniff
age: 429656
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1532
x-xss-protection: 0
last-modified: Fri, 24 Jun 2022 10:19:12 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 05 Oct 2024 15:28:25 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame DA97
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxguC7Xv8C86KRQomXB1j0&google_cver=1

43 B
337 B

78ms
73ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxguC7Xv8C86KRQomXB1j0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNWLxjCc0RQMqHWzhDrESMztgsTAc8PqY6WeL8lt-HQBx8YcZ01--aICAhnO0NJIYyWxc4f3taLtj1rz136MT2ef2TLhNAtadkqYfgVxNg-M4xP5oskIDbZTeNaM3nYvQrAZyq8a6Rytv-g3n-rhAffcw928NgYFQRckkbzyFjqJDVBhPaY
Protocol: H2
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8Nt7%2BIO%2BaWqG9edKAiKKoIDEsek1WTumWJWG95zXLSnTw2ncNlnpcgKt1xR9cdTtjhJc1%2F2hwXigv6uImSqwsP6om6%2F7NN0JKeAwnhg93ziKt6LdMR%2B2Guka1rAUf8OBI9Vrq2SFlCP2YA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8147e8ca0bce3609-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxguC7Xv8C86KRQomXB1j0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DA97
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZSa18h8U9fqHPksYS11NOAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxguC7Xv8C86KRQomXB1j0&google_cver=1

43 B
772 B

60ms
55ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxguC7Xv8C86KRQomXB1j0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNWLxjCc0RQMqHWzhDrESMztgsTAc8PqY6WeL8lt-HQBx8YcZ01--aICAhnO0NJIYyWxc4f3taLtj1rz136MT2ef2TLhNAtadkqYfgVxNg-M4xP5oskIDbZTeNaM3nYvQrAZyq8a6Rytv-g3n-rhAffcw928NgYFQRckkbzyFjqJDVBhPaY
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q%2F%2FMmrwtsvWvMw96IvI0bdy3ZA7ihhJ0uhru%2Fb3PB0nRUkm5SwD8JexDcoh1M%2F6x4qvD1F6xzG9h7xSz6exGSxJ%2FJsfxeqSDAmO9oQWu4aB%2BvPZXd1Zuxs9qVot7QAkTDlWvJw7zH5pwow%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8147e8cb79d09a0b-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHxguC7Xv8C86KRQomXB1j0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame DA97
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFG-xTbiLALmBXSOb7SQLto&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFG-xTbiLALmBXSOb7SQLto%26google_cver%3D1

43 B
892 B

123ms
121ms

Image
image/gif

68.67.160.186
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFG-xTbiLALmBXSOb7SQLto%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNWLxjCc0RQMqHWzhDrESMztgsTAc8PqY6WeL8lt-HQBx8YcZ01--aICAhnO0NJIYyWxc4f3taLtj1rz136MT2ef2TLhNAtadkqYfgVxNg-M4xP5oskIDbZTeNaM3nYvQrAZyq8a6Rytv-g3n-rhAffcw928NgYFQRckkbzyFjqJDVBhPaY

Protocol

Server

68.67.160.186 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
an-x-request-uuid: f98be4c2-5dc5-4bbe-848c-be52a2df4359
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 217.114.218.21; 217.114.218.21; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
an-x-request-uuid: 82321fa4-3980-4eff-ab75-c56d9084bc25
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFG-xTbiLALmBXSOb7SQLto%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 217.114.218.21; 217.114.218.21; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DA97
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIwNDM0ODEyNzk3MTAxNDQwNA%3D%3D

170 B
188 B

45ms
44ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIwNDM0ODEyNzk3MTAxNDQwNA%3D%3D

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
an-x-request-uuid: 97b14b78-7392-4a1c-b433-04f1bc0f02eb
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIwNDM0ODEyNzk3MTAxNDQwNA%3D%3D
x-proxy-origin: 217.114.218.21; 217.114.218.21; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3B76
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

48ms
42ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 11 Oct 2023 14:49:22 GMT
expires: Wed, 11 Oct 2023 14:49:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 11 Oct 2023 14:49:22 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E9DA 0
20 B 148ms
147ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=504835829368&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E9DA 0
20 B 142ms
140ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=504835829368&version=m202309260101&ct=77&x=1&cor=6356465890994535000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
ad.doubleclick.net/dbm/ Frame E9DA 16 KB
12 KB 191ms
81ms Script
text/javascript 142.250.186.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/dbm/ad?dbm_c=AKAmf-AbQh_jYjm-0Gwf-ieSkeswUWEtfNiPJ69gErNvpFyreYeBk2-LQb39ChsePzf2bP7UtNRwfO90R1qx3453gAegGuziVzAFryqkjvuUTk23i7DDb5QstH6nMtQs1HIFTiwLBOPjoCsYqE8JuGUmG2pf9uCwSznGU8SVbG1PARkSDabrE6A&cry=1&dbm_d=AKAmf-DExXGliVaes_eNZMVEhCt4C036qu_9B65WS2K_ngX3QwQ47HPOSprOFL4CdAb1X-n9zs4rofOGvT6Xmflmc1c0IjcY1UIHkmg5X2cKn7hU6GYPB36_MdLf8GLJN_OybdXnTGe5GZtjeG8vSFENqcXoJRGvMrge41OBdFPzw5lZ2PSIpstKixGobFgsqekDiKFblMyRjpOdiolos5LApX0fMsLEOX5nnohuDyCWT28n02uyDmOYaXAyvAEW-Vbdo-0rouuQj91cPZZNACvOYV6mlhrfA4_rTrmcyfxml040FgRutBTREsg924jRi8nQBw2l1g-G6zjn9sZWMR6U06sK4NuqxHGAM12tfl6_FErtzToPXvZuHoBIzoaPm52EKVDgOOrGUQ21YtkRk1ONxuBNXEetvX2N12g9OxJcFdqxvCKrhvPA_-ap0_ykZi_WgmOj7IVkTzQJqM500ZyjQIMrI_lOSwbn6Vr0CfZxnr2IcmzOWxHmCUNSPaO7NQI_waVZiDBrhDfGVHV1jvQs4zBdWRBiFGGZQW9SP8ezu2zQ3kaLAVrCVCVIUmOMYo30dSElrskchWv5z_aiT4cHmQO9vpaXGOT-vBlHYC_ZtzHtzE78zsArlg7zlzJ91oWvNxVfuXvJ8UEJpxXtMX6L48fUNUcoPrdmLvBr0Y004VG1RS3NmsguY9E_wEMq91h1IC6tTX3_Nmk1DRQbeJ06v-AhY8TdEkvj9DunqKOXk57ZLWecsuyCVPlVxqG5j9scD1RrwME82KVreqFrLr_WoujuJb7DpFfJWe-Tg9GdRoPbNGlX3w1v0jre0B8R7vSNC12rXJpKb6oZWUs42RDBWtu4rWfgZQsuVQbHQFGrngbhaRhm32_6SM_b1tHfHGHneGJ8QReDIdRDygmzFOlekq7WYTbxcjs-eFDrfDhDVZTUsRK75mqfGENOUtPaZubPyOYZygnpmf-Md6qaTHT5Gp1_uLkW1twSG2dGvCY_QKvKB8YI8bEkOLvdfnsnGq4BVFQdiFWYZ1xgnYDZPDVCRbClZVoCjngaegpSME3Et2wAFZdFTGE0rtclvInW5xINCK4WgmYUJOmAsSYH___BxP9CJ6ViAZzkPTvgujRbD657ShNfaoHBdswbXMhLdc58mW45LYCrF2M6i8OtsNUBgkYxOd8yhs3mfH1FpQEWX8Dd3FkzYLqnn6mlGQOAlD-nWRXONWp8o21TmfDvr_V5CVEh9N_qFrKu5qPI_wLhVj7a4WCa50jh7XKnT8JPND13XFLESTASnitbqlRKy9wA_Vr-WAUhXG9oxTSjwLSB1AADcrn-UxlsjdykbpgH370Xm4ZU_oTVQY2i4oeC3tfxfzMY9i1JQXs9txptcwPFGEUc8g2Dvph7L7u00Z0Hc-uT66je5jT-8LWwBCdvhhUkmi3aOCJaN9PkodSuE3XN5Yd61UHE8FXE1o_M2lE554maDwxeG6DQDdVPA0yBsZltJdBzptdNj2CEjpajIVBxAGjjB9itMu3IJCr8VTg7EQBOhkqpOk6Xy8u9SUGBt5DP6wxMo7_wVYaGQnsT1_e4ajZoZ4bRFXZRdYqtk_YA5WaevvyU-PIqRKhyhIJ4dLNeVegZmpWOZesDxVM4wl-Giaw22MMkq5e4tyXLvBw9rnkn64lGjYe2ntWOZJ96YaUFdSwWCu3G2hwABN1V_x-5hlDizbhcPYVaMgkI8A57OhEOltqB9n-ARfWuxN2MgLqTy0FF0WGbGoMDdQqk4zn0yT7456c87QcK9UZGA8tEVqNTsjkec7-4ND_W37fq2WERNI8jFcOFX5djygRFpH5u2J58kZtlY0BwFtptmSBUZ3KKIn0cYyZIrA4C52b6eVj0RH4PFahmlA-wpPbrhX96CPyxQbNFFT97e2tBZ44sGuA-yQZWX77clAI-MuKqiyDh3KV7fHGL6uGG68FKJVwdGYa27IBn6wZijWsZDFDFuejI5M8_PhVK8_qKdFxVVloOHFeGNdcrj1f0OtYwVKyz2R7mZ7PVH_uiwzCJylOq-sHhA7ejTUxWWazkufrGooHG1uovWX0AAMGTaIu8M33nVlH5odQflH4FnlUT6olwTwApMNQMoaSnmRYwN7ZdAgUc483QRQTRo8nra_A4vhGXk-keWcJ9f6blO9jzbhL8K_t6XBExD35e07zqm_BDZ67WDNTrWx1Y3P8vbVM4X00e-xum6SzVVlAv0GgVgkaDdNJ4ua7fCwiyZn7JveSy5KBZxaHpXaF6JAF-qkk-mDhMUIaoO98ZDvyoqi_W0nw_Gs2qMCPDBmMhy3HdkkeRf1AkrilQEQwJNntNWeIiwOIKKE7NwXDGnsKoTXBPpoVmvlEjFkrtatQd5nEpfTzmNqRBPFWb9Dh2MmAtmNKuiCEL191vGW8tOO_iVv875DizfyCH3csPOYrOx7UyNzRvag-Zt51ZiDAI-fMJaR6hKJBqBOJ6lMXA-E62spyzJoLdk3jcR5J1AIprxQp3cFoyXc7KWjSDWuQHm3XFk_0JeBq0cHRmlqvlDGjTlDlGOuEf_bLki7hgsSQQ2cGBXtsh2vUXCNCr_epfwuD-enGHWs1FPJNaGl2HjaML8jhwiULsO7VEY8yTdVplOO1_PqzyK1C8KtOWiT7tcf3h0gR4fbnYQfGlYkOFNsdRNdeY_t31YGUSe0VX91SkmEjUbldm6xj_sy27mjMROb32spgrzsChB00Aq3jp9Md2KimDXcilCiNJfNXwSsYBQ0qIIQLss1Q0VobidK2p7wHvKprzn_2hMmXlCd7sl-T2o0M96VoT9yUUBJNpwOjjc36B3x4OolyQPqFRFX2Rp1E40kN47W6Q_dKZ9lI4prDY_D6rbgrNpD23sSlGKF4vsSHvq-RED9kuyxlrHHdN3VQ1wM-0iv8_PXMxyVCEqe-ThBD7F3ZsAHo-EMgqRP0qWns6CXn9ZlOBnx10W2xksE-E7OwUQCzqv7utjKZtql2D24zyNPl5WdwaTFsDCo9oIqt7dEqdx0wSatGE-tnW7rRVRFEvZufq88cD7YWB2VLeXqbe38h-3yjpEK3_E5cQQEMJFRcDelQICrsW4cNkpY8azkjOr3t_2wtxzuFH8g0IDjfdAqS4RZq2wYLvZSmzaw1hRqrGEeDVCFnVsA6U5ORj6-roV8la2pcTO9oeGYFcbYVbCr7zUCcD_EyU4UryB1iT43sfRUR-ziQGqGIM-E_AU53cpZi0kk1ucG2tqSKW6ZpaZfAT5lUnHxnd3Hu6ZZZcgEx-wH2xdgS7306qoz_O2t3PsWi4HCKUBv1nqE7pjQ6pXrHXNgwvkXGiQzzr5ZtsEi7W1i08U9vaPcsyGl0lWYdSF501drs3ipcNsrTuKTrb2srfQCCrMWRUHk9PEynR1QbSCPLAh2E7r2FFQ-Rmh2mm55lOBtd8mc-Vx6f-YTbLaF12KMhxzjKH3OLrjZuluob-Pe5abWeOyOeNIeC9Mc4a_fJGiZIP8SFBwsGHMncnzpdeXvEY38Z6Wb4Kf-SXE-7qXnh1DIsbprt7tzRTWFSuwQ4Fx45ybGdxoebG8jvqzov7WJPeqh6dbDjFjMWt7HaC8-OBu_T9mMwXVqs2VYJT3rgmNjjQRVaOrV7UMGesf7pb9h7gq3U7BuVibvzC-x1FFKV1o-GxpxCGWHt0q4TNlG0_bJzuBDzar9CJm2GEojJft4Siyb-quJVDZlm3RRxkafzXTOrcLDpAE_D7gDwr9Zf5TAws49jetPHQhmoqqww05ymF0F0ZJtfR0sUOIqwAgCnwBDPR047V8l64vIPm-f5rlwyMBEbFhfCKXAUSFDHwgZW5vzWf5WYmOu60LrbB1OW77FfhszEWoNicsyZlHt3YYtjShJbG9zFmMxnCdzL2Cwlc_jl6HwJSU0NvVXjpd6U-M6SxZp6zHQ&cid=CAQSOwDICaaNxYDYzK8SYCkhlNgeuKiFakMR8WuWUnsj5weIWnAC1geyrPM1XHBqPBDMmSm2Znx_c6TdHBBSGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&ds=l&xdt=1&iif=1&cor=6356465890994535000&adk=1761367587&idt=155&cac=0&dtd=20

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f6.1e100.net

Software

cafe /

Resource Hash

ce606673cbb536ef364b17bccb6f477709a68968e4266aeee5e5b5ba1527fdd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12082
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 608F 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cdc947348a8b6e8c46fb2c46c329dbe52ee19e2c4b43e6bf9c8ad2995af0fdc0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3D7F
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEGiVaaOOC5WpkwuGlnQ-EV4&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEGiVaaOOC5WpkwuGlnQ-EV4&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=V3pqTDRhZVUxUVFBd3k1&google_gid=CAESEGiVaaOOC5WpkwuGlnQ-EV4&google_cver=1&google_push=AXcoOmTiZwIz6KkytarX2Q4HdqW5MZDtwgbltH_AyPl78rL...

170 B
188 B

67ms
66ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=V3pqTDRhZVUxUVFBd3k1&google_gid=CAESEGiVaaOOC5WpkwuGlnQ-EV4&google_cver=1&google_push=AXcoOmTiZwIz6KkytarX2Q4HdqW5MZDtwgbltH_AyPl78rLQxDuObYQ__D3Xj21FGmuGH3_6leY4SRY-EO6Fl5njFVUsAOXAEslzMgk

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 11 Oct 2023 14:49:21 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-790-g2a3fdc2#rel-ec2-master i-0e647d20a74bb4317@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=V3pqTDRhZVUxUVFBd3k1&google_gid=CAESEGiVaaOOC5WpkwuGlnQ-EV4&google_cver=1&google_push=AXcoOmTiZwIz6KkytarX2Q4HdqW5MZDtwgbltH_AyPl78rLQxDuObYQ__D3Xj21FGmuGH3_6leY4SRY-EO6Fl5njFVUsAOXAEslzMgk
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 3D7F 70 B
149 B 210ms
53ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEDaeNN-gxDTKSZmRkD4BFcw&google_cver=1&google_push=AXcoOmSDMlbgPYRz29bdM6t1x-r4EaF37-eRliUr1uSzM2P7oOwd5iFlUjJ2aX9n5F7EnhDsujuYQgOiu1jx1Q20QR3Knn0Tm5slxMM
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=280&adk=933129145&adf=264647053&pi=t.aa~a.1127516034~i.6~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1697028560&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=2252401314&ad_type=text_image&format=1200x280&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rh=200&rw=1200&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035760943&bpp=1&bdt=3961&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280&nras=2&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1290&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cN0esWBxRE&p=https%3A//hizlitrenbiletisatis.com&dtd=49
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:22 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 3D7F 0
173 B 189ms
32ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEEZExbwJKiUCI-gVnL5yBYs&google_cver=1&google_push=AXcoOmSh2rw2fP8l7LB6yGvZ5xl2Kaid4rIQt-6aW5GGiCDLbHTNXNQsJSdyU0jRlN8p7Dx2ly8NiDfdgjdUTx_A-1lwixyFtuv7fRw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=280&adk=933129145&adf=264647053&pi=t.aa~a.1127516034~i.6~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1697028560&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=2252401314&ad_type=text_image&format=1200x280&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rh=200&rw=1200&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035760943&bpp=1&bdt=3961&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280&nras=2&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1290&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cN0esWBxRE&p=https%3A//hizlitrenbiletisatis.com&dtd=49
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:22 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 sync
x.bidswitch.net/ Frame 3D7F 43 B
146 B 184ms
27ms Image
image/gif 3.65.107.250
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEDsLG8MnIzMrSrF9ErxiYXo&google_cver=1&google_push=AXcoOmQnG_8fD5bzt31lFFgksVEqV7jKWTB6CZtmOzk-Q3h8BuoWnMjArPmYGuUkLqGr86VsuB1xVo04c9b47wO2BQ7xN0Od7BDctA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=280&adk=933129145&adf=264647053&pi=t.aa~a.1127516034~i.6~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1697028560&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=2252401314&ad_type=text_image&format=1200x280&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rh=200&rw=1200&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035760943&bpp=1&bdt=3961&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280&nras=2&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1290&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cN0esWBxRE&p=https%3A//hizlitrenbiletisatis.com&dtd=49
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.65.107.250 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-65-107-250.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:22 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3D7F
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECKDbfwQcsuNXtxOFwFwZH0&google_cver=1&google_push=AXcoOmQYXU639-fq6eMu3tY_c3uw-qPIv03WZ-LnUkqKhicTAPJWE3nh5OrIYZepW2cu7Qpem6gFG9NhZonoKfM4lXIsK-i...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQYXU639-fq6eMu3tY_c3uw-qPIv03WZ-LnUkqKhicTAPJWE3nh5OrIYZepW2cu7Qpem6gFG9NhZonoKfM4lXIsK-i2Z_i0Nw&google_hm=eS12VU5GTDM5RTJwRU1V...

170 B
188 B

51ms
50ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQYXU639-fq6eMu3tY_c3uw-qPIv03WZ-LnUkqKhicTAPJWE3nh5OrIYZepW2cu7Qpem6gFG9NhZonoKfM4lXIsK-i2Z_i0Nw&google_hm=eS12VU5GTDM5RTJwRU1VM2FUaVFRVDlsY3AyWGdaWkxuZ35B

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 11 Oct 2023 14:49:22 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQYXU639-fq6eMu3tY_c3uw-qPIv03WZ-LnUkqKhicTAPJWE3nh5OrIYZepW2cu7Qpem6gFG9NhZonoKfM4lXIsK-i2Z_i0Nw&google_hm=eS12VU5GTDM5RTJwRU1VM2FUaVFRVDlsY3AyWGdaWkxuZ35B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 3D7F 43 B
363 B 187ms
32ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmS8ARUwbYbbxL3Z9Cn5YsOgSXaYlxqRNGAKL1CDErt6-GhqSp6Pg1ovkgZyUpqKLgwSmk0T0ZNXMmBuzmTrQt_TOGBXQ0s_rgc&google_gid=CAESEHhTkGPHNInXx0BLuKaYyQs&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 268976
expires: Wed, 11 Oct 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3D7F
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEO_9HTypQ2POsFeMW0DMs_c&google_cver=1&google_push=AXcoOmR_Nh339pf8_-PpxxNra0WA_GvnGV-fLcVdxUbFZQKWHdwNl1HwnY_zP64F-o7DzjpVbD-jeU-y...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEO_9HTypQ2POsFeMW0DMs_c&google_cver=1&google_push=AXcoOmR_Nh339pf8_-PpxxNra0WA_GvnGV-fLcVdxUbFZQKWHdwNl1HwnY_zP64F-o7DzjpVbD-...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTY5NDkwOTc5NTIyNDY1Mzg0Ng&google_push=AXcoOmR_Nh339pf8_-PpxxNra0WA_GvnGV-fLcVdxUbFZQKWHdwNl1HwnY_zP64F-o7DzjpVbD-jeU...

170 B
188 B

48ms
48ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTY5NDkwOTc5NTIyNDY1Mzg0Ng&google_push=AXcoOmR_Nh339pf8_-PpxxNra0WA_GvnGV-fLcVdxUbFZQKWHdwNl1HwnY_zP64F-o7DzjpVbD-jeU-ydcjK75W9BlHELSFY0Q6Tpg

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTY5NDkwOTc5NTIyNDY1Mzg0Ng&google_push=AXcoOmR_Nh339pf8_-PpxxNra0WA_GvnGV-fLcVdxUbFZQKWHdwNl1HwnY_zP64F-o7DzjpVbD-jeU-ydcjK75W9BlHELSFY0Q6Tpg
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 3D7F 0
50 B 81ms
68ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IyasjmQJudURNSCk1fir_6IMTzxwQWxwsF25rp6CQKVN9RH-O9s3t4vI_CpFh3GSGqfiht

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:22 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame 6B9A 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 37aa364f6bc75091a7fe228017b0ca78e0607abf9b0541f03fd1b3323b8062d9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 6B9A 16 KB
16 KB 142ms
51ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 18:20:08 GMT
x-content-type-options: nosniff
age: 505754
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 04 Oct 2024 18:20:08 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 6B9A 12 KB
12 KB 188ms
101ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7f1c829b0c90fd664a03bb714a74f7d35d9e38ee1687104abc8ad5bd9c8ccb6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 00:01:31 GMT
x-content-type-options: nosniff
age: 485271
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11800
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:05 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 05 Oct 2024 00:01:31 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 6B9A 15 KB
15 KB 138ms
52ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 04:06:52 GMT
x-content-type-options: nosniff
age: 470550
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 05 Oct 2024 04:06:52 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 608F 16 KB
16 KB 157ms
70ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 18:20:08 GMT
x-content-type-options: nosniff
age: 505754
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 04 Oct 2024 18:20:08 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 608F 15 KB
15 KB 185ms
99ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 04:06:52 GMT
x-content-type-options: nosniff
age: 470550
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 05 Oct 2024 04:06:52 GMT

GET
H3 200 21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js Show response
pagead2.googlesyndication.com/bg/ Frame 7477 37 KB
14 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db598c4a37dc6643fcb9277b0c0850b6da3ad0fa9adf81b6c39d06a352abf6e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 07:33:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 544574
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14668
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 04 Oct 2024 07:33:08 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E9DA 41 KB
13 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/dbm/ad?dbm_c=AKAmf-AbQh_jYjm-0Gwf-ieSkeswUWEtfNiPJ69gErNvpFyreYeBk2-LQb39ChsePzf2bP7UtNRwfO90R1qx3453gAegGuziVzAFryqkjvuUTk23i7DDb5QstH6nMtQs1HIFTiwLBOPjoCsYqE8JuGUmG2pf9uCwSznGU8SVbG1PARkSDabrE6A&cry=1&dbm_d=AKAmf-DExXGliVaes_eNZMVEhCt4C036qu_9B65WS2K_ngX3QwQ47HPOSprOFL4CdAb1X-n9zs4rofOGvT6Xmflmc1c0IjcY1UIHkmg5X2cKn7hU6GYPB36_MdLf8GLJN_OybdXnTGe5GZtjeG8vSFENqcXoJRGvMrge41OBdFPzw5lZ2PSIpstKixGobFgsqekDiKFblMyRjpOdiolos5LApX0fMsLEOX5nnohuDyCWT28n02uyDmOYaXAyvAEW-Vbdo-0rouuQj91cPZZNACvOYV6mlhrfA4_rTrmcyfxml040FgRutBTREsg924jRi8nQBw2l1g-G6zjn9sZWMR6U06sK4NuqxHGAM12tfl6_FErtzToPXvZuHoBIzoaPm52EKVDgOOrGUQ21YtkRk1ONxuBNXEetvX2N12g9OxJcFdqxvCKrhvPA_-ap0_ykZi_WgmOj7IVkTzQJqM500ZyjQIMrI_lOSwbn6Vr0CfZxnr2IcmzOWxHmCUNSPaO7NQI_waVZiDBrhDfGVHV1jvQs4zBdWRBiFGGZQW9SP8ezu2zQ3kaLAVrCVCVIUmOMYo30dSElrskchWv5z_aiT4cHmQO9vpaXGOT-vBlHYC_ZtzHtzE78zsArlg7zlzJ91oWvNxVfuXvJ8UEJpxXtMX6L48fUNUcoPrdmLvBr0Y004VG1RS3NmsguY9E_wEMq91h1IC6tTX3_Nmk1DRQbeJ06v-AhY8TdEkvj9DunqKOXk57ZLWecsuyCVPlVxqG5j9scD1RrwME82KVreqFrLr_WoujuJb7DpFfJWe-Tg9GdRoPbNGlX3w1v0jre0B8R7vSNC12rXJpKb6oZWUs42RDBWtu4rWfgZQsuVQbHQFGrngbhaRhm32_6SM_b1tHfHGHneGJ8QReDIdRDygmzFOlekq7WYTbxcjs-eFDrfDhDVZTUsRK75mqfGENOUtPaZubPyOYZygnpmf-Md6qaTHT5Gp1_uLkW1twSG2dGvCY_QKvKB8YI8bEkOLvdfnsnGq4BVFQdiFWYZ1xgnYDZPDVCRbClZVoCjngaegpSME3Et2wAFZdFTGE0rtclvInW5xINCK4WgmYUJOmAsSYH___BxP9CJ6ViAZzkPTvgujRbD657ShNfaoHBdswbXMhLdc58mW45LYCrF2M6i8OtsNUBgkYxOd8yhs3mfH1FpQEWX8Dd3FkzYLqnn6mlGQOAlD-nWRXONWp8o21TmfDvr_V5CVEh9N_qFrKu5qPI_wLhVj7a4WCa50jh7XKnT8JPND13XFLESTASnitbqlRKy9wA_Vr-WAUhXG9oxTSjwLSB1AADcrn-UxlsjdykbpgH370Xm4ZU_oTVQY2i4oeC3tfxfzMY9i1JQXs9txptcwPFGEUc8g2Dvph7L7u00Z0Hc-uT66je5jT-8LWwBCdvhhUkmi3aOCJaN9PkodSuE3XN5Yd61UHE8FXE1o_M2lE554maDwxeG6DQDdVPA0yBsZltJdBzptdNj2CEjpajIVBxAGjjB9itMu3IJCr8VTg7EQBOhkqpOk6Xy8u9SUGBt5DP6wxMo7_wVYaGQnsT1_e4ajZoZ4bRFXZRdYqtk_YA5WaevvyU-PIqRKhyhIJ4dLNeVegZmpWOZesDxVM4wl-Giaw22MMkq5e4tyXLvBw9rnkn64lGjYe2ntWOZJ96YaUFdSwWCu3G2hwABN1V_x-5hlDizbhcPYVaMgkI8A57OhEOltqB9n-ARfWuxN2MgLqTy0FF0WGbGoMDdQqk4zn0yT7456c87QcK9UZGA8tEVqNTsjkec7-4ND_W37fq2WERNI8jFcOFX5djygRFpH5u2J58kZtlY0BwFtptmSBUZ3KKIn0cYyZIrA4C52b6eVj0RH4PFahmlA-wpPbrhX96CPyxQbNFFT97e2tBZ44sGuA-yQZWX77clAI-MuKqiyDh3KV7fHGL6uGG68FKJVwdGYa27IBn6wZijWsZDFDFuejI5M8_PhVK8_qKdFxVVloOHFeGNdcrj1f0OtYwVKyz2R7mZ7PVH_uiwzCJylOq-sHhA7ejTUxWWazkufrGooHG1uovWX0AAMGTaIu8M33nVlH5odQflH4FnlUT6olwTwApMNQMoaSnmRYwN7ZdAgUc483QRQTRo8nra_A4vhGXk-keWcJ9f6blO9jzbhL8K_t6XBExD35e07zqm_BDZ67WDNTrWx1Y3P8vbVM4X00e-xum6SzVVlAv0GgVgkaDdNJ4ua7fCwiyZn7JveSy5KBZxaHpXaF6JAF-qkk-mDhMUIaoO98ZDvyoqi_W0nw_Gs2qMCPDBmMhy3HdkkeRf1AkrilQEQwJNntNWeIiwOIKKE7NwXDGnsKoTXBPpoVmvlEjFkrtatQd5nEpfTzmNqRBPFWb9Dh2MmAtmNKuiCEL191vGW8tOO_iVv875DizfyCH3csPOYrOx7UyNzRvag-Zt51ZiDAI-fMJaR6hKJBqBOJ6lMXA-E62spyzJoLdk3jcR5J1AIprxQp3cFoyXc7KWjSDWuQHm3XFk_0JeBq0cHRmlqvlDGjTlDlGOuEf_bLki7hgsSQQ2cGBXtsh2vUXCNCr_epfwuD-enGHWs1FPJNaGl2HjaML8jhwiULsO7VEY8yTdVplOO1_PqzyK1C8KtOWiT7tcf3h0gR4fbnYQfGlYkOFNsdRNdeY_t31YGUSe0VX91SkmEjUbldm6xj_sy27mjMROb32spgrzsChB00Aq3jp9Md2KimDXcilCiNJfNXwSsYBQ0qIIQLss1Q0VobidK2p7wHvKprzn_2hMmXlCd7sl-T2o0M96VoT9yUUBJNpwOjjc36B3x4OolyQPqFRFX2Rp1E40kN47W6Q_dKZ9lI4prDY_D6rbgrNpD23sSlGKF4vsSHvq-RED9kuyxlrHHdN3VQ1wM-0iv8_PXMxyVCEqe-ThBD7F3ZsAHo-EMgqRP0qWns6CXn9ZlOBnx10W2xksE-E7OwUQCzqv7utjKZtql2D24zyNPl5WdwaTFsDCo9oIqt7dEqdx0wSatGE-tnW7rRVRFEvZufq88cD7YWB2VLeXqbe38h-3yjpEK3_E5cQQEMJFRcDelQICrsW4cNkpY8azkjOr3t_2wtxzuFH8g0IDjfdAqS4RZq2wYLvZSmzaw1hRqrGEeDVCFnVsA6U5ORj6-roV8la2pcTO9oeGYFcbYVbCr7zUCcD_EyU4UryB1iT43sfRUR-ziQGqGIM-E_AU53cpZi0kk1ucG2tqSKW6ZpaZfAT5lUnHxnd3Hu6ZZZcgEx-wH2xdgS7306qoz_O2t3PsWi4HCKUBv1nqE7pjQ6pXrHXNgwvkXGiQzzr5ZtsEi7W1i08U9vaPcsyGl0lWYdSF501drs3ipcNsrTuKTrb2srfQCCrMWRUHk9PEynR1QbSCPLAh2E7r2FFQ-Rmh2mm55lOBtd8mc-Vx6f-YTbLaF12KMhxzjKH3OLrjZuluob-Pe5abWeOyOeNIeC9Mc4a_fJGiZIP8SFBwsGHMncnzpdeXvEY38Z6Wb4Kf-SXE-7qXnh1DIsbprt7tzRTWFSuwQ4Fx45ybGdxoebG8jvqzov7WJPeqh6dbDjFjMWt7HaC8-OBu_T9mMwXVqs2VYJT3rgmNjjQRVaOrV7UMGesf7pb9h7gq3U7BuVibvzC-x1FFKV1o-GxpxCGWHt0q4TNlG0_bJzuBDzar9CJm2GEojJft4Siyb-quJVDZlm3RRxkafzXTOrcLDpAE_D7gDwr9Zf5TAws49jetPHQhmoqqww05ymF0F0ZJtfR0sUOIqwAgCnwBDPR047V8l64vIPm-f5rlwyMBEbFhfCKXAUSFDHwgZW5vzWf5WYmOu60LrbB1OW77FfhszEWoNicsyZlHt3YYtjShJbG9zFmMxnCdzL2Cwlc_jl6HwJSU0NvVXjpd6U-M6SxZp6zHQ&cid=CAQSOwDICaaNxYDYzK8SYCkhlNgeuKiFakMR8WuWUnsj5weIWnAC1geyrPM1XHBqPBDMmSm2Znx_c6TdHBBSGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&ds=l&xdt=1&iif=1&cor=6356465890994535000&adk=1761367587&idt=155&cac=0&dtd=20

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 526974
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 04 Oct 2024 12:26:28 GMT

GET
H/1.1 200
OK g72h7lz2c4az Show response
hal9000.redintelligence.net/zone/ Frame E9DA 11 KB
4 KB 148ms
45ms Script
text/html 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=&gdpr_consent=&rnd=1697035761074030&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fad.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvjpY8bUmZa7CBLOi-cAP2LG0mA6m5b2gaYWVnKfJD_AuEAEg1a7sEGCV4pOCoAfIAQmpAiAns5b-xbE-qAMByAObBKoE9wFP0PnNdY25h73oacRrScALoHNz3ctu_lkkxwbaLscpYZx15aVAlvlrFSOtu7_K_KI7s9ttzsjY0gcjuhGhsJV8QuJRdLdOEordKk0IGCxJqOzvSQoieqMhdhJMPY0lZOgicvpWCHsgblHDBgANMkwRLtaaNicmInp5fYSSnSJ3VJxKea6CUFa-IR-JHKrYk-kwFTKxOw8Zeh-QfpF7AqzbnCf_O7JTrIApUmEj_shvHSCk5yAjGegIhH3azDsCz4QCOKsnEYq3iHxFDgmrgfjr6rEIIppTqrFBwx-2opfL_NNYsJV2-wPyjpdtr5kthlhmBuiBRVnpwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB8yAqoCOgKAQEi9_cE6gAoBmAsByAsBgAwBqg0CREXIDQGwE8yc2RLQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26gclid%3DEAIaIQobChMI7v7W7Z7ugQMVM1EeAh3YGA3jEAEYASAAEgJ96_D_BwE%26num%3D1%26cid%3DCAQSOwDICaaNxYDYzK8SYCkhlNgeuKiFakMR8WuWUnsj5weIWnAC1geyrPM1XHBqPBDMmSm2Znx_c6TdHBBSGAE%26sig%3DAOD64_1jg8uL6lxxKSCzRNu9SRuQZDPGYg%26client%3Dca-pub-9503319699712926%26dbm_c%3DAKAmf-CVQXTgA3AKj428V8dufiA0HaVB1-8YBEYzHFiXThwRGwd6CtKBDJqw3jxZ9usSXIaAPWPaOr4qGaOZINY_430HsRzj5X056nY5lZ3pDvKz3o3P3ODn7_981PjnkkgveFD-DVWv1aZzE0uk1BgO92m1uO1RxwnFZLnX6su01Mrrcjl5Uo8%26cry%3D1%26dbm_d%3DAKAmf-A5NwheYPPpypUvDLy_JMFhYEIMGgyPo1p59qGjVo8sGEjDEi2CYZfzIK8vgt9jy-LUQT8L_RDWPqkAIGw3dxAe5IC0aRbziHNy9Lwv0KVaHCA6v-Ek3BX1YYcabt_hamhNeLUzqI-kho1HA0iyW_2krhXusaj4qYPIJnSdmoE4WuyJZ1XYZm5sn0Ij6eq33CED7prQQAIgL8EtIGif1302RC5Lo33HzwG3NaiS8MrAdVDffS0DuOl0kuVlVb5XhjNn_eHsezmc-NJrcqu0Xgj4v1ZGeldT-dHgL1PHHyCTgqSo_0L3ZRmsvdSrWIcqZ7etR4uRvj4XK-RRdzXHcRGNDOAG3_L0fZ7S1SDwFgab0zP4pAGk2xc0w4PjYm_ICMtlnmbt1BlVqVaMbbdhr-6fIGqJbZG0nshsXawiGLl8XpEfzNIpfIC3tKhZQRu6R6OwWytdQ1K0dqy1ukrXSqr8ZE4dNIi1zC8-gCeqHr-6eBCC_8Hoa9f2qZi0N8QRd8h3N2QyCCvZagR7TY8HVatGxXyqpj84qLEwWs4bSC1GyXs5KVupuUthemxKUWQfrbqdyPov%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=90&adk=4007679122&adf=1902911653&pi=t.aa~a.2836415199~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1697028561&rafmt=1&to=qs&pwprc=2252401314&format=1200x90&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035761013&bpp=1&bdt=4032&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280%2C1200x280&nras=3&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1923&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ikt1naLgoN&p=https%3A//hizlitrenbiletisatis.com&dtd=10
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: d57dc1f6c0f182da05b1b34742c0c876afdd8d0dff4491f7da997fd368d1bd96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date: Wed, 11 Oct 2023 14:49:22 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4194
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js Show response
pagead2.googlesyndication.com/bg/ Frame 622B 37 KB
14 KB 62ms
55ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db598c4a37dc6643fcb9277b0c0850b6da3ad0fa9adf81b6c39d06a352abf6e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 07:33:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 544574
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14668
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 04 Oct 2024 07:33:08 GMT

GET
H3 200 21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js Show response
pagead2.googlesyndication.com/bg/ Frame 4750 37 KB
14 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db598c4a37dc6643fcb9277b0c0850b6da3ad0fa9adf81b6c39d06a352abf6e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 07:33:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 544574
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14668
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 04 Oct 2024 07:33:08 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 6B92 22 KB
8 KB 30ms
25ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 457834
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 06 Oct 2023 07:38:48 GMT
expires: Sat, 05 Oct 2024 07:38:48 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 608F
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CW3nn8bUmZazjA8-oiQaG7br4BPXx-qVyuK_Kh6wR6ISUmEMQASDVruwQYJXik4KgB6AB--TfmAPIAQmpAiAns5b-xbE-qAMByAPLBKoE5gFP0HPP0GsWnsk9sZ2aEF0zFfcAk5a_kzfp9gL...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%225927052780835567528%22,%22debug_reporting%22:true,%22destination%22:%22https://enpal.de%22,%22event_report_window%22:%2225...

0
0

86ms
84ms

Fetch
text/css

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%225927052780835567528%22,%22debug_reporting%22:true,%22destination%22:%22https://enpal.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22857207419%22],%224%22:[%2210-11%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%22275719327073111265%22}&andc=true

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:22 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"5927052780835567528","debug_reporting":true,"destination":"https://enpal.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["857207419"],"4":["10-11"],"6":["true"]},"priority":"500","source_event_id":"275719327073111265"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 11 Oct 2023 14:49:22 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 11 Oct 2023 14:49:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"5927052780835567528","debug_reporting":true,"destination":"https://enpal.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["857207419"],"4":["10-11"],"6":["true"]},"priority":"500","source_event_id":"275719327073111265"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js Show response
pagead2.googlesyndication.com/bg/ Frame 72C2 37 KB
14 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db598c4a37dc6643fcb9277b0c0850b6da3ad0fa9adf81b6c39d06a352abf6e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 07:33:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 544574
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14668
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 04 Oct 2024 07:33:08 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 5181 42 B
174 B 142ms
139ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssMAvfFevlivQWHBucLH-PC0o18y34snouLAgdGOuFUAuhN_k8JS0L_kxbsPO7l-Ms-po-15Rtji1zd0nEKbEGM51ecoMfHfUyAAlBx2uH6uo8bZOACl3hSsamLNkh2r2ZTZHaM3ceaU18e&sai=AMfl-YQyX9ENTZQ3rjWCFURIGbTK_7G3_d4gVH0jNsN4B6UDnmfGd5F-4a0yMAY2D44LPEVQ1vBJ1KvBWUPUzpsZKzRZu_bDo8R41sl82Qbqz5_v4tWzvvyVDSLBrYP6c27XriBk1NFHGHHG-kbs&sig=Cg0ArKJSzNZUQ8Enj9v6EAE&cid=CAQSSwDICaaNNDOHryGPF_6gWwlrad1nJf6EgsAE15dvLLFxkr1V0iIIi6uLxlN7vTrnktxobzR4hkTjDyZfy1zV3IjcwENlG1MUwgaKnhgB&id=lidar2&mcvt=1043&p=0,0,124,1005&mtos=295,963,1043,1043,1043&tos=295,668,80,0,0&v=20231009&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697035761157&rpt=486&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

request.php Show response
hal90004.redintelligence.net/ Frame E9DA
Redirect Chain

https://hal90004.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=c8ffbd92cb&subid=&uid=f4c49f48f6e7cc0a&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90004.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=c8ffbd92cb&subid=&uid=f4c49f48f6e7cc0a&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

4 KB
2 KB

282ms
154ms

Script
application/x-javascript

138.201.63.116

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=c8ffbd92cb&subid=&uid=f4c49f48f6e7cc0a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fad.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvjpY8bUmZa7CBLOi-cAP2LG0mA6m5b2gaYWVnKfJD_AuEAEg1a7sEGCV4pOCoAfIAQmpAiAns5b-xbE-qAMByAObBKoE9wFP0PnNdY25h73oacRrScALoHNz3ctu_lkkxwbaLscpYZx15aVAlvlrFSOtu7_K_KI7s9ttzsjY0gcjuhGhsJV8QuJRdLdOEordKk0IGCxJqOzvSQoieqMhdhJMPY0lZOgicvpWCHsgblHDBgANMkwRLtaaNicmInp5fYSSnSJ3VJxKea6CUFa-IR-JHKrYk-kwFTKxOw8Zeh-QfpF7AqzbnCf_O7JTrIApUmEj_shvHSCk5yAjGegIhH3azDsCz4QCOKsnEYq3iHxFDgmrgfjr6rEIIppTqrFBwx-2opfL_NNYsJV2-wPyjpdtr5kthlhmBuiBRVnpwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB8yAqoCOgKAQEi9_cE6gAoBmAsByAsBgAwBqg0CREXIDQGwE8yc2RLQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26gclid%3DEAIaIQobChMI7v7W7Z7ugQMVM1EeAh3YGA3jEAEYASAAEgJ96_D_BwE%26num%3D1%26cid%3DCAQSOwDICaaNxYDYzK8SYCkhlNgeuKiFakMR8WuWUnsj5weIWnAC1geyrPM1XHBqPBDMmSm2Znx_c6TdHBBSGAE%26sig%3DAOD64_1jg8uL6lxxKSCzRNu9SRuQZDPGYg%26client%3Dca-pub-9503319699712926%26dbm_c%3DAKAmf-CVQXTgA3AKj428V8dufiA0HaVB1-8YBEYzHFiXThwRGwd6CtKBDJqw3jxZ9usSXIaAPWPaOr4qGaOZINY_430HsRzj5X056nY5lZ3pDvKz3o3P3ODn7_981PjnkkgveFD-DVWv1aZzE0uk1BgO92m1uO1RxwnFZLnX6su01Mrrcjl5Uo8%26cry%3D1%26dbm_d%3DAKAmf-A5NwheYPPpypUvDLy_JMFhYEIMGgyPo1p59qGjVo8sGEjDEi2CYZfzIK8vgt9jy-LUQT8L_RDWPqkAIGw3dxAe5IC0aRbziHNy9Lwv0KVaHCA6v-Ek3BX1YYcabt_hamhNeLUzqI-kho1HA0iyW_2krhXusaj4qYPIJnSdmoE4WuyJZ1XYZm5sn0Ij6eq33CED7prQQAIgL8EtIGif1302RC5Lo33HzwG3NaiS8MrAdVDffS0DuOl0kuVlVb5XhjNn_eHsezmc-NJrcqu0Xgj4v1ZGeldT-dHgL1PHHyCTgqSo_0L3ZRmsvdSrWIcqZ7etR4uRvj4XK-RRdzXHcRGNDOAG3_L0fZ7S1SDwFgab0zP4pAGk2xc0w4PjYm_ICMtlnmbt1BlVqVaMbbdhr-6fIGqJbZG0nshsXawiGLl8XpEfzNIpfIC3tKhZQRu6R6OwWytdQ1K0dqy1ukrXSqr8ZE4dNIi1zC8-gCeqHr-6eBCC_8Hoa9f2qZi0N8QRd8h3N2QyCCvZagR7TY8HVatGxXyqpj84qLEwWs4bSC1GyXs5KVupuUthemxKUWQfrbqdyPov%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-9503319699712926%26output%3Dhtml%26h%3D90%26adk%3D4007679122%26adf%3D1902911653%26pi%3Dt.aa~a.2836415199~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1697028561%26rafmt%3D1%26to%3Dqs%26pwprc%3D2252401314%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fhizlitrenbiletisatis.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1697035761013%26bpp%3D1%26bdt%3D4032%26idt%3D1%26shv%3Dr20231004%26mjsv%3Dm202310030101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D36f369bc50818345-22fd4bad43df0042%253AT%253D1697035760%253ART%253D1697035760%253AS%253DALNI_MZGzwMz73MJf8FV5SbfdydYad676w%26gpic%3DUID%253D00000da5d61795de%253AT%253D1697035760%253ART%253D1697035760%253AS%253DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw%26prev_fmts%3D0x0%252C1200x280%252C1200x280%26nras%3D3%26correlator%3D390441101575%26frm%3D20%26pv%3D1%26ga_vid%3D918218546.1697035760%26ga_sid%3D1697035760%26ga_hid%3D282395861%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D1923%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C31077327%252C44804783%252C44805099%252C31078297%252C31078557%26oid%3D2%26pvsid%3D777396027689374%26tmod%3D82866107%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D2%26fsb%3D1%26xpc%3Dikt1naLgoN%26p%3Dhttps%253A%2F%2Fhizlitrenbiletisatis.com%26dtd%3D10&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fhizlitrenbiletisatis.com&random=5071629461249&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=90&adk=4007679122&adf=1902911653&pi=t.aa~a.2836415199~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1697028561&rafmt=1&to=qs&pwprc=2252401314&format=1200x90&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035761013&bpp=1&bdt=4032&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280%2C1200x280&nras=3&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1923&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ikt1naLgoN&p=https%3A//hizlitrenbiletisatis.com&dtd=10
Protocol: HTTP/1.1
Server: 138.201.63.116 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 69c30bed085485fd26fd4ba1a3d93820935bb6e2ffb3aa2410b58477f01deeb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 11 Oct 2023 14:49:23 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 34265700073041104444550012474004
Connection: close
Content-Length: 1353
Expires: Wed, 11 Oct 2023 15:49:23 +0200

Redirect headers

Pragma: no-cache
Date: Wed, 11 Oct 2023 14:49:22 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=c8ffbd92cb&subid=&uid=f4c49f48f6e7cc0a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fad.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvjpY8bUmZa7CBLOi-cAP2LG0mA6m5b2gaYWVnKfJD_AuEAEg1a7sEGCV4pOCoAfIAQmpAiAns5b-xbE-qAMByAObBKoE9wFP0PnNdY25h73oacRrScALoHNz3ctu_lkkxwbaLscpYZx15aVAlvlrFSOtu7_K_KI7s9ttzsjY0gcjuhGhsJV8QuJRdLdOEordKk0IGCxJqOzvSQoieqMhdhJMPY0lZOgicvpWCHsgblHDBgANMkwRLtaaNicmInp5fYSSnSJ3VJxKea6CUFa-IR-JHKrYk-kwFTKxOw8Zeh-QfpF7AqzbnCf_O7JTrIApUmEj_shvHSCk5yAjGegIhH3azDsCz4QCOKsnEYq3iHxFDgmrgfjr6rEIIppTqrFBwx-2opfL_NNYsJV2-wPyjpdtr5kthlhmBuiBRVnpwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB8yAqoCOgKAQEi9_cE6gAoBmAsByAsBgAwBqg0CREXIDQGwE8yc2RLQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26gclid%3DEAIaIQobChMI7v7W7Z7ugQMVM1EeAh3YGA3jEAEYASAAEgJ96_D_BwE%26num%3D1%26cid%3DCAQSOwDICaaNxYDYzK8SYCkhlNgeuKiFakMR8WuWUnsj5weIWnAC1geyrPM1XHBqPBDMmSm2Znx_c6TdHBBSGAE%26sig%3DAOD64_1jg8uL6lxxKSCzRNu9SRuQZDPGYg%26client%3Dca-pub-9503319699712926%26dbm_c%3DAKAmf-CVQXTgA3AKj428V8dufiA0HaVB1-8YBEYzHFiXThwRGwd6CtKBDJqw3jxZ9usSXIaAPWPaOr4qGaOZINY_430HsRzj5X056nY5lZ3pDvKz3o3P3ODn7_981PjnkkgveFD-DVWv1aZzE0uk1BgO92m1uO1RxwnFZLnX6su01Mrrcjl5Uo8%26cry%3D1%26dbm_d%3DAKAmf-A5NwheYPPpypUvDLy_JMFhYEIMGgyPo1p59qGjVo8sGEjDEi2CYZfzIK8vgt9jy-LUQT8L_RDWPqkAIGw3dxAe5IC0aRbziHNy9Lwv0KVaHCA6v-Ek3BX1YYcabt_hamhNeLUzqI-kho1HA0iyW_2krhXusaj4qYPIJnSdmoE4WuyJZ1XYZm5sn0Ij6eq33CED7prQQAIgL8EtIGif1302RC5Lo33HzwG3NaiS8MrAdVDffS0DuOl0kuVlVb5XhjNn_eHsezmc-NJrcqu0Xgj4v1ZGeldT-dHgL1PHHyCTgqSo_0L3ZRmsvdSrWIcqZ7etR4uRvj4XK-RRdzXHcRGNDOAG3_L0fZ7S1SDwFgab0zP4pAGk2xc0w4PjYm_ICMtlnmbt1BlVqVaMbbdhr-6fIGqJbZG0nshsXawiGLl8XpEfzNIpfIC3tKhZQRu6R6OwWytdQ1K0dqy1ukrXSqr8ZE4dNIi1zC8-gCeqHr-6eBCC_8Hoa9f2qZi0N8QRd8h3N2QyCCvZagR7TY8HVatGxXyqpj84qLEwWs4bSC1GyXs5KVupuUthemxKUWQfrbqdyPov%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-9503319699712926%26output%3Dhtml%26h%3D90%26adk%3D4007679122%26adf%3D1902911653%26pi%3Dt.aa~a.2836415199~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1697028561%26rafmt%3D1%26to%3Dqs%26pwprc%3D2252401314%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fhizlitrenbiletisatis.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1697035761013%26bpp%3D1%26bdt%3D4032%26idt%3D1%26shv%3Dr20231004%26mjsv%3Dm202310030101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D36f369bc50818345-22fd4bad43df0042%253AT%253D1697035760%253ART%253D1697035760%253AS%253DALNI_MZGzwMz73MJf8FV5SbfdydYad676w%26gpic%3DUID%253D00000da5d61795de%253AT%253D1697035760%253ART%253D1697035760%253AS%253DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw%26prev_fmts%3D0x0%252C1200x280%252C1200x280%26nras%3D3%26correlator%3D390441101575%26frm%3D20%26pv%3D1%26ga_vid%3D918218546.1697035760%26ga_sid%3D1697035760%26ga_hid%3D282395861%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D1923%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C31077327%252C44804783%252C44805099%252C31078297%252C31078557%26oid%3D2%26pvsid%3D777396027689374%26tmod%3D82866107%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D2%26fsb%3D1%26xpc%3Dikt1naLgoN%26p%3Dhttps%253A%2F%2Fhizlitrenbiletisatis.com%26dtd%3D10&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fhizlitrenbiletisatis.com&random=5071629461249&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Wed, 11 Oct 2023 15:49:22 +0200

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 6B9A
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CLcIg8LUmZcfBDpysiQbboqf4DfGaxr1zpb7g_uoRt-mivcABEAEg1a7sEGCV4pOCoAegAc_chKwCyAEJqQLVy2t5T11jPqgDAcgDywSqBOIBT9AB-8ZiMu-fVCyJK31t6nzY0MQA_gXoNuJ...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%223062383837059546945%22,%22debug_reporting%22:true,%22destination%22:%22https://suryapiantalya.com.tr%22,%22event_report_wi...

0
0

100ms
99ms

Fetch
text/css

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%223062383837059546945%22,%22debug_reporting%22:true,%22destination%22:%22https://suryapiantalya.com.tr%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22629222991%22],%224%22:[%2210-11%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%229292214637711986657%22}&andc=true

Requested by

Host: hizlitrenbiletisatis.com
URL: https://hizlitrenbiletisatis.com/

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:22 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"3062383837059546945","debug_reporting":true,"destination":"https://suryapiantalya.com.tr","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["629222991"],"4":["10-11"],"6":["true"]},"priority":"500","source_event_id":"9292214637711986657"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 11 Oct 2023 14:49:22 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 11 Oct 2023 14:49:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"3062383837059546945","debug_reporting":true,"destination":"https://suryapiantalya.com.tr","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["629222991"],"4":["10-11"],"6":["true"]},"priority":"500","source_event_id":"9292214637711986657"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js Show response
pagead2.googlesyndication.com/bg/ Frame 6330 37 KB
14 KB 37ms
29ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db598c4a37dc6643fcb9277b0c0850b6da3ad0fa9adf81b6c39d06a352abf6e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 07:33:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 544574
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14668
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 04 Oct 2024 07:33:08 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 64ms
62ms Preflight
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 11 Oct 2023 14:49:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js Show response
pagead2.googlesyndication.com/bg/ Frame 6B92 37 KB
14 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/21mMSjfcZkP8uSd7DAhQtto60Pqa34G2w50Go1Kr9uE.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db598c4a37dc6643fcb9277b0c0850b6da3ad0fa9adf81b6c39d06a352abf6e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 07:33:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 544574
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14668
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 04 Oct 2024 07:33:08 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 106ms
105ms Preflight
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 11 Oct 2023 14:49:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6B92 0
20 B 170ms
169ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B4pSe8rUmZbbBEOT2x_AP3uy24AsAAAAAOAHgBAI&bg=!mpmlmdbNAAYMG8UMLBs7ADQBe5WfOEPVrwfE8RAmHTVhKMXlIIo6Y3REjkVjodU8sgFEQ2stD4tU9u7ZlbNq1APTEOAaAgAAAINSAAAAC2gBB5kDIXDbAfUL0CxvoThKYBBVpmmKJmLck1QqBHEaVaVxThZjwck2BuphDsmtYJcP1WKs2jmM0AdGWFJwVx2VUolfi-AGN9gWGEPEL51Eet4VbJpY2ulcIDVU9wJMOmDp3zGzcNCIv7IbpLYnhA4VcJv6J0a1MhpD2W588EBg9nX796Kf_46fw4XJLzpcgzB234s8ZIUjACDQPcOvybOBke6O3ke0422MBhtykPItIHRjlVaOTB1NQsv8JwQ3TnXNulbLt4EAEAF9D949Qq86ewbyiH-Bo8fkZxI3XY3GjF4LlPr0llCMejg08j-GUklHxmOQkv0ggt5IrsVGcYwm58X0ag0DPXHmAJt7nkYortFAocQYC3WoFG8nbsiqWn5-ebEnLG1mSyZSfjwxl0c9zlgicWGuYfQ0mbi4wHyEWR7XK5s8qHXK1aqBFT-HUCPxBxe7yyST2BqYjOWnYoTSz7jrcNwHsb1cHm5QSgHWaGe5mMUTPSfFmUyOShPfOHJzoUcvtNcdCXmLm2_tOp30JxbTZQ5B7KzIkxfhv7sVTu4n33sJ3xnZMYmkb9MtigXE-MBf014--6MQBPa_F9eqrZCjaAdzBTfkrkl0ZMbBwmykOhAn1mV6unvCjjtKUbnInDYmvN0NtVGLuzvUaPif4MGtNZsMn4Xfb9PEGAk2U3nDilEl0XLhur56lqlfB5pygijlxlTPouRfVjtaxswzh516oOhMPFzflBjpVsvh4tQvMGyGup-0kcxTiD3sO88pLYP7hPkkNT4zF8bISxH_Tyc4fMMRKpd8pKi8ZnA1nhT3VQ2aBQ6m3ZbN-NV17RMqgphRMvSuig-ioEVoLDYUM6LB66mkmnd1iHvOCnZmJSRLPkHZcWJHiNekXuc1AJ9R4UDMQ5Y-dBABPxUCZqbBj97ZaOQ3uGOrEn1lLvdFdPKuVZanbaKK4VreXd3tAM8YvM0q_0vKYPuno_kgC5ViFLgY9JNIektGwhqBQ-mweZON1ioW_6L-2U4TUtIZqEr_feROCCphs7v64fyU_Aq_YEPK2H-EGWsYXsv1Qe8EFXm1GXzMeg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame 158E 0
466 B 514ms
370ms Document
application/javascript 145.239.193.130

General

Check archive.org

Show headers Download Go to

Full URL

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=34265700073041104444550012474004&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=c8ffbd92cb&subid=&uid=f4c49f48f6e7cc0a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fad.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvjpY8bUmZa7CBLOi-cAP2LG0mA6m5b2gaYWVnKfJD_AuEAEg1a7sEGCV4pOCoAfIAQmpAiAns5b-xbE-qAMByAObBKoE9wFP0PnNdY25h73oacRrScALoHNz3ctu_lkkxwbaLscpYZx15aVAlvlrFSOtu7_K_KI7s9ttzsjY0gcjuhGhsJV8QuJRdLdOEordKk0IGCxJqOzvSQoieqMhdhJMPY0lZOgicvpWCHsgblHDBgANMkwRLtaaNicmInp5fYSSnSJ3VJxKea6CUFa-IR-JHKrYk-kwFTKxOw8Zeh-QfpF7AqzbnCf_O7JTrIApUmEj_shvHSCk5yAjGegIhH3azDsCz4QCOKsnEYq3iHxFDgmrgfjr6rEIIppTqrFBwx-2opfL_NNYsJV2-wPyjpdtr5kthlhmBuiBRVnpwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB8yAqoCOgKAQEi9_cE6gAoBmAsByAsBgAwBqg0CREXIDQGwE8yc2RLQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26gclid%3DEAIaIQobChMI7v7W7Z7ugQMVM1EeAh3YGA3jEAEYASAAEgJ96_D_BwE%26num%3D1%26cid%3DCAQSOwDICaaNxYDYzK8SYCkhlNgeuKiFakMR8WuWUnsj5weIWnAC1geyrPM1XHBqPBDMmSm2Znx_c6TdHBBSGAE%26sig%3DAOD64_1jg8uL6lxxKSCzRNu9SRuQZDPGYg%26client%3Dca-pub-9503319699712926%26dbm_c%3DAKAmf-CVQXTgA3AKj428V8dufiA0HaVB1-8YBEYzHFiXThwRGwd6CtKBDJqw3jxZ9usSXIaAPWPaOr4qGaOZINY_430HsRzj5X056nY5lZ3pDvKz3o3P3ODn7_981PjnkkgveFD-DVWv1aZzE0uk1BgO92m1uO1RxwnFZLnX6su01Mrrcjl5Uo8%26cry%3D1%26dbm_d%3DAKAmf-A5NwheYPPpypUvDLy_JMFhYEIMGgyPo1p59qGjVo8sGEjDEi2CYZfzIK8vgt9jy-LUQT8L_RDWPqkAIGw3dxAe5IC0aRbziHNy9Lwv0KVaHCA6v-Ek3BX1YYcabt_hamhNeLUzqI-kho1HA0iyW_2krhXusaj4qYPIJnSdmoE4WuyJZ1XYZm5sn0Ij6eq33CED7prQQAIgL8EtIGif1302RC5Lo33HzwG3NaiS8MrAdVDffS0DuOl0kuVlVb5XhjNn_eHsezmc-NJrcqu0Xgj4v1ZGeldT-dHgL1PHHyCTgqSo_0L3ZRmsvdSrWIcqZ7etR4uRvj4XK-RRdzXHcRGNDOAG3_L0fZ7S1SDwFgab0zP4pAGk2xc0w4PjYm_ICMtlnmbt1BlVqVaMbbdhr-6fIGqJbZG0nshsXawiGLl8XpEfzNIpfIC3tKhZQRu6R6OwWytdQ1K0dqy1ukrXSqr8ZE4dNIi1zC8-gCeqHr-6eBCC_8Hoa9f2qZi0N8QRd8h3N2QyCCvZagR7TY8HVatGxXyqpj84qLEwWs4bSC1GyXs5KVupuUthemxKUWQfrbqdyPov%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-9503319699712926%26output%3Dhtml%26h%3D90%26adk%3D4007679122%26adf%3D1902911653%26pi%3Dt.aa~a.2836415199~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1697028561%26rafmt%3D1%26to%3Dqs%26pwprc%3D2252401314%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fhizlitrenbiletisatis.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1697035761013%26bpp%3D1%26bdt%3D4032%26idt%3D1%26shv%3Dr20231004%26mjsv%3Dm202310030101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D36f369bc50818345-22fd4bad43df0042%253AT%253D1697035760%253ART%253D1697035760%253AS%253DALNI_MZGzwMz73MJf8FV5SbfdydYad676w%26gpic%3DUID%253D00000da5d61795de%253AT%253D1697035760%253ART%253D1697035760%253AS%253DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw%26prev_fmts%3D0x0%252C1200x280%252C1200x280%26nras%3D3%26correlator%3D390441101575%26frm%3D20%26pv%3D1%26ga_vid%3D918218546.1697035760%26ga_sid%3D1697035760%26ga_hid%3D282395861%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D1923%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C31077327%252C44804783%252C44805099%252C31078297%252C31078557%26oid%3D2%26pvsid%3D777396027689374%26tmod%3D82866107%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D2%26fsb%3D1%26xpc%3Dikt1naLgoN%26p%3Dhttps%253A%2F%2Fhizlitrenbiletisatis.com%26dtd%3D10&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fhizlitrenbiletisatis.com&random=5071629461249&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.239.193.130 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
content-length: 0
content-type: application/javascript; charset=utf-8
date: Wed, 11 Oct 2023 14:49:23 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40028
x-iplb-request-id: D972DA15:ECA6_91EFC182:01BB_6526B5F3_1FD47F5:27FE4

GET
H2 200 / Show response
adv.office-partner.de/ Frame 9322 930 B
931 B 161ms
19ms Document
text/html 2a0b:4d07:101::1

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=c8ffbd92cb&subid=&uid=f4c49f48f6e7cc0a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fad.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvjpY8bUmZa7CBLOi-cAP2LG0mA6m5b2gaYWVnKfJD_AuEAEg1a7sEGCV4pOCoAfIAQmpAiAns5b-xbE-qAMByAObBKoE9wFP0PnNdY25h73oacRrScALoHNz3ctu_lkkxwbaLscpYZx15aVAlvlrFSOtu7_K_KI7s9ttzsjY0gcjuhGhsJV8QuJRdLdOEordKk0IGCxJqOzvSQoieqMhdhJMPY0lZOgicvpWCHsgblHDBgANMkwRLtaaNicmInp5fYSSnSJ3VJxKea6CUFa-IR-JHKrYk-kwFTKxOw8Zeh-QfpF7AqzbnCf_O7JTrIApUmEj_shvHSCk5yAjGegIhH3azDsCz4QCOKsnEYq3iHxFDgmrgfjr6rEIIppTqrFBwx-2opfL_NNYsJV2-wPyjpdtr5kthlhmBuiBRVnpwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB8yAqoCOgKAQEi9_cE6gAoBmAsByAsBgAwBqg0CREXIDQGwE8yc2RLQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26gclid%3DEAIaIQobChMI7v7W7Z7ugQMVM1EeAh3YGA3jEAEYASAAEgJ96_D_BwE%26num%3D1%26cid%3DCAQSOwDICaaNxYDYzK8SYCkhlNgeuKiFakMR8WuWUnsj5weIWnAC1geyrPM1XHBqPBDMmSm2Znx_c6TdHBBSGAE%26sig%3DAOD64_1jg8uL6lxxKSCzRNu9SRuQZDPGYg%26client%3Dca-pub-9503319699712926%26dbm_c%3DAKAmf-CVQXTgA3AKj428V8dufiA0HaVB1-8YBEYzHFiXThwRGwd6CtKBDJqw3jxZ9usSXIaAPWPaOr4qGaOZINY_430HsRzj5X056nY5lZ3pDvKz3o3P3ODn7_981PjnkkgveFD-DVWv1aZzE0uk1BgO92m1uO1RxwnFZLnX6su01Mrrcjl5Uo8%26cry%3D1%26dbm_d%3DAKAmf-A5NwheYPPpypUvDLy_JMFhYEIMGgyPo1p59qGjVo8sGEjDEi2CYZfzIK8vgt9jy-LUQT8L_RDWPqkAIGw3dxAe5IC0aRbziHNy9Lwv0KVaHCA6v-Ek3BX1YYcabt_hamhNeLUzqI-kho1HA0iyW_2krhXusaj4qYPIJnSdmoE4WuyJZ1XYZm5sn0Ij6eq33CED7prQQAIgL8EtIGif1302RC5Lo33HzwG3NaiS8MrAdVDffS0DuOl0kuVlVb5XhjNn_eHsezmc-NJrcqu0Xgj4v1ZGeldT-dHgL1PHHyCTgqSo_0L3ZRmsvdSrWIcqZ7etR4uRvj4XK-RRdzXHcRGNDOAG3_L0fZ7S1SDwFgab0zP4pAGk2xc0w4PjYm_ICMtlnmbt1BlVqVaMbbdhr-6fIGqJbZG0nshsXawiGLl8XpEfzNIpfIC3tKhZQRu6R6OwWytdQ1K0dqy1ukrXSqr8ZE4dNIi1zC8-gCeqHr-6eBCC_8Hoa9f2qZi0N8QRd8h3N2QyCCvZagR7TY8HVatGxXyqpj84qLEwWs4bSC1GyXs5KVupuUthemxKUWQfrbqdyPov%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-9503319699712926%26output%3Dhtml%26h%3D90%26adk%3D4007679122%26adf%3D1902911653%26pi%3Dt.aa~a.2836415199~rp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1697028561%26rafmt%3D1%26to%3Dqs%26pwprc%3D2252401314%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fhizlitrenbiletisatis.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1697035761013%26bpp%3D1%26bdt%3D4032%26idt%3D1%26shv%3Dr20231004%26mjsv%3Dm202310030101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D36f369bc50818345-22fd4bad43df0042%253AT%253D1697035760%253ART%253D1697035760%253AS%253DALNI_MZGzwMz73MJf8FV5SbfdydYad676w%26gpic%3DUID%253D00000da5d61795de%253AT%253D1697035760%253ART%253D1697035760%253AS%253DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw%26prev_fmts%3D0x0%252C1200x280%252C1200x280%26nras%3D3%26correlator%3D390441101575%26frm%3D20%26pv%3D1%26ga_vid%3D918218546.1697035760%26ga_sid%3D1697035760%26ga_hid%3D282395861%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D1923%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C31077327%252C44804783%252C44805099%252C31078297%252C31078557%26oid%3D2%26pvsid%3D777396027689374%26tmod%3D82866107%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D2%26fsb%3D1%26xpc%3Dikt1naLgoN%26p%3Dhttps%253A%2F%2Fhizlitrenbiletisatis.com%26dtd%3D10&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fhizlitrenbiletisatis.com&random=5071629461249&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 -, , ASN (),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Wed, 11 Oct 2023 14:49:23 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Wed, 18 Oct 2023 14:49:23 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame E9DA 0
466 B 518ms
371ms Script
application/javascript 145.239.193.130

General

Check archive.org

Show headers Download Go to

Full URL

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=34265700073041104444550012474004&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.239.193.130 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:23 GMT
strict-transport-security: max-age=15768000
server: nginx
host: pv.medialead.de
x-iplb-request-id: D972DA15:ECA2_91EFC182:01BB_6526B5F3_1FD26E3:27FE5
x-iplb-instance: 40028
vary: Origin
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 0
proxy-host: pv.medialead.de

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame E9DA 43 B
482 B 517ms
368ms Image
image/gif 145.239.193.130

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=34265700073041104444550012474004&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.239.193.130 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:23 GMT
strict-transport-security: max-age=15768000
server: nginx
host: pv.medialead.de
x-iplb-request-id: D972DA15:ECA4_91EFC182:01BB_6526B5F3_1FA19E1:1D8B7
x-iplb-instance: 40027
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 43
proxy-host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame E9DA 43 B
705 B 226ms
88ms Image
image/gif 92.123.148.9

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=34265700073041104444550012474004&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 -, , ASN (),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 11 Oct 2023 14:49:23 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 9322 175 KB
63 KB 53ms
52ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e2755c61fe6c1a6268f7d9c741ed2d678f0fd67c734c62a4c61095bc322990d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:23 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64195
x-xss-protection: 0
last-modified: Wed, 11 Oct 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 11 Oct 2023 14:49:23 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 9322 272 KB
91 KB 67ms
66ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

df08da969ffb2b94cc47fb4bce7b62b92c5bb81a99f0095010530409bbfd73e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:23 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92971
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 11 Oct 2023 14:49:23 GMT

GET
H2 200 link.html Show response
track.webgains.com/ Frame E9DA 2 KB
2 KB 588ms
276ms Script
text/html 18.135.175.58

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=34265700073041104444550012474004&nw=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=90&adk=4007679122&adf=1902911653&pi=t.aa~a.2836415199~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1697028561&rafmt=1&to=qs&pwprc=2252401314&format=1200x90&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035761013&bpp=1&bdt=4032&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280%2C1200x280&nras=3&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1923&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ikt1naLgoN&p=https%3A//hizlitrenbiletisatis.com&dtd=10
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.135.175.58 -, , ASN (),
Reverse DNS
Software: nginx / PHP/7.4.26
Resource Hash: a661b1a8cbd1ec17eff6bc345f48b75eaf3a31e1467029ccd435ee0b7d7e3167

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:24 GMT
last-modified: Wed, 11 Oct 2023 14:49:24 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Wed, 11 Oct 2023 14:50:24 GMT

GET
H2

200

activityi;dc_pre=CNnjk--e7oEDFW9EwgodUUYPGQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5510468895751.816 Show response
5994599.fls.doubleclick.net/ Frame 939B
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5510468895751.816?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CNnjk--e7oEDFW9EwgodUUYPGQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5510468895751.816?

391 B
324 B

615ms
93ms

Document
text/html

142.250.185.134

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CNnjk--e7oEDFW9EwgodUUYPGQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5510468895751.816?

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.134 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

8b37a054737b9f9b9d52d3522d07c9c17535f5d2f369b24ae3fe001077e0f3ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 11 Oct 2023 14:49:24 GMT
expires: Wed, 11 Oct 2023 14:49:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 11 Oct 2023 14:49:24 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CNnjk--e7oEDFW9EwgodUUYPGQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5510468895751.816?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90004.redintelligence.net/ Frame 228E 7 KB
2 KB 178ms
63ms Document
text/html 138.201.63.116

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/request_content.php?s=34265700073041104444550012474004&a=c51ff915
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=90&adk=4007679122&adf=1902911653&pi=t.aa~a.2836415199~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1697028561&rafmt=1&to=qs&pwprc=2252401314&format=1200x90&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035761013&bpp=1&bdt=4032&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280%2C1200x280&nras=3&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1923&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ikt1naLgoN&p=https%3A//hizlitrenbiletisatis.com&dtd=10
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.116 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: bed986eec544a4c285c9fc5ef9931ae74d1e19afcd660dbc48decd20aaf5753a

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2081
Content-Type: text/html; charset=utf-8
Date: Wed, 11 Oct 2023 14:49:23 GMT
Expires: Wed, 11 Oct 2023 15:49:23 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 7382 1 KB
643 B 56ms
50ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 58393
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 10 Oct 2023 22:36:10 GMT
etag: 48472445140208031
expires: Wed, 11 Oct 2023 22:36:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame E9DA 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dddb9f1533df88ecb7c8f1e122cfcaeb5141aeee3538f500567e6bf643ab0882

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6B9A 42 B
64 B 349ms
332ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu-YRxvu_aOx0EFUneerG3VD21orLpiodWNDhjzduvWsrUXADbO2OukO_KeNKZ2FBkyV92-aT1SI1uOKv02oSYRltn30tsR57Rr-QHgiQeloyb-BxU_UUuduMX4Xov8BEBMqfxv0UN80NLW&sai=AMfl-YTN_6H5NqSC_mECuWG2Wsu3QfXXxQT8klRjmmu-jO4OBBT4lUzKBP_3jSuSkzaETGYfBm51Shdndv_oguHpeZ2638NLap5U0eUncqq2z4vBHRgT09ccXUeX1nf8aRqDcZzE8Cysg0XUmOjtUA&sig=Cg0ArKJSzP0iGi6J7YwaEAE&cid=CAQSTADICaaNYewYf53bARHugcTTHEe7W-r1xPrwVwj7F0NY45zgMU_Y4WCY6S_7WwTYKvc0Wf8_GArd5bLXkKSue5YDG9CpaJf0JHC9ex4YAQ&id=lidar2&mcvt=1022&p=0,0,280,1200&mtos=1022,1022,1022,1022,1022&tos=1022,0,0,0,0&v=20231009&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=884195032&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697035760181&rpt=2554&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 228E 2 KB
434 B 211ms
210ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=34265700073041104444550012474004&a=c51ff915

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bf5b911ce6645add415b3dbf40d50dc8cda426f38f5300525bf4793c4131b2c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 11 Oct 2023 14:49:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 11 Oct 2023 14:47:26 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 11 Oct 2023 14:49:24 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 228E 17 KB
17 KB 380ms
79ms Image
image/png 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=34265700073041104444550012474004&a=c51ff915
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 5c9890e24fba9be54dcb4e3d44aa5dc7779f0d95f6b0959b9e09b0b6b53edcb8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date: Wed, 11 Oct 2023 14:49:24 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16984
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 228E 16 KB
16 KB 367ms
68ms Image
image/png 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=34265700073041104444550012474004&a=c51ff915
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: fffd2078493be0435e8920547b3eca3914fa366d875469b387f34e0495af1d06

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date: Wed, 11 Oct 2023 14:49:24 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16514
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 228E 11 KB
11 KB 369ms
70ms Image
image/png 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native2.png
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=34265700073041104444550012474004&a=c51ff915
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: aac6ad0e8e97614a8ce64f1c95e8af91f867772824c7eff0da7e7bc11542c644

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date: Wed, 11 Oct 2023 14:49:24 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10939
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 dpixel
cms.quantserve.com/ Frame 7382 35 B
465 B 803ms
58ms Image
image/gif 2620:116:800d:21:7eb1:3826:be7e:d981

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEBxMx8WuMZDHYr9lYRUG2cg&google_cver=1&google_push=AXcoOmReiCNCdFrE_ZSmOCnsEShjOHuCqQsLiS_0-c5JnBBPLbIK9LkJCoyMPWM-1sra-T8G_mO47dzfnQ1zuKUDFdom4p-tBCn1dA

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:7eb1:3826:be7e:d981 -, , ASN (),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:24 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7382
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEFbFIQ9t5BOxpkE2zf97tYI&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=V3pqTDRhZVUxUVFBd3k1&google_gid=CAESEFbFIQ9t5BOxpkE2zf97tYI&google_cver=1&google_push=AXcoOmQFfIS0kaE1eDk1NFbgHtFwCBk4_Xs9dMUUe4_QRv_...

170 B
188 B

102ms
59ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=V3pqTDRhZVUxUVFBd3k1&google_gid=CAESEFbFIQ9t5BOxpkE2zf97tYI&google_cver=1&google_push=AXcoOmQFfIS0kaE1eDk1NFbgHtFwCBk4_Xs9dMUUe4_QRv_df2mIOEQ1PNQb-ySiKggJVWbRHMEBJPTJuNErpPcnS_Tp1R0arBQY4w

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 11 Oct 2023 14:49:24 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-790-g2a3fdc2#rel-ec2-master i-038ad97d93033251e@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=V3pqTDRhZVUxUVFBd3k1&google_gid=CAESEFbFIQ9t5BOxpkE2zf97tYI&google_cver=1&google_push=AXcoOmQFfIS0kaE1eDk1NFbgHtFwCBk4_Xs9dMUUe4_QRv_df2mIOEQ1PNQb-ySiKggJVWbRHMEBJPTJuNErpPcnS_Tp1R0arBQY4w
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7382
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEKAnSa8GKdK7FeBQCV65hg8&google_cver=1&google_push=AXcoOmT5KFf5ttwyNFZHaxmy1GW8Y4LX5PtKTkrbLRzWlNStqiDouU5VlARrnTB6Gv1FP4TcJJmmWWm7auNgiOutPFswOpKN9mxd6g
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=1B4AA6C9032C49BCB08ACC2D7EAC04FE&google_push=AXcoOmT5KFf5ttwyNFZHaxmy1GW8Y4LX5PtKTkrbLRzWlNStqiDouU5VlARrnTB6Gv1FP4TcJJmmWWm7auNgiOu...

170 B
188 B

66ms
62ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=1B4AA6C9032C49BCB08ACC2D7EAC04FE&google_push=AXcoOmT5KFf5ttwyNFZHaxmy1GW8Y4LX5PtKTkrbLRzWlNStqiDouU5VlARrnTB6Gv1FP4TcJJmmWWm7auNgiOutPFswOpKN9mxd6g

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 11 Oct 2023 14:49:24 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=1B4AA6C9032C49BCB08ACC2D7EAC04FE&google_push=AXcoOmT5KFf5ttwyNFZHaxmy1GW8Y4LX5PtKTkrbLRzWlNStqiDouU5VlARrnTB6Gv1FP4TcJJmmWWm7auNgiOutPFswOpKN9mxd6g
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 10 Oct 2023 14:49:24 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 7382 70 B
148 B 166ms
160ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEP7JESb4rO6VCU4TTz9FOf8&google_cver=1&google_push=AXcoOmS6c0WdjCBqkdioTaqkzNDYvmnGC1os2Sj3mKafudZRu2l9tbxp6ygkqHjBBhM8qzYcrUnfl0pJjNv3BRuFIFx8D1md8Kd6vQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=90&adk=4007679122&adf=1902911653&pi=t.aa~a.2836415199~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1697028561&rafmt=1&to=qs&pwprc=2252401314&format=1200x90&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035761013&bpp=1&bdt=4032&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280%2C1200x280&nras=3&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1923&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ikt1naLgoN&p=https%3A//hizlitrenbiletisatis.com&dtd=10
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:24 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7382
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEE-R5lqd-G7sx2E4eLNcLnM&google_cver=1&google_push=AXcoOmQW7iNTM2pVD-yqPJDZBLCSktfkxZQeadvg1Rg5VD7jtH7r3VD_NGWHPP_ZcbPwGZV2jrMtGQ1w-abIV4j_...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=URdjU_-aQ4s2yZGvxHmuZg&google_push=AXcoOmQW7iNTM2pVD-yqPJDZBLCSktfkxZQeadvg1Rg5VD7jtH7r3VD_NGWHPP_ZcbPwGZV2jrMtGQ1w-abIV4j_EvHTSpgQq_YbMA

170 B
188 B

67ms
63ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=URdjU_-aQ4s2yZGvxHmuZg&google_push=AXcoOmQW7iNTM2pVD-yqPJDZBLCSktfkxZQeadvg1Rg5VD7jtH7r3VD_NGWHPP_ZcbPwGZV2jrMtGQ1w-abIV4j_EvHTSpgQq_YbMA

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 11 Oct 2023 14:49:24 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=URdjU_-aQ4s2yZGvxHmuZg&google_push=AXcoOmQW7iNTM2pVD-yqPJDZBLCSktfkxZQeadvg1Rg5VD7jtH7r3VD_NGWHPP_ZcbPwGZV2jrMtGQ1w-abIV4j_EvHTSpgQq_YbMA
x-host: tde-deliveryengine-production-69fbf984b9-dw9qq
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 7382 43 B
362 B 161ms
156ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmSm4fO4OuGbBiAkNrhYsqXkOtbYNO59RDUbtlQKsEv-KJgYH9N9i0YfjknQUhqd9AOsS_5oU_GqEXBajV4gkphvkw6QHn8Riw&google_gid=CAESEFKEt2LHpL-iX7-10M5H30E&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:23 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 262262
expires: Wed, 11 Oct 2023 00:00:00 GMT

GET googleredir
googlecm.hit.gemius.pl/ Frame 7382 0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 7382 0
12 B 192ms
188ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JpOLx46ewclPGkdk7lE9zwqxEZ0cKzfic84VSbbwPvMUxZgwm48Z0YW_jPiRp1VXWWlimC9Q

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:24 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK viewability Show response
hal90004.redintelligence.net/ Frame 228E 0
150 B 209ms
59ms Script
text/html 138.201.63.116

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/viewability?s=34265700073041104444550012474004&a=bbaec795&vb=m
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=34265700073041104444550012474004&a=c51ff915
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.116 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/request_content.php?s=34265700073041104444550012474004&a=c51ff915
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date: Wed, 11 Oct 2023 14:49:24 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame E9DA 52 KB
18 KB 570ms
52ms Script
text/javascript 18.66.122.12

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=34265700073041104444550012474004&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.12 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 761cff5428e8aa5d947284cdaa6d9f6e9d0fe755909c364f807ee5c23ddb8dcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 10:03:46 GMT
content-encoding: gzip
via: 1.1 109c7a7f1cf897851e09b16d3030a948.cloudfront.net (CloudFront)
last-modified: Mon, 02 Oct 2023 14:06:37 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 17139
etag: W/"2c13a74e288a2942ad3d2af9bad52cdf"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: LeCpObI2p_hXrfyta24Q6X-GKsqjetRw2rOpq0JorQC6Blf7rfGfdA==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame E9DA 85 B
437 B 563ms
60ms Image
image/gif 99.86.4.94

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1697036064&Signature=h-wBVvlM3-w~2LoTZlq9UTuxT2u0OuuRp0i~XAcnmuByReGUWbhgMji3B~3XmVCkwl2u6Q9IBWEG8pN1jdf1N2DQc7iEryFvPuofqVZQMiHPFYQQd9~zo8u0UiEYaR-zU3Jpm~8dt44K68NugeWAjBpWJbh-hIdqTYuJo8X79gw4sxCGwqJnUbwkTynYzNf5uXzg1H9m7ytS-mVhD4~v7tQRmuwAP6lI~p9ytkI6lFN-c2fEGA20n-uQ5iA5es16yRif1IfBVl88zuNzWeeTE-ZQ~j6qjh47mah4CZfYPBLdVhZqDNXgKkXqo69eHT9~X5rvKFPhprsgP5ih7RX-uA__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9503319699712926&output=html&h=90&adk=4007679122&adf=1902911653&pi=t.aa~a.2836415199~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1697028561&rafmt=1&to=qs&pwprc=2252401314&format=1200x90&url=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1697035761013&bpp=1&bdt=4032&idt=1&shv=r20231004&mjsv=m202310030101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D36f369bc50818345-22fd4bad43df0042%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_MZGzwMz73MJf8FV5SbfdydYad676w&gpic=UID%3D00000da5d61795de%3AT%3D1697035760%3ART%3D1697035760%3AS%3DALNI_Mb4OKmxSEuuy8ahVu9hkgkrfpKYQw&prev_fmts=0x0%2C1200x280%2C1200x280&nras=3&correlator=390441101575&frm=20&pv=1&ga_vid=918218546.1697035760&ga_sid=1697035760&ga_hid=282395861&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1923&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31077327%2C44804783%2C44805099%2C31078297%2C31078557&oid=2&pvsid=777396027689374&tmod=82866107&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=ikt1naLgoN&p=https%3A//hizlitrenbiletisatis.com&dtd=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.94 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-amz-version-id: null
date: Wed, 11 Oct 2023 03:46:10 GMT
via: 1.1 35c75b7f0ca8c787d67c8ebd22bc7fc2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 39808
etag: "70af33d70b6810475aae19743c8c435b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: ziH6PEZFB7HbotQ45rOoK-mjBCVbCU444p6KGxxWpTi70UjsQdjywg==

GET
H2 200 dc_pre=CNnjk--e7oEDFW9EwgodUUYPGQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5510468895751.816
adservice.google.com/ddm/fls/z/ Frame 939B 42 B
401 B 190ms
89ms Image
image/gif 2a00:1450:4001:80f::2002

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CNnjk--e7oEDFW9EwgodUUYPGQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5510468895751.816

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CNnjk--e7oEDFW9EwgodUUYPGQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5510468895751.816?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 114ms
111ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231004&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

99b8b9b7c1e27c76d3ad4bbf63ecc0d6e941396b73d74e6630696b5924821694

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12260
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 32ms
31ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hizlitrenbiletisatis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 11 Oct 2023 14:49:25 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 34D9 13 KB
5 KB 29ms
24ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hizlitrenbiletisatis.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 191935
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 09 Oct 2023 09:30:30 GMT
expires: Tue, 08 Oct 2024 09:30:30 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame ACAA 829 B
562 B 52ms
51ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

79977cbb7685dc6d82777a64de55010e485c329b4e4f757370ecd45cada1d579

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-HFYn8yRj8PSNBLzBMoSFUQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://hizlitrenbiletisatis.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-HFYn8yRj8PSNBLzBMoSFUQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 11 Oct 2023 14:49:25 GMT
expires: Wed, 11 Oct 2023 14:49:25 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 YeTNF82ErcXtSc42GSWrie2SEIEL8DxR64dbf1nZkSc.js Show response
pagead2.googlesyndication.com/bg/ Frame 34D9 37 KB
14 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YeTNF82ErcXtSc42GSWrie2SEIEL8DxR64dbf1nZkSc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61e4cd17cd84adc5ed49ce361925ab89ed9210810bf03c51eb875b7f59d99127

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 12:29:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8388
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14663
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 10 Oct 2024 12:29:37 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame ACAA 0
0 148ms
148ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231004&jk=777396027689374&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

POST
H2 200 tracking-event
api.webgains.io/ Frame E9DA 16 B
209 B 98ms
98ms Fetch
application/json 52.56.171.192

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.56.171.192 -, , ASN (),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 11 Oct 2023 14:49:26 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 34D9 0
12 B 21ms
21ms Image
text/plain 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?8_qZAg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 11 Oct 2023 14:49:25 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E9DA 0
20 B 123ms
123ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=504835829368&version=m202309260101&ct=77&x=1&cor=6356465890994535000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Oct 2023 14:49:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 398ms
69ms Preflight 52.56.171.192

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.56.171.192 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Wed, 11 Oct 2023 14:49:26 GMT
server: nginx

POST collect
region1.google-analytics.com/g/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: googlecm.hit.gemius.pl
URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEJZUfL-1xyMR_92lGhK7p_w&google_cver=1&google_push=AXcoOmSwKnybsK58aDaOVFBqdFg8v-6rdvOrQJ_eJHazVCRrTqq_do9JArgjqRNii2UEUbRulEq_s0TYdet-DXk0nKLU4uTZgf0TRQ

Domain: region1.google-analytics.com
URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-LFKKHQFG5B&gtm=45je3a90&_p=282395861&cid=918218546.1697035760&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEII&sid=1697035759&sct=1&seg=0&dl=https%3A%2F%2Fhizlitrenbiletisatis.com%2F&dt=TCDD%20H%C4%B1zl%C4%B1%20Tren%20Bileti%20Sat%C4%B1%C5%9F%202023%20YHT%20Fiyatlar%C4%B1&_s=2

Verdicts & Comments Add Verdict or Comment

46 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

26 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
hizlitrenbiletisatis.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: gi5famsd6u25d0uca6ajgvlj1j
.hizlitrenbiletisatis.com/	1970-01-20 15:25:22	Name: _gid Value: GA1.2.1275344022.1697035760
.hizlitrenbiletisatis.com/	1970-01-20 15:23:55	Name: _gat_gtag_UA_32775258_2 Value: 1
.hizlitrenbiletisatis.com/	1970-01-21 00:59:55	Name: _ga Value: GA1.1.918218546.1697035760
.hizlitrenbiletisatis.com/	1970-01-21 00:45:31	Name: __gads Value: ID=66719545732c905a:T=1697035760:RT=1697035760:S=ALNI_MYonHzKYGHRxnYRaYIB4M21s_oQKQ
.hizlitrenbiletisatis.com/	1970-01-21 00:45:31	Name: __gpi Value: UID=00000c94d116e2e7:T=1697035760:RT=1697035760:S=ALNI_MbjzuZoy5UUHU9y8ObxhjDKe5f6Og
.doubleclick.net/	1970-01-21 00:45:31	Name: IDE Value: AHWqTUlLEmYljYBCgSsGAEMz-4RagE99MyP99ttpwYPaDF5SYfhz10iz-78WbeV-BwY
.casalemedia.com/	1970-01-21 00:09:31	Name: CMID Value: ZSa18h8U9fqHPksYS11NOAAA
.casalemedia.com/	1970-01-20 17:33:31	Name: CMPS Value: 3273
.casalemedia.com/	1970-01-20 17:33:31	Name: CMPRO Value: 3273
.doubleclick.net/	1970-01-20 15:23:59	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-20 19:43:07	Name: APC Value: AfxxVi6Nnx8YuN0rqx-zRjYRkKOI5EIVE2gIEtU5FynJItBbfzwl1Q
.googleadservices.com/	1970-01-20 17:33:31	Name: ar_debug Value: 1
.blismedia.com/	1970-01-21 00:09:35	Name: b Value: 6526B5F226DD02A752850EE9BLIS
.w55c.net/	1970-01-21 00:55:36	Name: wfivefivec Value: WzjL4aeU1QQAwy5
.adform.net/	1970-01-20 16:08:34	Name: C Value: 1
.yahoo.com/	1970-01-21 00:09:53	Name: A3 Value: d=AQABBPK1JmUCEODFCRE6sVINXbMpHKaaXAoFEgEBAQEHKGUwZQAAAAAA_eMAAA&S=AQAAAn1xFFCEXuriGU7o4RbeiA0
.adnxs.com/	1970-01-20 17:33:31	Name: uuid2 Value: 5204348127971014404
.w55c.net/	1970-01-20 16:07:07	Name: matchgoogle Value: 5
.adform.net/	1970-01-20 16:50:19	Name: uid Value: 1694909795224653846
.adnxs.com/	1970-01-20 17:33:31	Name: anj Value: dTM7k!M41.D>6NRF']wIg2In5vYW?'!]tbPl1M>e)ZlrFUfJ+tGXxp2b8G(1?TtQQ>XiZf^cdlbI4kzzc?0^z_[AE)3If)y3KL9D3I?+dVmq+-
.redintelligence.net/	1970-01-20 17:33:31	Name: 8lcfmzhxc8d6_uid Value: a71565af97657226
.awin1.com/	1970-01-20 15:34:00	Name: awpv11601 Value: 113440\|1697035763\|5dfcba20-6845-11ee-b483-223780762ed7
.awin1.com/	1969-12-31 23:59:59	Name: AWSESS Value: 357526:3266505
.office-partner.de/	1970-01-21 00:59:55	Name: source Value: {"webgains_webgains":{"timestamp":1697035763544,"clickCookie":false}}
.hizlitrenbiletisatis.com/	1970-01-21 00:59:55	Name: _ga_LFKKHQFG5B Value: GS1.1.1697035759.1.0.1697035763.0.0.0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5994599.fls.doubleclick.net
ad.doubleclick.net
ads.travelaudience.com
adservice.google.com
adv.office-partner.de
analytics.webgains.io
api.webgains.io
c1.adform.net
cdn.track.production.webgains.team
cm.g.doubleclick.net
cms.quantserve.com
dis.criteo.com
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googlecm.hit.gemius.pl
hal9000.redintelligence.net
hal90004.redintelligence.net
hizlitrenbiletisatis.com
ib.adnxs.com
match.adsrvr.org
pagead2.googlesyndication.com
partner.googleadservices.com
pm.w55c.net
pr-bh.ybp.yahoo.com
pv.medialead.de
region1.google-analytics.com
stats.g.doubleclick.net
tpc.googlesyndication.com
tr.blismedia.com
track.webgains.com
um.simpli.fi
www.awin1.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
googlecm.hit.gemius.pl
region1.google-analytics.com
104.18.26.193
138.201.63.116
142.250.185.134
142.250.185.98
142.250.186.38
145.239.193.130
172.217.16.194
178.250.1.9
18.135.175.58
18.66.122.12
185.216.113.60
2001:4860:4802:32::36
2620:116:800d:21:7eb1:3826:be7e:d981
2a00:1450:4001:800::200a
2a00:1450:4001:806::2001
2a00:1450:4001:808::200e
2a00:1450:4001:809::2003
2a00:1450:4001:80f::2002
2a00:1450:4001:813::2002
2a00:1450:4001:813::2008
2a00:1450:4001:828::2002
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::2003
2a00:1450:4001:82b::2004
2a00:1450:4001:830::2002
2a00:1450:400c:c0a::9b
2a05:d018:d29:3602:77fc:3cf3:5701:3122
2a0b:4d07:101::1
3.126.78.53
3.65.107.250
34.96.105.8
35.190.0.66
35.204.74.118
35.71.131.137
37.157.6.237
46.4.10.49
52.56.171.192
68.67.160.186
92.123.148.9
99.86.4.94
003fffcd4e614a4719da6f886bd221851da79915061393b248af55fe0ddf9476
02c2596eb2531597968eb78fedfe7dee6f02d6aee8b15bb163156e83540902f0
041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51
08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0e2d8bbaad11ab9ab4e22f2f444e98fac11bf62e899679d26b96f2da7a152ca1
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
172f1d0631af65a71f1c84c7cb6737058a9e7133e23573ee84102f75e4f87b61
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
19aaa87c8184f65551d5c44d78d03aa8230d28c7c04d142f731f0fa129fd9cdb
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2eecb10987686704a8c7ca6dde3754d3a2de0c6700922d5c2bf0de5c9a865b7a
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
37aa364f6bc75091a7fe228017b0ca78e0607abf9b0541f03fd1b3323b8062d9
384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7
3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280
3af6f2f6faafb2b524d44723591d3598b88e09c4668a83a5deab02b93416cc7e
454b60927b9163b1e8c3f715ef77eac0616b48c8440f0f32a61876a04dbb25ea
4755a52910466d3bd7b706550f76af98eeb94b7092368df86e6e0c914eff2756
49b294716e336dbc654131cde9cd0f23941b3193e64f04019118c188113de0fc
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50a61db1134643f3360d0e1ff16c4e48fdf700090052d0fcf9301e95884ae9d9
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5c9890e24fba9be54dcb4e3d44aa5dc7779f0d95f6b0959b9e09b0b6b53edcb8
5ca25457129f5aaadd68b570e04fc7d92b9117220bcfbff681aaf0e881f926f2
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
61e4cd17cd84adc5ed49ce361925ab89ed9210810bf03c51eb875b7f59d99127
6235f3507b8a254505ca262606bfc55d0b46f6c3d52c14a042b118cc16634e17
662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33
69c30bed085485fd26fd4ba1a3d93820935bb6e2ffb3aa2410b58477f01deeb7
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc
6f4813e4fe6dd891838e421479bf603f6d3f0d2a55b90517b875a77050471d4b
729bb9007929a8af5c6f300c99e7c5899043ed1734d39fd6f4e0361b94d1adbc
761cff5428e8aa5d947284cdaa6d9f6e9d0fe755909c364f807ee5c23ddb8dcd
777bee19cd171a780de1b42ebcf5c63dae897faf69b750ce65d324f4d68f9270
78b71b79ae790119f4e33c03c39f582aa0cd2862ec262e0b612bae6f7663aacc
794051fd3bf99ded63ae9d9eeb32f4f86fe11711e0621453495da61d5ce2ca23
79977cbb7685dc6d82777a64de55010e485c329b4e4f757370ecd45cada1d579
7f1c829b0c90fd664a03bb714a74f7d35d9e38ee1687104abc8ad5bd9c8ccb6c
7f8d937ac3c24cd9099dccaeb3e160dba15d6396b7f8ada3ca95f9ef24633aee
82edadf1a4e203c779a869000ff61cefdc08c8d8df630dde045e3fcdb0716021
8b37a054737b9f9b9d52d3522d07c9c17535f5d2f369b24ae3fe001077e0f3ef
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
99b8b9b7c1e27c76d3ad4bbf63ecc0d6e941396b73d74e6630696b5924821694
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a5727cfaeaec106ad25ff50f9a3c223a041c021a019bb17846fef7993cc49c6a
a661b1a8cbd1ec17eff6bc345f48b75eaf3a31e1467029ccd435ee0b7d7e3167
a725c7709a5d03c4fd4d925e20647233aa661f22f192882ff960026f1168622d
a98edd99a102f9b0de155a7fccae56553ecb454c6dcefb977dda6c4b905581be
aac6ad0e8e97614a8ce64f1c95e8af91f867772824c7eff0da7e7bc11542c644
aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed
ab546eb3c1f0d36c9af7d2aac30b3dff73c93691b4bade217df522a260d4b138
ac4a4d48faf1670dd95aac541fd22c6728ab6528d9fbacfdbd2e58ab5cbc83c8
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b312c55e3afef18f18cf6e7d3e97e7ab879ddf6c72228270a558bc25fd764c49
b3c1195df8f1265e23f8d49d65cacf66da91aa583df3d2ba7e48430f0d2ab53e
bb877802d3ffbc6b7dd0314a46b48f7747a592dab0a04a223179e1edd8c67318
bed51c15d9b149e50219b406bddaa5a205b8dd8816c465eb20bbaa51e7bff7aa
bed986eec544a4c285c9fc5ef9931ae74d1e19afcd660dbc48decd20aaf5753a
bf5b911ce6645add415b3dbf40d50dc8cda426f38f5300525bf4793c4131b2c2
c0c0c5d0b029b32cf5c81c3b73dd75cb7d0ba56f6d8908342a5ec19ed3dbb8d0
c251ad610dd52a133121c65835dec6963294bd41e776ae4c1076980331c47769
c9bb40cefe87d2b65103b30be083f0dc8f963f3c930f230d905b811b6eb82f47
cdc947348a8b6e8c46fb2c46c329dbe52ee19e2c4b43e6bf9c8ad2995af0fdc0
ce606673cbb536ef364b17bccb6f477709a68968e4266aeee5e5b5ba1527fdd9
cff79cf3ccb589fe725677915342a1f145677cafc09eb65e31705a01bdec75b2
d42a4ff56dbc7b7d2bcd5fecfa5b6416fdef6a43550a1fefd8f7d93889b8a62f
d57dc1f6c0f182da05b1b34742c0c876afdd8d0dff4491f7da997fd368d1bd96
db598c4a37dc6643fcb9277b0c0850b6da3ad0fa9adf81b6c39d06a352abf6e1
dc855df5f96c6e1a018719c3e3cb045a8355222b5ff8615c870163f0727b0612
dddb9f1533df88ecb7c8f1e122cfcaeb5141aeee3538f500567e6bf643ab0882
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de3a29c65cd67216c62d60c69ed9af9fc37b31f7e07e470472b4eaef7f9ca146
df08da969ffb2b94cc47fb4bce7b62b92c5bb81a99f0095010530409bbfd73e8
e0309fd597700b89310de557575438fb73dbee569cf734340057c0884ce91c20
e2755c61fe6c1a6268f7d9c741ed2d678f0fd67c734c62a4c61095bc322990d7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e47228780ee5592a708ceb1fc3c9201715ab77166589661310925555458f3a35
eabbeb79a10a5cc1851b20a1c56a051495ff884edecc7e9cf5af185a29ed6117
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f614bd61bd075edf0d404d4ad101744a06ed0674049e2769e824d84d21974b27
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390
fec8e17c18093016b75bcc3d62b52f6d758d9a7cae88c857f2c5bc8a82ff649a
fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48
fffd2078493be0435e8920547b3eca3914fa366d875469b387f34e0495af1d06

hizlitrenbiletisatis.com Open in urlscan Pro 185.216.113.60 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

172 Requests

91 %HTTPS

43 %IPv6

30 Domains

41 Subdomains

36 IPs

8 Countries

1871 kBTransfer

4667 kBSize

26 Cookies

0 Outgoing links

Page URL History

Redirected requests

172 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

hizlitrenbiletisatis.com Open in urlscan Pro
185.216.113.60 Public Scan

Screenshot
Live screenshot

Full Image

172
Requests

91 %
HTTPS

43 %
IPv6

30
Domains

41
Subdomains

36
IPs

8
Countries

1871 kB
Transfer

4667 kB
Size

26
Cookies

172 HTTP transactions
5 data transactions