www.nzz.ch Open in urlscan Pro
194.40.217.50 Public Scan

server-143-204-98-82.fra50.r.cloudfront.net

Software

cafe /

Resource Hash

936790ccabd26acddebd039c54120623734e2aa82310def49cc535912338fc0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14166
x-xss-protection: 0
server: cafe
etag: 5348393372526461885
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 28 Sep 2021 13:57:12 GMT

GET
H2 200 hotjar-828209.js Show response
static.hotjar.com/c/ 9 KB
3 KB 27ms
8ms Script
application/javascript 143.204.98.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-828209.js?sv=6

Requested by

Host: ens.nzz.ch
URL: https://ens.nzz.ch/nzz/prod-nzz/code/197efde10ffc277f6aba8e69543cf0d2.js?conditionId0=422956

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.82 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ae4276e7e8ec7a850cb6eaed74b92fe841878291315f4f2a2f5c0a24ac84a369

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:56:27 GMT
content-encoding: br
x-content-type-options: nosniff
cache-control: max-age=60
age: 45
etag: W/fa870b19a4c4fa56467c0ce79a6a6a09
vary: Accept-Encoding
x-edge-origin-shield-skipped: 0
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: rXam2U5rG9iXdcorYqiZjFDaLpheYQ8Y5ILgb7m5I6R9-74aQCK4TA==
via: 1.1 ef13dd533b8dc9dcfdc35449cf88f808.cloudfront.net (CloudFront)

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 14 KB
6 KB 37ms
21ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: ens.nzz.ch
URL: https://ens.nzz.ch/nzz/prod-nzz/code/197efde10ffc277f6aba8e69543cf0d2.js?conditionId0=422956
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
content-encoding: gzip
last-modified: Mon, 20 Sep 2021 23:58:10 GMT
etag: "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-geo-cc_and_ra: DE-NW
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 5410
x-served-by: cache-iad-kcgs7200034-IAD, cache-fra19164-FRA

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect/?pid=2632308&fmt=gif
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fpid%3D2632308%26fmt%3Dgif%26liSync%3Dtrue
https://px.ads.linkedin.com/collect?pid=2632308&fmt=gif&liSync=true

43 B
115 B

169ms
169ms

Image
image/gif

108.174.11.69
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?pid=2632308&fmt=gif&liSync=true
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.174.11.69 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-11-69.fwd.linkedin.com
Software: Play /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
content-encoding: gzip
server: Play
linkedin-action: 1
vary: Accept-Encoding
x-li-fabric: prod-lva1
x-li-proto: http/2
x-li-pop: prod-eda6
content-type: image/gif
content-length: 65
x-li-uuid: TEQMfP4AqRagji5A5SoAAA==

Redirect headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-uuid: AAXNDpcn4k/cpdbQ2ZepKw==
pragma: no-cache
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: DD7250AC01514484A4D9BE4F77BACA7E Ref B: PRG01EDGE0819 Ref C: 2021-09-28T13:57:12Z
date: Tue, 28 Sep 2021 13:57:12 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options: sameorigin
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?pid=2632308&fmt=gif&liSync=true
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect/?pid=3319553&fmt=gif
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fpid%3D3319553%26fmt%3Dgif%26liSync%3Dtrue
https://px.ads.linkedin.com/collect?pid=3319553&fmt=gif&liSync=true

43 B
143 B

166ms
166ms

Image
image/gif

108.174.11.69
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?pid=3319553&fmt=gif&liSync=true
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.174.11.69 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-11-69.fwd.linkedin.com
Software: Play /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
content-encoding: gzip
server: Play
linkedin-action: 1
vary: Accept-Encoding
x-li-fabric: prod-lva1
x-li-proto: http/2
x-li-pop: prod-eda6
content-type: image/gif
content-length: 65
x-li-uuid: i2Y9fP4AqRbwRMj04yoAAA==

Redirect headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-uuid: AAXNDpcn4DY2ozlLPEDDzw==
pragma: no-cache
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 1FF7D2201B3946449B64C768896478F3 Ref B: PRG01EDGE0819 Ref C: 2021-09-28T13:57:12Z
date: Tue, 28 Sep 2021 13:57:12 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options: sameorigin
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?pid=3319553&fmt=gif&liSync=true
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/seg?add=11367112&t=2
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D11367112%26t%3D2

43 B
1 KB

36ms
35ms

Image
image/gif

185.33.220.242
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D11367112%26t%3D2

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.242 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 28 Sep 2021 13:57:12 GMT
X-Proxy-Origin: 216.131.114.132; 216.131.114.132; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: da3b3751-b1a2-4260-882f-9b493190b060
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 28 Sep 2021 13:57:12 GMT
X-Proxy-Origin: 216.131.114.132; 216.131.114.132; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: a1cd27b3-4d99-41dc-935b-60c4220e4821
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D11367112%26t%3D2
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 bind
adserver.adtech.de/ 43 B
275 B 111ms
11ms Image
image/gif 152.199.22.2
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://adserver.adtech.de/bind?ckey1=nzz_none;cvalue1=;expiresDays=99;adct=image/gif;misc=123
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.22.2 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:12 GMT
server: nginx
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
cache-control: no-store, no-cache
content-type: image/gif
content-length: 43
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 23ms
6ms Script
application/x-javascript 31.13.92.14
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: ens.nzz.ch
URL: https://ens.nzz.ch/nzz/prod-nzz/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.92.14 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-frt3.fbcdn.net

Software

Resource Hash

ab43cf929d649dba8ce38c92dec4849c8049b678fec9942ae08df5ca57757280

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 25969
x-xss-protection: 0
pragma: public
x-fb-debug: 2iiRwshy8X1/52ndrgiMlJekDlOHqpGUnmLYmna0j051oIQc9k6rit0kDlBTkYV04iWUX0VzBJLE357+kxCWzQ==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Tue, 28 Sep 2021 13:57:12 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 publisher.js Show response
adnz.co/dmp/ 131 KB
43 KB 83ms
27ms Script
application/javascript 104.26.3.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://adnz.co/dmp/publisher.js
Requested by: Host: ens.nzz.ch
URL: https://ens.nzz.ch/nzz/prod-nzz/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f46ba773cdfde3e003bf2637c4ba183ebebe71d68d225fcb719e94565f4b1b89

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2036
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
x-amz-request-id: tx0000000000000613cc279-006152decd-cad0bc-default
last-modified: Tue, 28 Sep 2021 09:17:53 GMT
server: cloudflare
cache-control: public, max-age=10800
etag: W/"bd4039dc35ce867932b42edc15bd7b81"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JR%2FjK6TPB4YuopczTXRk71PAQ%2BGhS2FMs66DsfvGcgcOPO3nED4oB1%2B98C%2BNFv0s7twcEjBf%2BbG53oFtS7W78DpoXt1xMVU4Gtl8GnWfinNK4YDMd1fL2CM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
x-rgw-object-type: Normal
access-control-allow-credentials: true
cf-ray: 695d7abf8ce027a0-PRG
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With
expires: Tue, 28 Sep 2021 16:23:16 GMT

GET
H2 200 langpurpose_de.min.js Show response
cdn.consentmanager.mgr.consensu.org/delivery/lang/ 39 KB
8 KB 9ms
9ms Script
application/javascript 195.181.175.49
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.consentmanager.mgr.consensu.org/delivery/lang/langpurpose_de.min.js
Requested by: Host: cdn.consentmanager.mgr.consensu.org
URL: https://cdn.consentmanager.mgr.consensu.org/delivery/cmp_en.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 195.181.175.49 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: frankfurt-47.cdn77.com
Software: CDN77-Turbo / PleskLin
Resource Hash: 2379c0a9ea59e6709dbcfdbea6d7ceec9cc54c6de77d0a09936381d43c2104b3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Tue, 28 Sep 2021 13:57:12 GMT
content-encoding: br
vary: Accept-Encoding
x-77-nzt-ray: HzIfVCX6peE=
x-powered-by: PleskLin
x-77-cache: HIT
x-cache: HIT
x-age: 549
x-77-nzt: AcO1ry82TSTvJQIAAA==
x-accel-expires: @1632838683
last-modified: Wed, 15 Sep 2021 21:25:42 GMT
server: CDN77-Turbo
etag: W/"614264d6-9dbc"
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, DELETE, PUT
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=1800, public

GET
H2 200 call.js Show response
track.nzz.ch/cre-1.0/tracking/ 444 B
516 B 24ms
24ms Script
application/javascript 194.40.217.50
NZZ-AS Seehofstr. 16

General

Check archive.org

Show headers Download Go to

Full URL: https://track.nzz.ch/cre-1.0/tracking/call.js?action=pageview&serviceid=nzz&origin=web&doctype=section&contentid=%2Fdeutschland&cms_id=1395547&channel=Startseite%20(Deutschland)&heading=Startseite%20(Deutschland)&site=www.nzz.ch&_u=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&_r=&_c=cre_callback_96710
Requested by: Host: track.nzz.ch
URL: https://track.nzz.ch/cre-1.0/tracking/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.40.217.50 , Switzerland, ASN29166 (NZZ-AS Seehofstr. 16, SE),
Reverse DNS: onl-paylbvip-p.nzzmg.ch
Software: nginx /
Resource Hash: ce37714dc3cd97b0629cce3f0597468d43e509a0e8a10847e722d86fef9235ff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:11 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-cache, max-age=0, must-revalidate, no-store
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 modules.e95f6e2deb67f1b24d8e.js Show response
script.hotjar.com/ 221 KB
59 KB 25ms
8ms Script
application/javascript 143.204.98.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.e95f6e2deb67f1b24d8e.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-828209.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.33 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-33.fra50.r.cloudfront.net

Software

Resource Hash

3e4dcf5d937c6cd9bd580358e83d9bff9769f73cc2364ed9af22c88571959adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 08:27:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19807
x-amz-server-side-encryption: AES256
x-edge-origin-shield-skipped: 0
x-cache: Hit from cloudfront
content-length: 59787
access-control-allow-origin: *
last-modified: Tue, 28 Sep 2021 08:26:22 GMT
etag: "4c2c45df8457d0c2a07b3285a23cd7a4"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: eQz0BtcbNp2jCX1jqXPl-tAbrOnHlMCBH6MbqmQ1kM0Y1P8F8KRwvA==

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
659 B 196ms
181ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nzhbj&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=2dd3ea01-efd0-4e1f-90c4-cdf64665e53c&tw_document_href=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&tpx_cb=twttr.conversion.loadPixels

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
pragma: no-cache
last-modified: Tue, 28 Sep 2021 13:57:12 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 18926ff14428b0d6b480b9bea50578c2f4a05045a7428db9fc7ed9f7c46a550e
x-transaction: cd0e88de67cf6086
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
454 B 188ms
172ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nzhbj&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=2dd3ea01-efd0-4e1f-90c4-cdf64665e53c&tw_document_href=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Tue, 28 Sep 2021 13:57:12 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f811b4a17afd0bbe4527e92a8eece48c20c71b6569b673a6c9d31dd6f8e8282b
x-transaction: 1956d5f703d25857
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK pixel.php
consentmanager.mgr.consensu.org/delivery/ 43 B
353 B 15ms
15ms Image
image/gif 87.230.98.74
PLUSSERVER-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consentmanager.mgr.consensu.org/delivery/pixel.php?id=16054&did=1&cfdid=1&t=pv.cn.d_reg0&h=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&o=1632837432233&l=DE&lv=20933&d=1&ct=14&e=&e2=&e3=&i=&sv=63&dv=34&

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

87.230.98.74 , Germany, ASN61157 (PLUSSERVER-ASN1, DE),

Reverse DNS

ma5037422.psmanaged.com

Software

Resource Hash

5704a2e9f2f7ce43a79f9b407f1aedcfd50223cbe8bd2f71ff8c5c819e469cbc

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 28 Sep 2021 13:57:12 GMT
Last-Modified: Tue, 28 Sep 2021 13:57:12 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate
Content-Length: 43
X-XSS-Protection: 0
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 362 B
1 KB 123ms
34ms XHR
application/json 52.213.161.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=41600C3A53DF55A50A490D4D%40AdobeOrg&d_nsid=0&ts=1632837432241

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.213.161.66 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-213-161-66.eu-west-1.compute.amazonaws.com

Software

Resource Hash

e47d6a3048c58d693dadde6e25d10946816059a96245d79a2772a17a7738d9b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.nzz.ch/deutschland
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-1-v018-096402d94.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: MOON00cFSe4=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.nzz.ch
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 307
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H2 204 delivery
mboxedge37.tt.omtrdc.net/rest/v1/ 0
201 B 107ms
33ms Ping
text/plain 18.203.190.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mboxedge37.tt.omtrdc.net/rest/v1/delivery?client=nzz&sessionId=5f96fb32fbff4cb19251ae89ba24cf94&version=2.3.1
Requested by: Host: assets.static-nzz.ch
URL: https://assets.static-nzz.ch/nzz/v1/abfaeff117548c4.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.190.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-190-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.nzz.ch/deutschland
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.nzz.ch
date: Tue, 28 Sep 2021 13:57:12 GMT
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
x-request-id: d8e7401415abe93ca50520fc11cad4e6

GET
H2 200 box-dfc01efbdc94bb0936d9a35a502b0b64.html Show response
vars.hotjar.com/ Frame 61F6 2 KB
1 KB 25ms
7ms Document
text/html 143.204.98.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-dfc01efbdc94bb0936d9a35a502b0b64.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-828209.js?sv=6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-32.fra50.r.cloudfront.net
Software: /
Resource Hash: 88ca677c14d4217c2f6b8c8964a1d172027974c4c0839e4d531ad7d3d6de1987

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-dfc01efbdc94bb0936d9a35a502b0b64.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.nzz.ch/deutschland
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland

Response headers

content-type: text/html
content-length: 1044
date: Tue, 20 Jul 2021 13:05:05 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
etag: "10714b84569172431728622d7c8098e4"
last-modified: Tue, 20 Jul 2021 13:04:43 GMT
x-amz-server-side-encryption: AES256
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 a267c4458d5587daaaf85f1d134a02d4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: tKzZJhT_pTXqwY0LJEMBv7dhhZaFBDbYUdWPlPqaKJCSPr6A58W3hw==
age: 6051127

GET
H2 200 call.js Show response
track.nzz.ch/cre-1.0/tracking/ 268 B
423 B 22ms
21ms Script
application/javascript 194.40.217.50
NZZ-AS Seehofstr. 16

General

Check archive.org

Show headers Download Go to

Full URL: https://track.nzz.ch/cre-1.0/tracking/call.js?action=pagecomplete&serviceid=nzz&origin=web&doctype=section&contentid=%2Fdeutschland&cms_id=1395547&channel=Startseite%20(Deutschland)&heading=Startseite%20(Deutschland)&site=www.nzz.ch&_u=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&_r=&_c=cre_callback_40686
Requested by: Host: track.nzz.ch
URL: https://track.nzz.ch/cre-1.0/tracking/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.40.217.50 , Switzerland, ASN29166 (NZZ-AS Seehofstr. 16, SE),
Reverse DNS: onl-paylbvip-p.nzzmg.ch
Software: nginx /
Resource Hash: 5f6ec0ac37a1b7828bc8be8cec82ec59fc26c8dafd6b7ab6507f89b68d89c287

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:11 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-cache, max-age=0, must-revalidate, no-store
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 device.js Show response
track.nzz.ch/cre-1.0/tracking/ 22 B
246 B 32ms
32ms Script
application/javascript 194.40.217.50
NZZ-AS Seehofstr. 16

General

Check archive.org

Show headers Download Go to

Full URL: https://track.nzz.ch/cre-1.0/tracking/device.js?action=pagecomplete&serviceid=nzz&origin=web&doctype=section&contentid=%2Fdeutschland&cms_id=1395547&channel=Startseite%20(Deutschland)&heading=Startseite%20(Deutschland)&site=www.nzz.ch&_u=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&_r=&_c=cre_callback_6676&width=1600&height=1200&dpi_x=96&dpi_y=96&tracking_id=1712154142359083918
Requested by: Host: track.nzz.ch
URL: https://track.nzz.ch/cre-1.0/tracking/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.40.217.50 , Switzerland, ASN29166 (NZZ-AS Seehofstr. 16, SE),
Reverse DNS: onl-paylbvip-p.nzzmg.ch
Software: nginx /
Resource Hash: 3fd9360ec05707673eabfdbb6faf57ff21a2b6ced82744375cb10fd90b93b334

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:11 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-cache, max-age=0, must-revalidate, no-store
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1045474921/ 2 KB
2 KB 40ms
18ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1045474921/?random=1632837432275&cv=9&fst=1632837432275&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&data=sbscrst%3D%3Bcidmstrcnt%3D%3Bprdnamsord%3D&frm=0&url=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&tiba=NZZ%20%E2%80%93%20Neue%20Z%C3%BCrcher%20Zeitung%20%7C%20Aktuelle%20News%2C%20Hintergr%C3%BCnde%20%26%20mehr&hn=www.googleadservices.com&us_privacy=error&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e971851ab10ff96b890a49f9e530d68356209da38a84859aa8193ab59456619e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1076
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1647567628859797 Show response
connect.facebook.net/signals/config/ 490 KB
144 KB 341ms
341ms Script
application/x-javascript 31.13.92.14
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1647567628859797?v=2.9.46&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.92.14 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-frt3.fbcdn.net

Software

Resource Hash

ffa1f77354496ef6abc42607f180acc84ed75ca0f60dc27b9560404b68001f1f

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: DY5XATmGIrNqsKcNT4yNVOscmvnbineNLqVw3euKES6ou9wvpBXB1IV6ljF4gvj9f5tqWX5oGbGlFBqN9ULZqQ==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Tue, 28 Sep 2021 13:57:12 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

beacon.js Show response
sb.scorecardresearch.com/internal-cs/default/
Redirect Chain

https://sb.scorecardresearch.com/cs/25855845/beacon.js
https://sb.scorecardresearch.com/internal-cs/default/beacon.js

4 KB
2 KB

7ms
7ms

Script
application/javascript

143.204.98.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/internal-cs/default/beacon.js
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-86.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6838420e13959ecffe73d3576ee2125a66c9315237394a23e3dd4a5181e80cda

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:34:25 GMT
content-encoding: gzip
etag: W/"5b0f9f0704a703b8da651007721fac57"
last-modified: Thu, 04 Mar 2021 13:31:34 GMT
server: AmazonS3
age: 1368
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-edge-origin-shield-skipped: 0
content-type: application/javascript
via: 1.1 ad46d498157a92ab1076f74db460670d.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: rgXl1azvZIfgsvh7S11oL3Na1aePVVh1od_ZAvrrug_vA1G3EE3PeA==

Redirect headers

date: Tue, 28 Sep 2021 13:57:12 GMT
via: 1.1 ad46d498157a92ab1076f74db460670d.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
vary: Accept
x-cache: Miss from cloudfront
content-type: text/plain; charset=utf-8
location: /internal-cs/default/beacon.js
content-length: 52
x-amz-cf-id: YDZfifWw5Kqlfxap3-OjzySG8SWR7cJUFO7oVABZKlOs6rckqvdFvA==

GET
H2 200 chartbeat.js Show response
static.chartbeat.com/js/ 36 KB
14 KB 89ms
8ms Script
application/x-javascript 143.204.98.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat.js
Requested by: Host: ens.nzz.ch
URL: https://ens.nzz.ch/nzz/prod-nzz/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.142 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-142.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: 612e6b00354d56a1726cd40dc9a28d83ffda033d63214eae704d1e61ef59b3b5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:14:04 GMT
content-encoding: gzip
age: 2588
x-edge-origin-shield-skipped: 0
cross-origin-resource-policy: cross-origin
x-cache: Hit from cloudfront
last-modified: Fri, 09 Jul 2021 00:11:37 GMT
server: nginx
etag: W/"60e79439-8e96"
vary: Accept-Encoding
content-type: application/x-javascript
via: 1.1 e6d97713eb9b65f883e0f86b833878dd.cloudfront.net (CloudFront)
cache-control: max-age=7200
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: JHwd_c2Ey3SiSu2_KGnv-zFlakr9EEr9fM7ZVnIp_iVQv6mBJLNt4A==
expires: Tue, 28 Sep 2021 15:14:04 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
233 B 174ms
174ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nzhbj&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=cd5ddd02-80e4-4f44-9ce6-e7dc32716349&tw_document_href=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&tpx_cb=twttr.conversion.loadPixels

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
pragma: no-cache
last-modified: Tue, 28 Sep 2021 13:57:12 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 18926ff14428b0d6b480b9bea50578c2f4a05045a7428db9fc7ed9f7c46a550e
x-transaction: a7ae5ff3b6a7cab2
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
118 B 170ms
170ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nzhbj&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=cd5ddd02-80e4-4f44-9ce6-e7dc32716349&tw_document_href=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Tue, 28 Sep 2021 13:57:12 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f811b4a17afd0bbe4527e92a8eece48c20c71b6569b673a6c9d31dd6f8e8282b
x-transaction: 7877c12659a27211
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK getuidj Show response
ib.adnxs.com/ 29 B
861 B 162ms
135ms XHR
application/json 185.33.221.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/getuidj

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

static.1.160.40.188.clients.your-server.de

Software

nginx/1.17.9 /

Resource Hash

09c5906718938ff5f41b37ceec336037ff36457ed28dfc979a63651e535ed825

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 28 Sep 2021 13:57:12 GMT
X-Proxy-Origin: 216.131.114.132; 216.131.114.132; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 30686436-67f3-4798-a773-cade03fc69b8
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.nzz.ch
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 29
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 xdomain_cookie.js Show response
xd.adnz.co/ 10 KB
11 KB 63ms
16ms Script
application/javascript 188.40.160.1
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://xd.adnz.co/xdomain_cookie.js

Requested by

Host: adnz.co
URL: https://adnz.co/dmp/publisher.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

188.40.160.1 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Resource Hash

b9847b26d3e80bdc648e8df7b451af6f2d7db111c2e4859ffcb144cb6d6376d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
x-amz-request-id: tx0000000000000617a448e-0061531f38-cad0bc-default
content-length: 10154
last-modified: Tue, 28 Sep 2021 09:16:02 GMT
cache-control: max-age=10800, public
etag: "e11aec66051b9d7e765c90a125d156f0"
strict-transport-security: max-age=15724800; includeSubDomains
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
x-rgw-object-type: Normal
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With
expires: Tue, 28 Sep 2021 16:57:12 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/1045474921/ 42 B
569 B 44ms
19ms Image
image/gif 142.250.181.228
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1045474921/?random=1632837432275&cv=9&fst=1632834000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=sbscrst%3D%3Bcidmstrcnt%3D%3Bprdnamsord%3D&frm=0&url=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&tiba=NZZ%20%E2%80%93%20Neue%20Z%C3%BCrcher%20Zeitung%20%7C%20Aktuelle%20News%2C%20Hintergr%C3%BCnde%20%26%20mehr&async=1&fmt=3&is_vtc=1&random=1806923982&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.228 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dest5.html Show response
nzz.demdex.net/ Frame 1FE7 7 KB
3 KB 385ms
32ms Document
text/html 52.18.85.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://nzz.demdex.net/dest5.html?d_nsid=undefined

Requested by

Host: ens.nzz.ch
URL: https://ens.nzz.ch/nzz/prod-nzz/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.18.85.49 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-18-85-49.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: nzz.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.nzz.ch/deutschland
Accept-Encoding: gzip, deflate, br
Cookie: demdex=34899130312303763884608483119892535680
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Tue, 28 Sep 2021 13:57:12 GMT
DCS: dcs-prod-irl1-1-v018-03a515461.edge-irl1.demdex.com UNKNOWN
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Thu, 23 Sep 2021 11:45:21 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: JrESSizkR+g=
Content-Length: 2791
Connection: keep-alive

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YVMfOAAAAKuCQAQp
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=34899130312303763884608483119892535680
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YVMfOAAAAKuCQAQp

42 B
945 B

39ms
38ms

Image
image/gif

52.213.161.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YVMfOAAAAKuCQAQp

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.213.161.66 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-213-161-66.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v018-046f9c0b1.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: BQgInEKkSow=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YVMfOAAAAKuCQAQp
Date: Tue, 28 Sep 2021 13:57:12 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2

200

b2
end.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=25855845&mp_brand=NZZ&ns_site=www.nzz.ch&gdpr=0&gdpr_p1t=&gdpr_li=&gdpr_purps=&gdpr_pcc=&cs_cmp_nc=0&cs_cmp_id=31&cs_cmp_sv=54&cs_cmp_rt=0&cs_it=b2&cv=3.8...
https://sb.scorecardresearch.com/b2?c1=2&c2=25855845&mp_brand=NZZ&ns_site=www.nzz.ch&gdpr=0&gdpr_p1t=&gdpr_li=&gdpr_purps=&gdpr_pcc=&cs_cmp_nc=0&cs_cmp_id=31&cs_cmp_sv=54&cs_cmp_rt=0&cs_it=b2&cv=3....
https://end.scorecardresearch.com/b2?c1=2&c2=25855845&mp_brand=NZZ&ns_site=www.nzz.ch&gdpr=0&gdpr_p1t=&gdpr_li=&gdpr_purps=&gdpr_pcc=&cs_cmp_nc=0&cs_cmp_id=31&cs_cmp_sv=54&cs_cmp_rt=0&cs_it=b2&cv=3...

43 B
304 B

299ms
9ms

Image
image/gif

18.194.215.200
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://end.scorecardresearch.com/b2?c1=2&c2=25855845&mp_brand=NZZ&ns_site=www.nzz.ch&gdpr=0&gdpr_p1t=&gdpr_li=&gdpr_purps=&gdpr_pcc=&cs_cmp_nc=0&cs_cmp_id=31&cs_cmp_sv=54&cs_cmp_rt=0&cs_it=b2&cv=3.8.0.210223&ns__t=1632837432383&ns_c=UTF-8&c7=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&c8=NZZ%20%E2%80%93%20Neue%20Z%C3%BCrcher%20Zeitung%20%7C%20Aktuelle%20News%2C%20Hintergr%C3%BCnde%20%26%20mehr&c9=&cs_rdr_ts=1632837432&cs_rdr_ts=1632837432

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.194.215.200 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-194-215-200.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Jul 2018 15:06:53 GMT
server: nginx
etag: "5b50a90d-2b"
strict-transport-security: max-age=31536000
content-type: image/gif
x-permitted-cross-domain-policies: master-only
accept-ranges: bytes
content-length: 43
x-xss-protection: 1; mode=block

Redirect headers

date: Tue, 28 Sep 2021 13:57:12 GMT
via: 1.1 ad46d498157a92ab1076f74db460670d.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
vary: Accept
x-cache: Miss from cloudfront
content-type: text/plain; charset=utf-8
location: https://end.scorecardresearch.com/b2?c1=2&c2=25855845&mp_brand=NZZ&ns_site=www.nzz.ch&gdpr=0&gdpr_p1t=&gdpr_li=&gdpr_purps=&gdpr_pcc=&cs_cmp_nc=0&cs_cmp_id=31&cs_cmp_sv=54&cs_cmp_rt=0&cs_it=b2&cv=3.8.0.210223&ns__t=1632837432383&ns_c=UTF-8&c7=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&c8=NZZ%20%E2%80%93%20Neue%20Z%C3%BCrcher%20Zeitung%20%7C%20Aktuelle%20News%2C%20Hintergr%C3%BCnde%20%26%20mehr&c9=&cs_rdr_ts=1632837432&cs_rdr_ts=1632837432
content-length: 460
x-amz-cf-id: PvgaeEcMa267qPLygZTqQr0kXSdzv2ydyF1FHTAc-e5yI4-IidXAtQ==

OPTIONS
H2 200 ws-ingress
gc-ingress-prod.danzz.ch/ Frame 0
0 327ms
36ms Preflight 172.67.158.225
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gc-ingress-prod.danzz.ch/ws-ingress

Protocol

Server

172.67.158.225 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.nzz.ch
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
content-length: 0
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
access-control-max-age: 3600
access-control-allow-headers: authorization, content-type, xsrf-token
access-control-expose-headers: xsrf-token
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e%2BCnHQy6MFxPos8VqDIYwhAVOnZ9hxRe7kDSRQ7XjA8%2BSdp9PiGswvOU%2BI8mv8fksFxI%2FmkVZJZTk8NVaoN9rDu%2FILVw57WoMSwMb5c71fxxM8mFC5rGO%2BwxkJcOsdPpJbG0SGBJR5kDmEY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 695d7ac27af0411f-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

POST
H3 200 ws-ingress Show response
gc-ingress-prod.danzz.ch/ 15 B
728 B 58ms
39ms XHR
text/plain 172.67.158.225
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gc-ingress-prod.danzz.ch/ws-ingress

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.158.225 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42a588450e65d32e4ca901fd8f98e5eb602ade28e0b5cb9143c7cbc6c93e2ddb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.nzz.ch/deutschland
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
access-control-allow-methods: POST, OPTIONS
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000 ; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 15
x-xss-protection: 1; mode=block
pragma: no-cache
server: cloudflare
x-frame-options: DENY
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xn9rcSKC9fDBLo4TDe0waoe0juilRLTnD0VUglffamqp9E2S1HOZm2kEHAj0ZYxV6Kvx5dmCwQi%2FZI%2BD6ONh7V80t0hkt0ON3%2F%2Bonr5tZG8jhSgiPj7NooRxnusAxs6IXsok8l1w3rv6AxE%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: xsrf-token
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
cf-ray: 695d7ac2cb4f411f-PRG
access-control-allow-headers: authorization, content-type, xsrf-token
expires: 0

GET
H/1.1 200
OK v.js Show response
tms.nzz.ch/p4m/ 176 B
492 B 307ms
17ms Script
application/javascript 194.40.217.131
NZZ-AS Seehofstr. 16

General

Check archive.org

Show headers Download Go to

Full URL: https://tms.nzz.ch/p4m/v.js
Requested by: Host: ens.nzz.ch
URL: https://ens.nzz.ch/nzz/prod-nzz/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.40.217.131 , Switzerland, ASN29166 (NZZ-AS Seehofstr. 16, SE),
Reverse DNS: nzzinfr-lbvip-prod.nzzmg.ch
Software: nginx /
Resource Hash: 66f36c0c1eca75f9d73786a64917afe6dd85a8f54cf84bb4e7ab7633b1e8363d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 28 Sep 2021 13:57:11 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/javascript

GET
H2 200 ping
ping.chartbeat.net/ 43 B
201 B 374ms
105ms Image
image/gif 52.206.172.150
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=nzz.ch&p=nzz.ch%2Fdeutschland&u=Bo_-TtpUnQ9DTlgss&d=nzz.ch&g=8912&g0=Startseite%20(Deutschland)&g1=No%20Author&g4=home&n=1&f=00001&c=0&x=0&m=0&y=15410&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=1262&t=CKjz_iDeaP91B2X48nB8KOz3CA9zJE&V=128&i=NZZ%20%E2%80%93%20Neue%20Z%C3%BCrcher%20Zeitung%20%7C%20Aktuelle%20News%2C%20Hintergr%C3%BCnde%20%26%20mehr%20-%20DE&tz=0&_acct=anon&sn=1&sv=CAf0j7WVJ_CBjoda1DXnzO346o9V&sd=1&im=06672ff3&_
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.206.172.150 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-172-150.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:12 GMT
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
content-length: 43
expires: 0

GET
H2 200 s81425314126986
nzz.d3.sc.omtrdc.net/b/ss/nzzlive/1/JS-2.22.0/ 43 B
393 B 171ms
16ms Image
image/gif 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nzz.d3.sc.omtrdc.net/b/ss/nzzlive/1/JS-2.22.0/s81425314126986?AQB=1&ndh=1&pf=1&t=28%2F8%2F2021%2013%3A57%3A12%202%200&sdid=4E5D7B5D728BF6D1-5103C50407404A5F&mid=34871541572160136144611382178348617066&aamlh=6&ce=UTF-8&ns=nzz&pageName=%2Fdeutschland&g=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&cc=CHF&ch=prod-nzz&server=www.nzz.ch&events=event981&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=www.nzz.ch%2Fdeutschland&v1=D%3Dc1&h1=Startseite%20%28Deutschland%29&c2=1395547&v2=D%3Dc2&c3=home&v3=D%3Dc3&l3=country_header%3ADE%3Bab_test%3AAB-NZZCH-2368-HeaderChange%3AHeaderChange-3%3Bcountry_header_passive%3ADE%3Blegal_header_per%3Atrue&c4=Startseite%20%28Deutschland%29&v4=D%3Dc4&c5=D%3Dg&v5=D%3Dg&c7=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&v7=D%3Dc7&c8=de-CH%7CCH&v8=D%3Dc8&c17=%2Fdeutschland&v17=D%3Dc17&c31=First%20Visit&v31=D%3Dc31&c32=New&v32=D%3Dc32&c33=New&v33=D%3Dc33&c35=1%7C1%7C1&v35=D%3Dc35&c36=none&v36=D%3Dc36&c38=3%3A57%20PM%7CTuesday%7C28%7C40%7C9&v38=D%3Dc38&c40=DE%7C&v40=D%3Dc40&c65=1600&v65=D%3Dc65&c66=1200&v66=D%3Dc66&c67=1&v67=D%3Dc67&v103=home&v127=NZZ%3Ainactive%2CNZZ%3Ainactive&v151=NZZ%20%E2%80%93%20Neue%20Z%C3%BCrcher%20Zeitung%20%7C%20Aktuelle%20News%2C%20Hintergr%C3%BCnde%20%26%20mehr&v169=light&v193=1632837432409_1139357377-1583337108-3447466457-2810660433&v195=1712154142359083918&v197=v3_20200123&v198=initial%3A0&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=41600C3A53DF55A50A490D4D%40AdobeOrg&AQE=1

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
x-content-type-options: nosniff
x-c: main-1531.I2ae8be.M0-520
p3p: CP="This is not a P3P policy"
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 29 Sep 2021 13:57:12 GMT
server: jag
xserver: anedge-567564d5d5-96268
etag: 3506491686567051264-4619614802621318323
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Mon, 27 Sep 2021 13:57:12 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
313 B 22ms
7ms Image
image/gif 31.13.92.36
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1647567628859797&ev=PageView&dl=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&rl=&if=false&ts=1632837432722&sw=1600&sh=1200&v=2.9.46&r=stable&a=tmensighten&ec=0&o=29&fbp=fb.1.1632837432721.526244029&it=1632837432290&coo=false&exp=p1&rqm=GET

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.92.36 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-frt3.facebook.com

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 28 Sep 2021 13:57:12 GMT

POST
H3 200 ws-ingress Show response
gc-ingress-prod.danzz.ch/ 15 B
731 B 36ms
35ms XHR
text/plain 172.67.158.225
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gc-ingress-prod.danzz.ch/ws-ingress

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.158.225 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42a588450e65d32e4ca901fd8f98e5eb602ade28e0b5cb9143c7cbc6c93e2ddb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.nzz.ch/deutschland
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
access-control-allow-methods: POST, OPTIONS
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000 ; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 15
x-xss-protection: 1; mode=block
pragma: no-cache
server: cloudflare
x-frame-options: DENY
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QWkRwRZpkJMsWQ8pQ91A4gsNGquOS2AsvWajsbhkrrdcYaRCOs%2Bp7lC0jQ74znM2S73q4ARDHx8%2Fueai%2FxFXBlgGbagEO0F%2FOK3dhsoQdjTW4NQEcvVAmm6LzWjGdrO1Ql4JL3C%2BitF2emA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: xsrf-token
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
cf-ray: 695d7ac30bae411f-PRG
access-control-allow-headers: authorization, content-type, xsrf-token
expires: 0

OPTIONS
H3 200 ws-ingress
gc-ingress-prod.danzz.ch/ Frame 0
0 56ms
38ms Preflight 172.67.158.225
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gc-ingress-prod.danzz.ch/ws-ingress

Protocol

Server

172.67.158.225 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.nzz.ch
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
content-length: 0
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
access-control-max-age: 3600
access-control-allow-headers: authorization, content-type, xsrf-token
access-control-expose-headers: xsrf-token
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TrXFwEOSmxiELVLJK%2B1FQQR0pNKUrPxMetdQGx2I7%2FG9lVNC3ohYpj2FBmJB8%2FyBN7wIQa%2FqM3GIOuJ%2B99KOT2fb5unA%2FqbNexbt9Zf7rqcMTxTTUcFnCbD2HXem2RIsh01rQAg3ruAwTow%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 695d7ac2cb4d411f-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 xdomain_cookie.html Show response
xd.adnz.co/ Frame 7BB1 3 KB
4 KB 14ms
13ms Document
text/html 188.40.160.1
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://xd.adnz.co/xdomain_cookie.html

Requested by

Host: xd.adnz.co
URL: https://xd.adnz.co/xdomain_cookie.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

188.40.160.1 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.1.160.40.188.clients.your-server.de

Software

Resource Hash

bd2717d6c9540ef58d7a2551925e8756b072e2a2efe80e6813b7f0319f5f5df9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: xd.adnz.co
:scheme: https
:path: /xdomain_cookie.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.nzz.ch/deutschland
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
content-type: text/html
content-length: 3429
last-modified: Tue, 28 Sep 2021 09:16:02 GMT
x-rgw-object-type: Normal
etag: "45e8129814ab26ff8ab64f3395937a88"
x-amz-request-id: tx00000000000002c992d8f-0061531f38-ccaef8-default
expires: Tue, 28 Sep 2021 16:57:12 GMT
cache-control: max-age=10800 public
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With
access-control-expose-headers: Content-Length,Content-Range
accept-ranges: bytes
strict-transport-security: max-age=15724800; includeSubDomains

GET
H2 200 visitor-id Show response
api.adnz.co/api/ws-convey2/ 20 B
604 B 87ms
69ms XHR
text/plain 104.26.3.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.adnz.co/api/ws-convey2/visitor-id?url=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&appnexusId=2284624289282667432&profileHash=4defa01e671ab8c019597a9b2cc3d662&firstPartyCookie=
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afad1f39ef8ef18f2a28ab401d584482f20ab346153eb8f3a101eb90047ed590

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
p3p: CP="Not used"
x-envoy-upstream-service-time: 19
content-length: 20
pragma: no-cache
server: cloudflare
etag: -8215831255077471378
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hs79dghF6L62Zf9EADJYZ%2BnOOh795Uiy5QxRRc6%2BA6UVXCOfX2koi%2BJwlbfZKs4M0OIBAC8YFsP7%2Fpv7a5isQLJ4W1qQvIaqcwNRjWFUAVa%2FPS1%2FxWLZxJVvDU6H"}],"group":"cf-nel","max_age":604800}
content-type: text/plain;charset=utf-8
access-control-allow-origin: https://www.nzz.ch
access-control-expose-headers: ETag, Authorization
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 695d7ac38faf27a0-PRG
expires: -1

GET
H2 200 fonts.css
assets.static-nzz.ch/nzz/9.17.11/static/css/ 3 KB
769 B 7ms
6ms Stylesheet
text/css 185.172.148.132
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.static-nzz.ch/nzz/9.17.11/static/css/fonts.css?v1
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.172.148.132 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 376f06b8f3c0e0f916193feefebcdb2af67d97f56e16a28306b4c8bc6dc35bd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:13 GMT
content-encoding: gzip
last-modified: Thu, 16 Sep 2021 13:29:11 GMT
server: keycdn-engine
x-amz-request-id: QH21Z1MFCWAHRN35
x-edge-location: defr
etag: W/"f4af3dc1ff3eb75c293bdbc67a5bf87f"
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31556940
x-amz-id-2: czvcLyOSNjcEcc6TdmGOwDNnszGLwyXRcuZoSnSbMbeckyXhrieaxlo6HzlM3ifgihsZhuH5qwQ=
expires: Wed, 28 Sep 2022 19:46:13 GMT

GET
H2 200 gt-america-standard-regular.woff2
assets.static-nzz.ch/nzz/8.23.0/static/fonts/ 17 KB
17 KB 8ms
8ms Font
application/octet-stream 185.172.148.132
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.static-nzz.ch/nzz/8.23.0/static/fonts/gt-america-standard-regular.woff2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.172.148.132 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 06788ceb7001b5ccc214e03ac5c2e9f33f158f858e5748b243fde245d2f525a6

Request headers

Referer: https://www.nzz.ch/
Origin: https://www.nzz.ch
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:13 GMT
x-amz-request-id: 5MFQD86R0R1N1CCD
x-edge-location: defr
x-cache: HIT
content-length: 17116
x-amz-id-2: B83/LH4nJ/vSAkoONSVgO/SrCApeeNIW9Ro9GQOqMNznWwZIB1luqD0RzXTtS1bUF1xMu/nEIHM=
last-modified: Mon, 23 Nov 2020 09:48:03 GMT
server: keycdn-engine
etag: "140e5735326383c0eb721efb790ea903"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31556940
accept-ranges: bytes
expires: Wed, 28 Sep 2022 19:46:13 GMT

GET
H2 200 gt-america-standard-medium.woff2
assets.static-nzz.ch/nzz/8.23.0/static/fonts/ 18 KB
18 KB 6ms
6ms Font
application/octet-stream 185.172.148.132
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.static-nzz.ch/nzz/8.23.0/static/fonts/gt-america-standard-medium.woff2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.172.148.132 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 0d145266bba6d9829be935dfadc3cbfafe4a1423e1cec1182e429fdac7b4f843

Request headers

Referer: https://www.nzz.ch/
Origin: https://www.nzz.ch
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:13 GMT
x-amz-request-id: 5MFJNP83TY42QA2B
x-edge-location: defr
x-cache: HIT
content-length: 18224
x-amz-id-2: QjD53V9R82jsfdPoiz5PVX1dDgGszPw1d2qzDW77AFnnKK8jYqZrEu2AUwqfR5wwgPKUGJtQip0=
last-modified: Mon, 23 Nov 2020 09:48:02 GMT
server: keycdn-engine
etag: "8da02ef4316e5457f0287d5363fbacf8"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31556940
accept-ranges: bytes
expires: Wed, 28 Sep 2022 19:46:13 GMT

GET
H2 200 chartbeat_mab_image.js Show response
static.chartbeat.com/js/ 22 KB
10 KB 7ms
7ms Script
application/x-javascript 143.204.98.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat_mab_image.js
Requested by: Host: assets.static-nzz.ch
URL: https://assets.static-nzz.ch/nzz/9.17.11/app/bd429fa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.142 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-142.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: bdbb3b88367e0dc7f2af34b3bb701fe2523c8653a48cdfd8aaf67c2d1e18b76d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:29:47 GMT
content-encoding: gzip
age: 1646
x-edge-origin-shield-skipped: 0
cross-origin-resource-policy: cross-origin
x-cache: Hit from cloudfront
last-modified: Thu, 21 Jan 2021 20:17:30 GMT
server: nginx
etag: W/"6009e15a-5976"
vary: Accept-Encoding
content-type: application/x-javascript
via: 1.1 e6d97713eb9b65f883e0f86b833878dd.cloudfront.net (CloudFront)
cache-control: max-age=7200
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: Qnc4UfWZR7VORLfCvBYtj1jlDzvssrRbIm6Oeqf6OaCqen0zBGD_ig==
expires: Tue, 28 Sep 2021 15:29:47 GMT

GET
H2 200 / Show response
mab.chartbeat.com/mab_strategy/headline_testing/get_strategy/ 154 B
482 B 49ms
6ms XHR
application/json 151.101.194.202
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://mab.chartbeat.com/mab_strategy/headline_testing/get_strategy/?host=nzz.ch&domain=nzz.ch&path=%2Fdeutschland
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.202 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 7e6ab84c0461cf8c717c6021a85bbd8922bae17cdd4354b1bd44ef43be47d25f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:13 GMT
content-encoding: gzip
x-cache-hits: 20
age: 1451
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 128
x-served-by: cache-hhn4065-HHN
access-control-allow-origin: *
x-timer: S1632837433.156635,VS0,VE0
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
content-type: application/json
via: 1.1 varnish (Varnish/6.0), 1.1 varnish
cache-control: no-store, no-cache, must-revalidate, max-age=0, s-maxage=0
accept-ranges: bytes
expires: Sun, 26 Sep 2021 13:33:02 GMT

POST
H3 200 ws-ingress Show response
gc-ingress-prod.danzz.ch/ 15 B
728 B 36ms
36ms XHR
text/plain 172.67.158.225
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gc-ingress-prod.danzz.ch/ws-ingress

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.158.225 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42a588450e65d32e4ca901fd8f98e5eb602ade28e0b5cb9143c7cbc6c93e2ddb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.nzz.ch/deutschland
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

date: Tue, 28 Sep 2021 13:57:13 GMT
access-control-allow-methods: POST, OPTIONS
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000 ; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 15
x-xss-protection: 1; mode=block
pragma: no-cache
server: cloudflare
x-frame-options: DENY
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ionpoGckAfZey46S2VOeWA1de3XJzPX5V9cKOc63miYfwAkcAaD10ZJ%2Fjmw5hs9eRqqvbUetOPj7dOgCYvb0QLwy6Z7rl7vID%2BB0VNZrdYhyqQzaBp8LpslVwU0fgQALzyMTADXNMiZCMZY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: xsrf-token
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
cf-ray: 695d7ac72eb2411f-PRG
access-control-allow-headers: authorization, content-type, xsrf-token
expires: 0

OPTIONS
H3 200 ws-ingress
gc-ingress-prod.danzz.ch/ Frame 0
0 37ms
36ms Preflight 172.67.158.225
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gc-ingress-prod.danzz.ch/ws-ingress

Protocol

Server

172.67.158.225 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.nzz.ch
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Tue, 28 Sep 2021 13:57:13 GMT
content-length: 0
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
access-control-max-age: 3600
access-control-allow-headers: authorization, content-type, xsrf-token
access-control-expose-headers: xsrf-token
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lFf1oXnNI2L7uLZ7Mqo8G5GHUtSUWmchzzYRy0Dl%2FHjv3XZdmYnFfT6Q6WA%2BldyjHincFFDHHvidOiQE3ewr%2BV2Tg7h%2BtUKLBiBom1J2tS6lHuuuEkgGEjB18hynSlJcprwqShsmOEAp1DY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 695d7ac6ee92411f-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 204 batch Show response
api.adnz.co/api/ws-events-sink/ 0
266 B 35ms
35ms XHR
text/plain 104.26.3.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.adnz.co/api/ws-events-sink/batch?visitorId=-8215831255077471378&profileHash=4defa01e671ab8c019597a9b2cc3d662&appnexusId=2284624289282667432&events=W3sidHlwZSI6IlBBR0VfSU1QUkVTU0lPTiIsImJvZHkiOnt9LCJldmVudElkIjoyOTg4NzU3MTI4Nzg4MjE1LCJwYWdlSW1wcmVzc2lvbklkIjo1Nzg2NDk2NDM5MDk4ODcxLCJ1cmwiOiJodHRwczovL3d3dy5uenouY2gvZGV1dHNjaGxhbmQifV0%3D
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OdQl2HiJ0QkU3w%2F4lUy8BJ5nFxuRdYrtmEtr4BM6YKOmlayxQZhczGN2VNnC9Mn4s7lcvvyHnRe8JP%2FXqMFByNO1EpTjCJXCSS6ZXT4FSowWGER6Mx7lEvfyDAxZ"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://www.nzz.ch
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
cf-ray: 695d7ac71b8327a0-PRG

GET
H2 200 header.js Show response
adnz.co/ 455 KB
83 KB 35ms
35ms Script
application/javascript 104.26.3.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://adnz.co/header.js?adTagId=8
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: f6d4eaa651da416e40d71c25ecde7ed135308d63da33893ac895df5c81d48dbc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:13 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 721
x-powered-by: Express
last-modified: Tue, 28 Sep 2021 13:45:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QFy4cTpvqAPbB0EOMFMZXBeKKVLHu4qb9Ukd5BBhGmmFh410sAcCmA7wgO3DHxblHfAyxa8i0xjCYNZxsXbj52GCJR96r3jsW1bnrZDdxzBU2vqMm5S%2Ft7k%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=1800
cf-ray: 695d7ac7abc327a0-PRG
access-control-allow-headers: origin, content-type, accept

OPTIONS
H2 200 country
api.adnz.co/api/ws-geodata/ Frame 0
0 62ms
31ms Preflight 104.26.3.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.adnz.co/api/ws-geodata/country
Protocol: H2
Server: 104.26.3.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://www.nzz.ch
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Tue, 28 Sep 2021 13:57:13 GMT
content-length: 0
access-control-allow-origin: https://www.nzz.ch
access-control-allow-credentials: true
access-control-allow-methods: GET, PUT, DELETE, POST, OPTIONS
access-control-allow-headers: authorization, cache-control, content-type, if-modified-since, keep-alive, user-agent, requested-status, access-control-request-headers, access-control-request-method, access-control-allow-credentials, origin, referer, sec-fetch-mode, accept-ranges, allow, vary, x-selected-company, sentry-trace
access-control-max-age: 86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2ir4Rt1T%2Bd2X2NUMoR%2B3plH0pR0KNxReWz%2BO%2Bz3i9fXVxmO%2B%2FiLIDhaPg3SseP5yFTlixyOZODmfKLs6yrRhhCw2atOFlVtKB7m8QbrCYdOJ7fG4sCmjTF05AbvR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 695d7ac85bfbf9d6-PRG

GET
H2 200 country Show response
api.adnz.co/api/ws-geodata/ 2 B
268 B 34ms
34ms XHR
application/json 104.26.3.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.adnz.co/api/ws-geodata/country
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9685eb765661ea3b95f31e1bb3c3b5501d0c2acdf353feeaa4d8fe32f95f77fb

Request headers

Accept: application/json
Referer: https://www.nzz.ch/deutschland
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 28 Sep 2021 13:57:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DsK1PadNhm%2BqLgBfoN2t2D0yMe7vaS0KvqWBiLdQCS2yvwxU8KuYuG%2B%2Ba6oCfPcc22gan4Fdw4mvt7ZV6TED56coabdAAIVzuacISdgOKFqGZp%2B%2FPuooCV7NUtzA"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.nzz.ch
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
cf-ray: 695d7ac88c1bf9d6-PRG
content-length: 2

GET
H2 200 page-keywords Show response
api.adnz.co/api/ws-contextual/ 2 B
353 B 64ms
34ms XHR
application/json 104.26.3.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.adnz.co/api/ws-contextual/page-keywords?url=https://www.nzz.ch/deutschland
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:13 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yjjJJv7esD2CVfM443xO4d85LVGEHQDEr585EbadgEG5Lsu3kR%2FxjBysmup3MgOy5y06wAFYdyzJ7qrDkWpxuzoSYAcJRxQMKC5xD07dLL8Qze31lTCd0Oe7bdMN"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.nzz.ch
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
cf-ray: 695d7ac85bfdf9d6-PRG

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame B1B9 73 KB
25 KB 44ms
22ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: adnz.co
URL: https://adnz.co/header.js?adTagId=8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4c3a6ad331c03037410f324fb4217f6c09fb4078d3d0f1988877670e0f93fd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1000 / 433 of 1000 / last-modified: 1632827509"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25103
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 28 Sep 2021 13:57:13 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 9AB4 73 KB
25 KB 46ms
31ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: adnz.co
URL: https://adnz.co/header.js?adTagId=8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8237c0a9108dc935dc352506bde7fc6daf7c99d88d2bdd8fcbdbe121c217ac4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1000 / 38 of 1000 / last-modified: 1632827554"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25099
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 28 Sep 2021 13:57:13 GMT

GET
H3 200 pubads_impl_2021091501.js Show response
securepubads.g.doubleclick.net/gpt/ Frame B1B9 334 KB
116 KB 64ms
40ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

52c41152c7916b4cf3b3a90f790faa0ba7f746603671e286531bc50407d844ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119151
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 08:39:44 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 28 Sep 2021 13:57:13 GMT

GET
H3 200 pubads_impl_2021091501.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 9AB4 334 KB
116 KB 39ms
26ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js?31062950

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

52c41152c7916b4cf3b3a90f790faa0ba7f746603671e286531bc50407d844ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119151
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 08:39:44 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 28 Sep 2021 13:57:13 GMT

GET
H/1.1 200
OK ast.js Show response
acdn.adnxs.com/ast/ 88 KB
31 KB 62ms
6ms Script
application/javascript 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ast/ast.js
Requested by: Host: adnz.co
URL: https://adnz.co/header.js?adTagId=8
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash: bca2ccdd5846d54ff24d04393a9d6ce0b5d60a91814e7bd2755b03059ed98c2e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 28 Sep 2021 13:57:13 GMT
Content-Encoding: gzip
Age: 3952
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 31278
X-Served-By: cache-lga21977-LGA, cache-hhn4062-HHN
Access-Control-Allow-Origin: *
Last-Modified: Thu, 24 Jun 2021 12:48:02 GMT
Server: nginx/1.13.10
X-Timer: S1632837434.896846,VS0,VE0
ETag: W/"60d47f02-1604d"
Vary: Accept-Encoding
Content-Type: application/javascript
Via: 1.1 varnish, 1.1 varnish
Expires: Fri, 25 Jun 2021 12:48:06 GMT
Cache-Control: max-age=86402
Accept-Ranges: bytes
X-Cache-Hits: 1, 4446

OPTIONS
H/1.1 200
OK prebid
ib.adnxs.com/ut/v3/ Frame 0
0 46ms
21ms Preflight
text/plain 185.33.221.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Protocol

HTTP/1.1

Server

185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: cache-control,content-type,pragma
Origin: https://www.nzz.ch
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Server: nginx/1.17.9
Date: Tue, 28 Sep 2021 13:57:13 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Max-Age: 86400
Access-Control-Allow-Headers: cache-control,content-type,pragma
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www.nzz.ch
AN-X-Request-Uuid: 664682e4-410f-4ca3-a8df-3a3d2da53a6a
X-Proxy-Origin: 216.131.114.132; 216.131.114.132; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 26 B
571 B 212ms
176ms XHR
application/json 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=529987&v=7.2&r=%7B%22id%22:%221291856340131003%22,%22imp%22:[%7B%22id%22:%22adnz_maxiboard_1_994x118%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22994x118%22%7D,%22banner%22:%7B%22w%22:994,%22h%22:118,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_maxiboard_1_728x90%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22728x90%22%7D,%22banner%22:%7B%22w%22:728,%22h%22:90,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_maxiboard_1_1620x1%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%221620x1%22%7D,%22banner%22:%7B%22w%22:1620,%22h%22:1,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_maxiboard_1_1340x1%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%221340x1%22%7D,%22banner%22:%7B%22w%22:1340,%22h%22:1,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_maxiboard_1_994x251%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22994x251%22%7D,%22banner%22:%7B%22w%22:994,%22h%22:251,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_maxiboard_1_970x250%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22970x250%22%7D,%22banner%22:%7B%22w%22:970,%22h%22:250,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_maxiboard_1_994x250%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22994x250%22%7D,%22banner%22:%7B%22w%22:994,%22h%22:250,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_maxiboard_1_980x250%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22980x250%22%7D,%22banner%22:%7B%22w%22:980,%22h%22:250,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_skyscraper_1_160x600%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22160x600%22%7D,%22banner%22:%7B%22w%22:160,%22h%22:600,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_skyscraper_1_300x600%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22300x600%22%7D,%22banner%22:%7B%22w%22:300,%22h%22:600,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_skyscraper_1_500x1000%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22500x1000%22%7D,%22banner%22:%7B%22w%22:500,%22h%22:1000,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_1_994x118%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22994x118%22%7D,%22banner%22:%7B%22w%22:994,%22h%22:118,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_1_1000x500%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%221000x500%22%7D,%22banner%22:%7B%22w%22:1000,%22h%22:500,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_1_994x500%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22994x500%22%7D,%22banner%22:%7B%22w%22:994,%22h%22:500,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_1_1000x250%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%221000x250%22%7D,%22banner%22:%7B%22w%22:1000,%22h%22:250,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_1_728x90%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22728x90%22%7D,%22banner%22:%7B%22w%22:728,%22h%22:90,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_1_970x250%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22970x250%22%7D,%22banner%22:%7B%22w%22:970,%22h%22:250,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_1_994x250%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22994x250%22%7D,%22banner%22:%7B%22w%22:994,%22h%22:250,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_1_980x250%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22980x250%22%7D,%22banner%22:%7B%22w%22:980,%22h%22:250,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_3_728x140%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22728x140%22%7D,%22banner%22:%7B%22w%22:728,%22h%22:140,%22topframe%22:1%7D%7D],%22site%22:%7B%22ref%22:%22%22,%22page%22:%22https:%2F%2Fwww.nzz.ch%2Fdeutschland%22%7D,%22ext%22:%7B%22source%22:%22prebid%22%7D,%22regs%22:%7B%22ext%22:%7B%22gdpr%22:0%7D%7D%7D&ac=j&sd=1
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 2c3a460339a59bcb1a2bb76b8a018477d0d834d907b4793bccbb0f5a4c7b51ab

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.nzz.ch/deutschland
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 28 Sep 2021 13:57:14 GMT
Content-Encoding: gzip
X-AK-INITIAL-GEO: CC:[DE], RC:[HE], CN:[EU], CIP:[216.131.114.132], XFF:[]
Server: Apache
Vary: Is-Traffic-Invalid,Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://www.nzz.ch
X-CS-CLIENT-GEO: 12
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 46
X-AK-CLIENT-GEO: 12
Expires: Tue, 28 Sep 2021 13:57:14 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 26 B
571 B 173ms
137ms XHR
application/json 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=529987&v=7.2&r=%7B%22id%22:%221291856340131003%22,%22imp%22:[%7B%22id%22:%22adnz_billboard_3_994x118%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22994x118%22%7D,%22banner%22:%7B%22w%22:994,%22h%22:118,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_3_1000x500%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%221000x500%22%7D,%22banner%22:%7B%22w%22:1000,%22h%22:500,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_3_994x500%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22994x500%22%7D,%22banner%22:%7B%22w%22:994,%22h%22:500,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_3_970x250%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22970x250%22%7D,%22banner%22:%7B%22w%22:970,%22h%22:250,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_3_994x250%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22994x250%22%7D,%22banner%22:%7B%22w%22:994,%22h%22:250,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_4_728x140%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22728x140%22%7D,%22banner%22:%7B%22w%22:728,%22h%22:140,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_4_994x118%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22994x118%22%7D,%22banner%22:%7B%22w%22:994,%22h%22:118,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_4_1000x500%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%221000x500%22%7D,%22banner%22:%7B%22w%22:1000,%22h%22:500,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_4_994x500%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22994x500%22%7D,%22banner%22:%7B%22w%22:994,%22h%22:500,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_4_970x250%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22970x250%22%7D,%22banner%22:%7B%22w%22:970,%22h%22:250,%22topframe%22:1%7D%7D,%7B%22id%22:%22adnz_billboard_4_994x250%22,%22ext%22:%7B%22siteID%22:%22529987%22,%22sid%22:%22994x250%22%7D,%22banner%22:%7B%22w%22:994,%22h%22:250,%22topframe%22:1%7D%7D],%22site%22:%7B%22ref%22:%22%22,%22page%22:%22https:%2F%2Fwww.nzz.ch%2Fdeutschland%22%7D,%22ext%22:%7B%22source%22:%22prebid%22%7D,%22regs%22:%7B%22ext%22:%7B%22gdpr%22:0%7D%7D%7D&ac=j&sd=1
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 2c3a460339a59bcb1a2bb76b8a018477d0d834d907b4793bccbb0f5a4c7b51ab

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.nzz.ch/deutschland
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 28 Sep 2021 13:57:14 GMT
Content-Encoding: gzip
X-AK-INITIAL-GEO: CC:[DE], RC:[HE], CN:[EU], CIP:[216.131.114.132], XFF:[]
Server: Apache
Vary: Is-Traffic-Invalid,Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://www.nzz.ch
X-CS-CLIENT-GEO: 12
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 46
X-AK-CLIENT-GEO: 12
Expires: Tue, 28 Sep 2021 13:57:14 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 716 B
1 KB 43ms
42ms XHR
application/json 185.33.221.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

75caeb8200008d1ef2ab140d0c939f14b7b3c59efa72735b71d890ea0b9d3434

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept: application/json, text/plain, */*
pragma: no-cache
cache-control: no-cache
Referer: https://www.nzz.ch/deutschland
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

Date: Tue, 28 Sep 2021 13:57:13 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 216.131.114.132; 216.131.114.132; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 49cb0a32-3ef8-43c0-a81f-59d4496684a3
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.nzz.ch
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 46 KB
12 KB 243ms
226ms XHR
application/json 185.33.221.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e27f5937b1205b017cfc55c51094b498164147e87aa57a3422bbb2b5eeb48bfa

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.nzz.ch/deutschland
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 28 Sep 2021 13:57:14 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 216.131.114.132; 216.131.114.132; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: b8b8dc86-fb64-4329-97e9-176693e54ce2
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.nzz.ch
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame B1B9 107 B
570 B 43ms
20ms Script
application/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.nzz.ch

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 28 Sep 2021 13:57:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame B1B9 88 KB
23 KB 601ms
600ms XHR
text/plain 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=180415192231688&correlator=1933416264527687&output=ldjh&impl=fif&eid=31061423&vrg=2021091501&ptt=17&gdpr=0&addtl_consent=1~46.1375.70.7.1019.440.1516.1097.1173.3005.817.1745.338.1575.2135.2213.2046.2568.326.1024.1034.1048.1127.1884.1842.2631.3010.2677.1885.1033&sc=1&sfv=1-0-38&ecs=20210928&iu_parts=96628199%2Cde_nzz.ch_v2%2Cde_nzz.ch_v2_133&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=994x118%7C728x90%7C1620x1%7C1340x1%7C994x251%7C970x250%7C994x250%7C980x250%7C1x1&eri=2&cust_params=hb_pb%3D0.30&cookie_enabled=1&cdm=www.nzz.ch&bc=31&abxe=1&lmt=1632837434&dt=1632837434203&dlt=1632837433695&idt=191&ea=0&frm=23&biw=1600&bih=1200&oid=3&adxs=74&adys=254&adks=1232760442&ucis=bfgumng1sq4n&ifi=1&ifk=1338903745&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&url=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&top=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=0x0&ga_vid=1596052319.1632837434&ga_sid=1632837434&ga_hid=2135249019&ga_fc=false&fws=256&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e802b855f1864c3eb5cb73b49103bbbfc8fd18c48b95f6717ed049b00d1e6ac5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23124
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.nzz.ch
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 93D5 6 KB
4 KB 60ms
15ms Document
text/html 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html?n=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.nzz.ch/deutschland
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 28 Sep 2021 13:57:14 GMT
expires: Wed, 28 Sep 2022 13:57:14 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 9AB4 107 B
165 B 41ms
29ms Script
application/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.nzz.ch

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js?31062950

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 28 Sep 2021 13:57:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 9AB4 107 KB
26 KB 600ms
600ms XHR
text/plain 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3489286934335887&correlator=529104998077127&output=ldjh&impl=fif&eid=31060979%2C31062950&vrg=2021091501&ptt=17&gdpr=0&addtl_consent=1~46.1375.70.7.1019.440.1516.1097.1173.3005.817.1745.338.1575.2135.2213.2046.2568.326.1024.1034.1048.1127.1884.1842.2631.3010.2677.1885.1033&sc=1&sfv=1-0-38&ecs=20210928&iu_parts=96628199%2Cde_nzz.ch_v2%2Cde_nzz.ch_v2_140&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=160x600%7C300x600%7C500x1000%7C1x1&eri=2&cust_params=hb_pb%3D0.30&cookie_enabled=1&cdm=www.nzz.ch&bc=31&abxe=1&lmt=1632837434&dt=1632837434215&dlt=1632837433703&idt=170&ea=0&frm=23&biw=1600&bih=1200&oid=3&adxs=1274&adys=0&adks=3713083756&ucis=wtngu46knf6o&ifi=1&ifk=1338903745&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&url=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&top=https%3A%2F%2Fwww.nzz.ch%2Fdeutschland&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=0x0&ga_vid=653936463.1632837434&ga_sid=1632837434&ga_hid=1167108257&ga_fc=false&fws=256&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js?31062950

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58dfab4feb66f10e0a589e14b417601582198ddf5b14840c02e5b24707d3fbfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26234
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.nzz.ch
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7881 6 KB
4 KB 60ms
15ms Document
text/html 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js?31062950

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html?n=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.nzz.ch/deutschland
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 28 Sep 2021 13:57:14 GMT
expires: Wed, 28 Sep 2022 13:57:14 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 204 batch Show response
api.adnz.co/api/ws-events-sink/ 0
267 B 41ms
40ms XHR
text/plain 104.26.3.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.adnz.co/api/ws-events-sink/batch?visitorId=-8215831255077471378&profileHash=4defa01e671ab8c019597a9b2cc3d662&appnexusId=2284624289282667432&events=W3sidHlwZSI6IkhFQURFUl9ET01fRk9VTkQiLCJib2R5Ijp7ImFkVGFnSWQiOjgsImRpdklkIjoiYWRuel90b3BfMSIsImlzUmVsb2FkIjpmYWxzZSwic2l6ZU1hcHBpbmdJZCI6ODYzOX0sImV2ZW50SWQiOjU5MjQwMTY0NjQyNTIwODksInBhZ2VJbXByZXNzaW9uSWQiOjMwMzgwMjE2Mzk4NzI5NywidXJsIjoiaHR0cHM6Ly93d3cubnp6LmNoL2RldXRzY2hsYW5kIn0seyJ0eXBlIjoiSEVBREVSX0RPTV9GT1VORCIsImJvZHkiOnsiYWRUYWdJZCI6OCwiZGl2SWQiOiJhZG56X21heGlib2FyZF8xIiwiaXNSZWxvYWQiOmZhbHNlLCJzaXplTWFwcGluZ0lkIjoxMzN9LCJldmVudElkIjozNTkzODM5MzI5ODE5ODU1LCJwYWdlSW1wcmVzc2lvbklkIjozMDM4MDIxNjM5ODcyOTcsInVybCI6Imh0dHBzOi8vd3d3Lm56ei5jaC9kZXV0c2NobGFuZCJ9LHsidHlwZSI6IkhFQURFUl9ET01fRk9VTkQiLCJib2R5Ijp7ImFkVGFnSWQiOjgsImRpdklkIjoiYWRuel9iaWxsYm9hcmRfMSIsImlzUmVsb2FkIjpmYWxzZSwic2l6ZU1hcHBpbmdJZCI6MTM1fSwiZXZlbnRJZCI6NjkxNzAzOTIxMjUwMTQ4OSwicGFnZUltcHJlc3Npb25JZCI6MzAzODAyMTYzOTg3Mjk3LCJ1cmwiOiJodHRwczovL3d3dy5uenouY2gvZGV1dHNjaGxhbmQifSx7InR5cGUiOiJIRUFERVJfRE9NX0ZPVU5EIiwiYm9keSI6eyJhZFRhZ0lkIjo4LCJkaXZJZCI6ImFkbnpfYmlsbGJvYXJkXzIiLCJpc1JlbG9hZCI6ZmFsc2V9LCJldmVudElkIjo2NjYzNDg1NzYwODU0Mzg5LCJwYWdlSW1wcmVzc2lvbklkIjozMDM4MDIxNjM5ODcyOTcsInVybCI6Imh0dHBzOi8vd3d3Lm56ei5jaC9kZXV0c2NobGFuZCJ9LHsidHlwZSI6IkhFQURFUl9ET01fRk9VTkQiLCJib2R5Ijp7ImFkVGFnSWQiOjgsImRpdklkIjoiYWRuel9iaWxsYm9hcmRfMyIsImlzUmVsb2FkIjpmYWxzZSwic2l6ZU1hcHBpbmdJZCI6MjIyM30sImV2ZW50SWQiOjM3NzgzNzg1MTMzMTQ0NDMsInBhZ2VJbXByZXNzaW9uSWQiOjMwMzgwMjE2Mzk4NzI5NywidXJsIjoiaHR0cHM6Ly93d3cubnp6LmNoL2RldXRzY2hsYW5kIn0seyJ0eXBlIjoiSEVBREVSX0RPTV9GT1VORCIsImJvZHkiOnsiYWRUYWdJZCI6OCwiZGl2SWQiOiJhZG56X3NreXNjcmFwZXJfMSIsImlzUmVsb2FkIjpmYWxzZSwic2l6ZU1hcHBpbmdJZCI6MTQwfSwiZXZlbnRJZCI6MjAwMjIwMTU3Mzk5MzI5NywicGFnZUltcHJlc3Npb25JZCI6MzAzODAyMTYzOTg3Mjk3LCJ1cmwiOiJodHRwczovL3d3dy5uenouY2gvZGV1dHNjaGxhbmQifSx7InR5cGUiOiJIRUFERVJfQ0FOX0JFX1BSRUxPQURFRCIsImJvZHkiOnsiYWRUYWdJZCI6OCwiZGl2SWQiOiJhZG56X3RvcF8xIiwiaXNSZWxvYWQiOmZhbHNlLCJzaXplTWFwcGluZ0lkIjo4NjM5fSwiZXZlbnRJZCI6NTMxNTc2MzIzNzE5NDY0NSwicGFnZUltcHJlc3Npb25JZCI6MzAzODAyMTYzOTg3Mjk3LCJ1cmwiOiJodHRwczovL3d3dy5uenouY2gvZGV1dHNjaGxhbmQifSx7InR5cGUiOiJIRUFERVJfQ0FOX0JFX1BSRUxPQURFRCIsImJvZHkiOnsiYWRUYWdJZCI6OCwiZGl2SWQiOiJhZG56X21heGlib2FyZF8xIiwiaXNSZWxvYWQiOmZhbHNlLCJzaXplTWFwcGluZ0lkIjoxMzN9LCJldmVudElkIjo1MzQ0NjcwODk3MDM5MDk5LCJwYWdlSW1wcmVzc2lvbklkIjozMDM4MDIxNjM5ODcyOTcsInVybCI6Imh0dHBzOi8vd3d3Lm56ei5jaC9kZXV0c2NobGFuZCJ9LHsidHlwZSI6IkhFQURFUl9DQU5fQkVfUFJFTE9BREVEIiwiYm9keSI6eyJhZFRhZ0lkIjo4LCJkaXZJZCI6ImFkbnpfc2t5c2NyYXBlcl8xIiwiaXNSZWxvYWQiOmZhbHNlLCJzaXplTWFwcGluZ0lkIjoxNDB9LCJldmVudElkIjo3NTM4Nzg2NzI3MjI5NDM5LCJwYWdlSW1wcmVzc2lvbklkIjozMDM4MDIxNjM5ODcyOTcsInVybCI6Imh0dHBzOi8vd3d3Lm56ei5jaC9kZXV0c2NobGFuZCJ9LHsidHlwZSI6IkhFQURFUl9DQU5fQkVfU0hPV04iLCJib2R5Ijp7ImFkVGFnSWQiOjgsImRpdklkIjoiYWRuel90b3BfMSIsImlzUmVsb2FkIjpmYWxzZSwic2l6ZU1hcHBpbmdJZCI6ODYzOX0sImV2ZW50SWQiOjU3NDIyMjc1MzIxNzYyNDcsInBhZ2VJbXByZXNzaW9uSWQiOjMwMzgwMjE2Mzk4NzI5NywidXJsIjoiaHR0cHM6Ly93d3cubnp6LmNoL2RldXRzY2hsYW5kIn0seyJ0eXBlIjoiSEVBREVSX0NBTl9CRV9TSE9XTiIsImJvZHkiOnsiYWRUYWdJZCI6OCwiZGl2SWQiOiJhZG56X21heGlib2FyZF8xIiwiaXNSZWxvYWQiOmZhbHNlLCJzaXplTWFwcGluZ0lkIjoxMzN9LCJldmVudElkIjo1MjU5NDQwNTQzODc5OSwicGFnZUltcHJlc3Npb25JZCI6MzAzODAyMTYzOTg3Mjk3LCJ1cmwiOiJodHRwczovL3d3dy5uenouY2gvZGV1dHNjaGxhbmQifSx7InR5cGUiOiJIRUFERVJfQ0FOX0JFX1NIT1dOIiwiYm9keSI6eyJhZFRhZ0lkIjo4LCJkaXZJZCI6ImFkbnpfc2t5c2NyYXBlcl8xIiwiaXNSZWxvYWQiOmZhbHNlLCJzaXplTWFwcGluZ0lkIjoxNDB9LCJldmVudElkIjoxMDA3MjE0MDUyODg2MDQ3LCJwYWdlSW1wcmVzc2lvbklkIjozMDM4MDIxNjM5ODcyOTcsInVybCI6Imh0dHBzOi8vd3d3Lm56ei5jaC9kZXV0c2NobGFuZCJ9LHsidHlwZSI6IkJJRF9SRVFVRVNUIiwiYm9keSI6eyJoZWFkZXJUYWdJZCI6IjgiLCJjcmVhdGVkIjoxNjMyODM3NDM0MTY2LCJyZXF1ZXN0SWQiOiIxMjkxODU2MzQwMTMxMDAzIiwiYmlkZGVycyI6WyJBUFBORVhVUyIsIlRFQURTIiwiSVgiLCJBTUFaT04iLCJCQyIsIkJUQSIsIkNPREUiLCJYQU5EUl9CQU5ORVIiXSwic2l6ZXMiOlsiOTk0eDEiXSwiZGl2SWQiOiJhZG56X3RvcF8xIn0sImV2ZW50SWQiOjg3NjM5NjE2OTY0MzI1MywicGFnZUltcHJlc3Npb25JZCI6MzAzODAyMTYzOTg3Mjk3LCJ1cmwiOiJodHRwczovL3d3dy5uenouY2gvZGV1dHNjaGxhbmQifSx7InR5cGUiOiJCSURfUkVRVUVTVCIsImJvZHkiOnsiaGVhZGVyVGFnSWQiOiI4IiwiY3JlYXRlZCI6MTYzMjgzNzQzNDE2NywicmVxdWVzdElkIjoiMTI5MTg1NjM0MDEzMTAwMyIsImJpZGRlcnMiOlsiQVBQTkVYVVMiLCJURUFEUyIsIklYIiwiQU1BWk9OIiwiQkMiLCJCVEEiLCJDT0RFIiwiWEFORFJfQkFOTkVSIl0sInNpemVzIjpbIjk5NHgxMTgiLCI3Mjh4OTAiLCIxNjIweDEiLCIxMzQweDEiLCI5OTR4MjUxIiwiOTcweDI1MCIsIjk5NHgyNTAiLCI5ODB4MjUwIl0sImRpdklkIjoiYWRuel9tYXhpYm9hcmRfMSJ9LCJldmVudElkIjo4NDU3NTA4OTQ4MjEwMjU3LCJwYWdlSW1wcmVzc2lvbklkIjozMDM4MDIxNjM5ODcyOTcsInVybCI6Imh0dHBzOi8vd3d3Lm56ei5jaC9kZXV0c2NobGFuZCJ9LHsidHlwZSI6IkJJRF9SRVFVRVNUIiwiYm9keSI6eyJoZWFkZXJUYWdJZCI6IjgiLCJjcmVhdGVkIjoxNjMyODM3NDM0MTY3LCJyZXF1ZXN0SWQiOiIxMjkxODU2MzQwMTMxMDAzIiwiYmlkZGVycyI6WyJBUFBORVhVUyIsIlRFQURTIiwiSVgiLCJBTUFaT04iLCJCQyIsIkJUQSIsIkNPREUiLCJYQU5EUl9CQU5ORVIiXSwic2l6ZXMiOlsiMTYweDYwMCIsIjMwMHg2MDAiLCI1MDB4MTAwMCJdLCJkaXZJZCI6ImFkbnpfc2t5c2NyYXBlcl8xIn0sImV2ZW50SWQiOjQ2NzI2Njc3MzA1NTc2MTcsInBhZ2VJbXByZXNzaW9uSWQiOjMwMzgwMjE2Mzk4NzI5NywidXJsIjoiaHR0cHM6Ly93d3cubnp6LmNoL2RldXRzY2hsYW5kIn0seyJ0eXBlIjoiQklEX1JFUVVFU1QiLCJib2R5Ijp7ImhlYWRlclRhZ0lkIjoiOCIsImNyZWF0ZWQiOjE2MzI4Mzc0MzQxNjcsInJlcXVlc3RJZCI6IjEyOTE4NTYzNDAxMzEwMDMiLCJiaWRkZXJzIjpbIkFQUE5FWFVTIiwiVEVBRFMiLCJJWCIsIkFNQVpPTiIsIkJDIiwiQlRBIiwiQ09ERSIsIlhBTkRSX0JBTk5FUiJdLCJzaXplcyI6WyI5OTR4MTE4IiwiMTAwMHg1MDAiLCI5OTR4NTAwIiwiMTAwMHgyNTAiLCI3Mjh4OTAiLCI5NzB4MjUwIiwiOTk0eDI1MCIsIjk4MHgyNTAiXSwiZGl2SWQiOiJhZG56X2JpbGxib2FyZF8xIn0sImV2ZW50SWQiOjg2MjQxNTgyNDM2MzA5MDMsInBhZ2VJbXByZXNzaW9uSWQiOjMwMzgwMjE2Mzk4NzI5NywidXJsIjoiaHR0cHM6Ly93d3cubnp6LmNoL2RldXRzY2hsYW5kIn0seyJ0eXBlIjoiQklEX1JFUVVFU1QiLCJib2R5Ijp7ImhlYWRlclRhZ0lkIjoiOCIsImNyZWF0ZWQiOjE2MzI4Mzc0MzQxNjcsInJlcXVlc3RJZCI6IjEyOTE4NTYzNDAxMzEwMDMiLCJiaWRkZXJzIjpbIkFQUE5FWFVTIiwiVEVBRFMiLCJJWCIsIkFNQVpPTiIsIkJDIiwiQlRBIiwiQ09ERSIsIlhBTkRSX0JBTk5FUiJdLCJzaXplcyI6WyI3Mjh4MTQwIiwiOTk0eDExOCIsIjEwMDB4NTAwIiwiOTk0eDUwMCIsIjk3MHgyNTAiLCI5OTR4MjUwIl0sImRpdklkIjoiYWRuel9iaWxsYm9hcmRfMyJ9LCJldmVudElkIjo4NzIxOTYyMjA0MzExMjA5LCJwYWdlSW1wcmVzc2lvbklkIjozMDM4MDIxNjM5ODcyOTcsInVybCI6Imh0dHBzOi8vd3d3Lm56ei5jaC9kZXV0c2NobGFuZCJ9LHsidHlwZSI6IkJJRF9SRVFVRVNUIiwiYm9keSI6eyJoZWFkZXJUYWdJZCI6IjgiLCJjcmVhdGVkIjoxNjMyODM3NDM0MTY3LCJyZXF1ZXN0SWQiOiIxMjkxODU2MzQwMTMxMDAzIiwiYmlkZGVycyI6WyJBUFBORVhVUyIsIlRFQURTIiwiSVgiLCJBTUFaT04iLCJCQyIsIkJUQSIsIkNPREUiLCJYQU5EUl9CQU5ORVIiXSwic2l6ZXMiOlsiNzI4eDE0MCIsIjk5NHgxMTgiLCIxMDAweDUwMCIsIjk5NHg1MDAiLCI5NzB4MjUwIiwiOTk0eDI1MCJdLCJkaXZJZCI6ImFkbnpfYmlsbGJvYXJkXzQifSwiZXZlbnRJZCI6MTg3NDk0ODI0ODA0ODM5NywicGFnZUltcHJlc3Npb25JZCI6MzAzODAyMTYzOTg3Mjk3LCJ1cmwiOiJodHRwczovL3d3dy5uenouY2gvZGV1dHNjaGxhbmQifSx7InR5cGUiOiJIRUFERVJfQVVDVElPTiIsImJvZHkiOnsiYWRUYWdJZCI6OCwiZGl2SWQiOiJhZG56X3RvcF8xIiwiaXNSZWxvYWQiOmZhbHNlLCJzaXplTWFwcGluZ0lkIjo4NjM5fSwiZXZlbnRJZCI6NjQzMTY1NzQ3MzI1NzY3NSwicGFnZUltcHJlc3Npb25JZCI6MzAzODAyMTYzOTg3Mjk3LCJ1cmwiOiJodHRwczovL3d3dy5uenouY2gvZGV1dHNjaGxhbmQifSx7InR5cGUiOiJIRUFERVJfQVVDVElPTiIsImJvZHkiOnsiYWRUYWdJZCI6OCwiZGl2SWQiOiJhZG56X21heGlib2FyZF8xIiwiaXNSZWxvYWQiOmZhbHNlLCJzaXplTWFwcGluZ0lkIjoxMzN9LCJldmVudElkIjo4Mjk5NTUxNzg0MzYzOSwicGFnZUltcHJlc3Npb25JZCI6MzAzODAyMTYzOTg3Mjk3LCJ1cmwiOiJodHRwczovL3d3dy5uenouY2gvZGV1dHNjaGxhbmQifSx7InR5cGUiOiJIRUFERVJfQVVDVElPTiIsImJvZHkiOnsiYWRUYWdJZCI6OCwiZGl2SWQiOiJhZG56X3NreXNjcmFwZXJfMSIsImlzUmVsb2FkIjpmYWxzZSwic2l6ZU1hcHBpbmdJZCI6MTQwfSwiZXZlbnRJZCI6NDA5NDUyMTk5MTg3NzI2MSwicGFnZUltcHJlc3Npb25JZCI6MzAzODAyMTYzOTg3Mjk3LCJ1cmwiOiJodHRwczovL3d3dy5uenouY2gvZGV1dHNjaGxhbmQifSx7InR5cGUiOiJIRUFERVJfQUxMT1dFRCIsImJvZHkiOnsiYWRUYWdJZCI6OCwiZGl2SWQiOiJhZG56X3RvcF8xIiwiaXNSZWxvYWQiOmZhbHNlLCJzaXplTWFwcGluZ0lkIjo4NjM5fSwiZXZlbnRJZCI6NTQwMTUxOTI2NTMxODg4NSwicGFnZUltcHJlc3Npb25JZCI6MzAzODAyMTYzOTg3Mjk3LCJ1cmwiOiJodHRwczovL3d3dy5uenouY2gvZGV1dHNjaGxhbmQifSx7InR5cGUiOiJIRUFERVJfQUxMT1dFRCIsImJvZHkiOnsiYWRUYWdJZCI6OCwiZGl2SWQiOiJhZG56X21heGlib2FyZF8xIiwiaXNSZWxvYWQiOmZhbHNlLCJzaXplTWFwcGluZ0lkIjoxMzN9LCJldmVudElkIjo0MDQyNzA2NjY1Mzk0ODIxLCJwYWdlSW1wcmVzc2lvbklkIjozMDM4MDIxNjM5ODcyOTcsInVybCI6Imh0dHBzOi8vd3d3Lm56ei5jaC9kZXV0c2NobGFuZCJ9LHsidHlwZSI6IkhFQURFUl9BTExPV0VEIiwiYm9keSI6eyJhZFRhZ0lkIjo4LCJkaXZJZCI6ImFkbnpfc2t5c2NyYXBlcl8xIiwiaXNSZWxvYWQiOmZhbHNlLCJzaXplTWFwcGluZ0lkIjoxNDB9LCJldmVudElkIjoyMjcyNDY1NDExMzcyNjEsInBhZ2VJbXByZXNzaW9uSWQiOjMwMzgwMjE2Mzk4NzI5NywidXJsIjoiaHR0cHM6Ly93d3cubnp6LmNoL2RldXRzY2hsYW5kIn0seyJ0eXBlIjoiSEVBREVSX0dQVF9JTkpFQ1RFRCIsImJvZHkiOnsiYWRUYWdJZCI6OCwiZGl2SWQiOiJhZG56X3RvcF8xIiwiaXNSZWxvYWQiOmZhbHNlLCJzaXplTWFwcGluZ0lkIjo4NjM5fSwiZXZlbnRJZCI6NTk3NjkyNjA1MzQ4NzU0NSwicGFnZUltcHJlc3Npb25JZCI6MzAzODAyMTYzOTg3Mjk3LCJ1cmwiOiJodHRwczovL3d3dy5uenouY2gvZGV1dHNjaGxhbmQifSx7InR5cGUiOiJIRUFERVJfR1BUX0lOSkVDVEVEIiwiYm9keSI6eyJhZFRhZ0lkIjo4LCJkaXZJZCI6ImFkbnpfbWF4aWJvYXJkXzEiLCJpc1JlbG9hZCI6ZmFsc2UsInNpemVNYXBwaW5nSWQiOjEzM30sImV2ZW50SWQiOjU5NDA1ODg5ODE0ODQxODEsInBhZ2VJbXByZXNzaW9uSWQiOjMwMzgwMjE2Mzk4NzI5NywidXJsIjoiaHR0cHM6Ly93d3cubnp6LmNoL2RldXRzY2hsYW5kIn0seyJ0eXBlIjoiSEVBREVSX0dQVF9JTkpFQ1RFRCIsImJvZHkiOnsiYWRUYWdJZCI6OCwiZGl2SWQiOiJhZG56X3NreXNjcmFwZXJfMSIsImlzUmVsb2FkIjpmYWxzZSwic2l6ZU1hcHBpbmdJZCI6MTQwfSwiZXZlbnRJZCI6MjgzODk3Mzg4NTQ2NzY3NSwicGFnZUltcHJlc3Npb25JZCI6MzAzODAyMTYzOTg3Mjk3LCJ1cmwiOiJodHRwczovL3d3dy5uenouY2gvZGV1dHNjaGxhbmQifSx7InR5cGUiOiJCSURfV0lOTkVSIiwiYm9keSI6eyJoZWFkZXJUYWdJZCI6IjgiLCJjcmVhdGVkIjoxNjMyODM3NDM0MTgzLCJzaXplTWFwcGluZ0lkIjoiIiwic2l6ZSI6IiIsInJlcXVlc3RJZCI6IjEyOTE4NTYzNDAxMzEwMDMiLCJkaXZJZCI6ImFkbnpfdG9wXzEiLCJiaWRkZXJTY29yZXMiOnsiQVBQTkVYVVMiOm51bGwsIlRFQURTIjpudWxsLCJJWCI6bnVsbCwiQU1BWk9OIjpudWxsLCJCQyI6bnVsbCwiQlRBIjpudWxsLCJDT0RFIjpudWxsLCJYQU5EUl9CQU5ORVIiOm51bGx9fSwiZXZlbnRJZCI6MTI0MTE5MTE5OTQ1NjQ2MywicGFnZUltcHJlc3Npb25JZCI6MzAzODAyMTYzOTg3Mjk3LCJ1cmwiOiJodHRwczovL3d3dy5uenouY2gvZGV1dHNjaGxhbmQifSx7InR5cGUiOiJIRUFERVJfQURfSU1QUkVTU0lPTiIsImJvZHkiOnsiYWRUYWdJZCI6OCwiZGl2SWQiOiJhZG56X3RvcF8xIiwiaXNSZWxvYWQiOmZhbHNlLCJpc0RlbGl2ZXJlZCI6ZmFsc2UsInNpemVNYXBwaW5nSWQiOjg2Mzl9LCJldmVudElkIjoyNDM2MDI1MTMzNjY3MTExLCJwYWdlSW1wcmVzc2lvbklkIjozMDM4MDIxNjM5ODcyOTcsInVybCI6Imh0dHBzOi8vd3d3Lm56ei5jaC9kZXV0c2NobGFuZCJ9XQ%3D%3D
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.3.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:14 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aO8fUu%2BQyFKIjBE9JVQ%2BjmmnJ9aaC5GZAHmTASTzF%2B1fnDBCsOou63amLIDz5wnWw7hMZkJef4V3hgKZCl2JB6s4iqEOZrU4G41XhTQR27dOZgKBhQO0SPLdYTtf"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://www.nzz.ch
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
cf-ray: 695d7aced85927a0-PRG

GET
H3 200 container.html Show response
6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2CE4 6 KB
3 KB 22ms
8ms Document
text/html 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html?n=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.nzz.ch/deutschland
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 28 Sep 2021 13:57:14 GMT
expires: Wed, 28 Sep 2022 13:57:14 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame B1B9 72 KB
27 KB 35ms
34ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5668ad294690c0def710438c8462f2eb7ece9e8ef4b7ab53cb93a45d1f8cd7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27596
x-xss-protection: 0
server: sffe
etag: "1632742284803949"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Tue, 28 Sep 2021 13:57:14 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame B1B9 11 KB
9 KB 46ms
22ms XHR
application/json 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021091501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

287f77f505c7fee9681e8e16414793563658bfdd41e9c844d00c4727eaad8c59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 28 Sep 2021 13:57:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8519
x-xss-protection: 0

GET
H3 200 container.html Show response
cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 104F 6 KB
3 KB 8ms
7ms Document
text/html 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js?31062950

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html?n=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.nzz.ch/deutschland
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 28 Sep 2021 13:57:14 GMT
expires: Wed, 28 Sep 2022 13:57:14 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9AB4 72 KB
27 KB 37ms
36ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js?31062950

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5668ad294690c0def710438c8462f2eb7ece9e8ef4b7ab53cb93a45d1f8cd7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27596
x-xss-protection: 0
server: sffe
etag: "1632742284803949"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Tue, 28 Sep 2021 13:57:14 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 9AB4 11 KB
8 KB 20ms
20ms XHR
application/json 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021091501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js?31062950

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f10.1e100.net

Software

cafe /

Resource Hash

0f79adbe66c31263ff541c560e95df8afa65dc8c7555c92b1177db4f657dbc2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 28 Sep 2021 13:57:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8478
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame 2CE4 2 KB
604 B 38ms
16ms Stylesheet
text/css 142.250.185.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400

Requested by

Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e89a316ebf1c63ea09e2b7b5889fb55e1ffb326c7b2b172027da0948f5709f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 28 Sep 2021 13:04:36 GMT
server: ESF
date: Tue, 28 Sep 2021 13:57:14 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 28 Sep 2021 13:57:14 GMT

GET
H2 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 2CE4 1 KB
959 B 37ms
14ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2911b334d84ae35bdef7cb396241b38425398b6ae5f91f13a72943e805309ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:46:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 641
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 852
x-xss-protection: 0
server: cafe
etag: 14170629819630813772
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Oct 2021 13:46:33 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 2CE4 0
0 41ms
41ms Fetch
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cu9rzOh9TYaLtD5n87_UPgNyRmASRzserY67D6_bDC9nPssW2GhABIP_tmzhgyQagAavt590DyAEJ4AIAqAMByAObBKoE8gFP0H-wSNZlYRmdj5ywVnehNPpVf63rvACB0O2CJH55QIAKE0LqVw0U_KBgvllBFObAkifqO0FTNbehhFO0B4CeMiuDZH-tROTxTCKTVt4x11hd5l9L2ZsoMyPsjGlJvhYC409niUWs2V7rvXifV-GmHMpg7dIN0YSNamtKmEWrIb7hXV1MkKfEV21EQLQrBcpnjdUhAG3QmU4Ofn3KdWCHs3jm5RYchWswxro8DEguuliIqM1ODCYWzYZJzQznIDPaq8OibAuIpAC8O1hQywMiaGTeupprme1yEtB8UIC66J20bi5qxTbnuf7CsCFCUHK10sAE_56V0PQC4AQBkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBi6AB72SmCKoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G9gHAPIHBBDesDPSCAcIgGEQARgdgAoDyAsB2BMO0BUBmBYBgBcBshceChwIABIUcHViLTg0OTAzMTc3MzYyMzUxMTEY56oe&sigh=-L2fLGFCXBE&template_id=494
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s11-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame 2CE4 18 KB
8 KB 28ms
6ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite_fy2019.js

Requested by

Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

830527b04ff3e5ae7d8f62ecb5f1aa2ece85a7a741b332051561787b52ddffcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:42:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 889
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7635
x-xss-protection: 0
server: cafe
etag: 15605042170853735879
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Oct 2021 13:42:25 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 2CE4 3 KB
1 KB 37ms
15ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/window_focus_fy2019.js

Requested by

Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:56:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Oct 2021 13:56:49 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2CE4 122 KB
37 KB 33ms
32ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2e2201192d8a342b5f570c4418dc4dcd2c0460243b4f9ba99c60a7c312d13e50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37837
x-xss-protection: 0
server: sffe
etag: "1632742272549041"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Tue, 28 Sep 2021 13:57:14 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 2CE4 14 KB
6 KB 29ms
7ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f10.1e100.net

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Oct 2021 13:57:08 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 2CE4 0
0 35ms
18ms Image
text/html 142.250.181.228
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTHyUrYf1obmv0WxHe2XwEoTN8_84HGidyJE4w2fyhDnRtHrpb1kOueIFIAO5BuCKhVs0lOEiWzzLNlyhtKS_fQX2nXuA
Requested by: Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.181.228 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s56-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 a05f1579543550f3e279366fb116adbd.js Show response
www.gstatic.com/mysidia/ Frame 2CE4 27 KB
12 KB 31ms
8ms Script
text/javascript 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a05f1579543550f3e279366fb116adbd.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

6cd4fdef93aef355d2c534bc7de3d08d9723234a1b0cf6161652193f34e4f820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 23 Sep 2021 03:59:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 467841
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11147
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 03:50:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Wed, 22 Dec 2021 03:59:53 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 104F 2 KB
1017 B 30ms
16ms Stylesheet
text/css 142.250.185.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e89a316ebf1c63ea09e2b7b5889fb55e1ffb326c7b2b172027da0948f5709f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 28 Sep 2021 13:57:12 GMT
server: ESF
date: Tue, 28 Sep 2021 13:57:14 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 28 Sep 2021 13:57:14 GMT

GET
H2 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 104F 1 KB
913 B 32ms
14ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2911b334d84ae35bdef7cb396241b38425398b6ae5f91f13a72943e805309ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:46:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 641
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 852
x-xss-protection: 0
server: cafe
etag: 14170629819630813772
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Oct 2021 13:46:33 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 104F 0
0 41ms
40ms Fetch
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CdU1NOh9TYZSzEM3B-gbrraqwA86X97RlmamdnvUMravIl64kEAEg_-2bOGDJhoCA3KPcEKABt9y9_wPIAQngAgCoAwHIA5sEqgTyAU_Qow0dq8ibudwC1Oe08x1oT58WiKxeVHm9zbKG0We5w3XlwmDK6VdM87nEwrJpVyBLOsEkIiLMxl8DP6VSvEl8xPV9JoWlOVArWt0hULRVfa9cKtjanko2jAxr2KGMbRjLCt1jP-Jx1lW843BYpy3Q18qe9LDDBIEnJBy8GB1dElbE_9OiCHRqF684tLUDNZ0jipH5rRinRaz76fQ-DntG8MUcvuxHSvgM4kdR57DZ1IhmbwQVJIjjfKljZBkFrT2YnwzILL9ethblbFX_ulhWaPl4Fyal9MJqg9c_xEnwNHPPjV1itYbKItJZp6l58W1XwATMla_RvQPgBAGSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAHsaNCqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhvYBwDyBwQQkPsU0ggHCIBhEAEYHYAKA8gLAdgTDtAVAZgWAYAXAbIXHgocCAASFHB1Yi04NDkwMzE3NzM2MjM1MTExGOeqHg&sigh=aRmyXgYDlBw&template_id=494
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s11-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame 104F 18 KB
8 KB 29ms
12ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite_fy2019.js

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

830527b04ff3e5ae7d8f62ecb5f1aa2ece85a7a741b332051561787b52ddffcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:42:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 889
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7635
x-xss-protection: 0
server: cafe
etag: 15605042170853735879
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Oct 2021 13:42:25 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 104F 3 KB
1 KB 31ms
15ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/window_focus_fy2019.js

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:56:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Oct 2021 13:56:49 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 104F 122 KB
37 KB 43ms
43ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2e2201192d8a342b5f570c4418dc4dcd2c0460243b4f9ba99c60a7c312d13e50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37837
x-xss-protection: 0
server: sffe
etag: "1632742272549041"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Tue, 28 Sep 2021 13:57:14 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 104F 14 KB
6 KB 29ms
13ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Oct 2021 13:57:08 GMT

GET
H2 200 a05f1579543550f3e279366fb116adbd.js Show response
www.gstatic.com/mysidia/ Frame 104F 27 KB
11 KB 26ms
8ms Script
text/javascript 142.250.181.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a05f1579543550f3e279366fb116adbd.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f3.1e100.net

Software

sffe /

Resource Hash

6cd4fdef93aef355d2c534bc7de3d08d9723234a1b0cf6161652193f34e4f820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 23 Sep 2021 03:59:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 467841
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11147
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 03:50:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Wed, 22 Dec 2021 03:59:53 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame B1B9 17 KB
7 KB 42ms
28ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 28 Sep 2021 13:57:14 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 2CE4 12 KB
13 KB 38ms
6ms Image
image/jpeg 172.217.23.110
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcQNd6KtiFc8zs7ADjD4tVvn_SWuvO4PeHG4JvBR83tUQrCpfrRq7o0iE9js2g&usqp=CAI

Requested by

Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c182a8c58b53a38a5bfac5d3005a17c541bec35aa9cbe5442b184fb48e5420f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 11:46:18 GMT
x-content-type-options: nosniff
age: 7856
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12441
x-xss-protection: 0
last-modified: Sun, 08 Nov 2020 02:31:56 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Wed, 28 Sep 2022 11:46:18 GMT

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame 2CE4 13 KB
14 KB 42ms
7ms Image
image/jpeg 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcSC8ZnNvJ3vK61rRytke6MCcqD8JIQC0ae_oY6BAyLEdmuLZXmOS76hu7cwpto&usqp=CAI

Requested by

Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e19f8cbe91970895e90569f7e6761450dd84017f1843aaacacade260596bae5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 06:41:53 GMT
x-content-type-options: nosniff
age: 26121
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13447
x-xss-protection: 0
last-modified: Fri, 28 Jun 2019 08:30:30 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Wed, 28 Sep 2022 06:41:53 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 2CE4 9 KB
9 KB 41ms
8ms Image
image/jpeg 172.217.23.110
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcTqLM_Rq9dG2EsFnQrAzGGgtdzBWBxetdkU9HCfT0NRnNlLrnAuq572GQ8hfQ&usqp=CAI

Requested by

Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f14.1e100.net

Software

sffe /

Resource Hash

e0427c0b4293087448bc79cfc944a8300d0f0151f01ca6bc7f626140ccd3e3f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 02:48:01 GMT
x-content-type-options: nosniff
age: 40153
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8734
x-xss-protection: 0
last-modified: Fri, 16 Apr 2021 10:35:30 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Wed, 28 Sep 2022 02:48:01 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame 2CE4 15 KB
16 KB 48ms
6ms Image
image/jpeg 142.250.181.238
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcTVHJJJJDI4GGEu4AjuiFDSV0VgU1TaYvho4f4Z8qZ4l8DEshyIR89_lR5VFcA&usqp=CAI

Requested by

Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5cd1e3d926ae88723bb5d3b183bf54e2f4d0cc74996b73fcb64f205a504d6700

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 02:48:01 GMT
x-content-type-options: nosniff
age: 40153
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15702
x-xss-protection: 0
last-modified: Fri, 30 Jul 2021 09:43:55 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Wed, 28 Sep 2022 02:48:01 GMT

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame 2CE4 4 KB
4 KB 42ms
9ms Image
image/png 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcRAhnT6mdHg16Q9wHJNQmAZMQqDnvis8HfpzHV-MP12l4g0qRqO&usqp=CAI

Requested by

Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97b5dea59a02da0918729a67b647665321a2d2fb8e97befdac7093a5679687ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 12:27:38 GMT
x-content-type-options: nosniff
age: 264576
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4256
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 12:54:22 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sun, 25 Sep 2022 12:27:38 GMT

GET
DATA 200
OK truncated
/ Frame 104F 358 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7a785e674d7e0a971efb769521d506914d875c0cbb461fbf0ee92885725ef03d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 9AB4 17 KB
6 KB 38ms
22ms Script
text/javascript 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js?31062950

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 28 Sep 2021 13:57:14 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8487 1 KB
749 B 21ms
6ms Document
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 27 Sep 2021 21:06:15 GMT
expires: Tue, 28 Sep 2021 21:06:15 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 60659
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 2CE4 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f393e266f5edc04fd1201cf2bb1d75d5443b1430a53bdeb19a71f8355b792c25

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 88D2 1 KB
749 B 7ms
7ms Document
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f14.1e100.net

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 27 Sep 2021 21:06:15 GMT
expires: Tue, 28 Sep 2021 21:06:15 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 60659
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame 104F 16 KB
16 KB 52ms
10ms Image
image/jpeg 142.250.185.206
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcQ9s_reXhVNixBVhvDf0ozZLwK0qZqjtxWRR-P76N7RRra-tJQ&usqp=CAI

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c4566c1cb9ef1404394e7031cdbd40e982ac3694fb8aadd837d79981121e387

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 09:11:53 GMT
x-content-type-options: nosniff
age: 535522
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15983
x-xss-protection: 0
last-modified: Sat, 26 Jun 2021 04:21:24 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Thu, 22 Sep 2022 09:11:53 GMT

GET
H3 200 shopping
encrypted-tbn3.gstatic.com/ Frame 104F 16 KB
16 KB 27ms
11ms Image
image/jpeg 172.217.23.110
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcRzCnuFYz6mO_fUXfEeH2yumRfwCndERyKwJDQ6RaKm8-adzMed&usqp=CAI

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f14.1e100.net

Software

sffe /

Resource Hash

0a20246c66c877e70b1cc85ea833d1edff071532f097e7bac9f561cf442a5376

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 10:38:12 GMT
x-content-type-options: nosniff
age: 98343
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16343
x-xss-protection: 0
last-modified: Mon, 01 Mar 2021 10:13:05 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Tue, 27 Sep 2022 10:38:12 GMT

GET
H3 200 shopping
encrypted-tbn2.gstatic.com/ Frame 104F 21 KB
21 KB 24ms
9ms Image
image/jpeg 142.250.181.238
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcQNYoDzbfnlkzaDCEqkqDzYu9Y3zWES6fzkuARsj2GyiK0DyzTr&usqp=CAI

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4a6ef87bab84067c73fc1a32b3220c65a8f2b199b2aa30509c576287cb291ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 02:16:33 GMT
x-content-type-options: nosniff
age: 128442
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21542
x-xss-protection: 0
last-modified: Fri, 02 Jul 2021 03:17:52 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Tue, 27 Sep 2022 02:16:33 GMT

GET
H3 200 shopping
encrypted-tbn3.gstatic.com/ Frame 104F 26 KB
26 KB 24ms
10ms Image
image/jpeg 172.217.23.110
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcT1AmbysVXqbYdKPNyDYtIV8Qe7VDaI0uOJ2jQFjPsqP7_j93hRNj2QCuSmmiE&usqp=CAI

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3cfc9e4a533001ccd8d806abf09917a99595d905287c614c7abd5f8d7ec04db1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 24 Sep 2021 01:21:43 GMT
x-content-type-options: nosniff
age: 390932
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26732
x-xss-protection: 0
last-modified: Fri, 06 Aug 2021 02:07:11 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sat, 24 Sep 2022 01:21:43 GMT

GET
H3 200 shopping
encrypted-tbn1.gstatic.com/ Frame 104F 44 KB
44 KB 27ms
11ms Image
image/jpeg 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcQyQ6PUTC93iqHtFJwQQjJqalg6QrysB7kT4igLfLbguaYTHPmKxoz33zrbIWM&usqp=CAI

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8b2f8b74c77cd4e6de2b8bedcec961f9ce6d9de5273bcc6e5209bc3f26328206

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 23 Sep 2021 20:07:13 GMT
x-content-type-options: nosniff
age: 409802
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44559
x-xss-protection: 0
last-modified: Thu, 21 Jun 2018 14:48:02 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 23 Sep 2022 20:07:13 GMT

GET
H3 200 shopping
encrypted-tbn1.gstatic.com/ Frame 104F 18 KB
18 KB 29ms
14ms Image
image/jpeg 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcTuWTg5adbXFPvLiL7XugSBhcu4uj1Aqej3wc8E_TrLm5jl5aiEogW5f_v-Bg&usqp=CAI

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28422aaf080aeed54007a95cafe2ac4af4706535a08b59eba913fc5179cbc319

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:57:03 GMT
x-content-type-options: nosniff
age: 68412
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18886
x-xss-protection: 0
last-modified: Sun, 06 Sep 2020 08:51:26 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Tue, 27 Sep 2022 18:57:03 GMT

GET
H3 200 shopping
encrypted-tbn1.gstatic.com/ Frame 104F 23 KB
23 KB 24ms
9ms Image
image/jpeg 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcSs0LcU0tXo2aahNRRgVMMArWeTURC_bn20rj_GrjijUQjqewyA&usqp=CAI

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f14.1e100.net

Software

sffe /

Resource Hash

3510c17bd115441e228824146e8e9e796a88f97cdd3feb1f1b858668ab95fec0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 24 Sep 2021 21:28:33 GMT
x-content-type-options: nosniff
age: 318522
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23062
x-xss-protection: 0
last-modified: Mon, 01 Mar 2021 12:16:03 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sat, 24 Sep 2022 21:28:33 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame 104F 28 KB
28 KB 54ms
13ms Image
image/jpeg 142.250.185.206
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcS8a0F8I71tJRAimVqmG1TzU4zLClaNWZEaac_E9SHFnp6BS2mM&usqp=CAI

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7d0630091e14572284df0c90a1bff173fd06949e30d364e9414948760062176

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 02:16:33 GMT
x-content-type-options: nosniff
age: 128442
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28577
x-xss-protection: 0
last-modified: Mon, 01 Mar 2021 12:05:46 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Tue, 27 Sep 2022 02:16:33 GMT

GET
H3 200 shopping
encrypted-tbn3.gstatic.com/ Frame 104F 16 KB
16 KB 23ms
10ms Image
image/png 172.217.23.110
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcSZNY3J4CXGu3_xAEiS4N7KCQk71QZfvKJSUNfkkppLkCfTGQds&usqp=CAI

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fed7c1d8d0232f14c3d6327e182b176ebcf52c37c14875a3e7eceb4552744452

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:08:43 GMT
x-content-type-options: nosniff
last-modified: Sat, 24 Mar 2018 07:49:28 GMT
server: sffe
age: 2912
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
content-type: image/png
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16243
x-xss-protection: 0
expires: Wed, 28 Sep 2022 13:08:43 GMT

GET
DATA 200
OK truncated
/ Frame 104F 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b566f395c77e404ff0e195702aae8abe9a98c071f320d0027a6e8e996757e70

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame D9A5 12 KB
5 KB 7ms
7ms Document
text/html 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.nzz.ch/deutschland
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Tue, 28 Sep 2021 13:52:25 GMT
expires: Wed, 28 Sep 2022 13:52:25 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 290
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 3D59 783 B
532 B 18ms
18ms Document
text/html 142.250.181.228
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.228 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f4.1e100.net

Software

GSE /

Resource Hash

1ac8035ea8b6889420c12c8640892b6b51179fb472af38a773fdba4406525031

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-YsVartgTzmlI/+IDYqh/dA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.nzz.ch/deutschland
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Tue, 28 Sep 2021 13:57:15 GMT
date: Tue, 28 Sep 2021 13:57:15 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-YsVartgTzmlI/+IDYqh/dA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 510
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
fonts.gstatic.com/s/googlesansdisplay/v15/ Frame 2CE4 20 KB
21 KB 31ms
7ms Font
font/woff2 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesansdisplay/v15/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

475700259e64d480d1a70023e14741bb298a025e338bb608552e2472d4505a65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 14:27:55 GMT
x-content-type-options: nosniff
age: 170960
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20900
x-xss-protection: 0
last-modified: Mon, 19 Apr 2021 22:53:16 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:27:55 GMT

GET
H2 200 ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
fonts.gstatic.com/s/googlesansdisplay/v15/ Frame 104F 20 KB
20 KB 37ms
13ms Font
font/woff2 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesansdisplay/v15/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

475700259e64d480d1a70023e14741bb298a025e338bb608552e2472d4505a65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 14:27:55 GMT
x-content-type-options: nosniff
age: 170960
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20900
x-xss-protection: 0
last-modified: Mon, 19 Apr 2021 22:53:16 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:27:55 GMT

GET
H2 200 ua-sdk.min.js Show response
web-sdk.urbanairship.com/notify/v1/ 273 KB
44 KB 8ms
8ms Script
application/javascript 35.227.208.151
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://web-sdk.urbanairship.com/notify/v1/ua-sdk.min.js
Requested by: Host: www.nzz.ch
URL: https://www.nzz.ch/deutschland
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.208.151 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 151.208.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: c674e5dfa0f9079f0a93059bf88ac6a7e53e9d6b5e5e9668ddca5741259f2f1e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:53:41 GMT
content-encoding: gzip
age: 214
x-guploader-uploadid: ADPycduZIzzzuDW709VhuJ_0M7m8VeI5eU7toWo0tD4xpCepNNRh9IjLcG4Yv8-wywdPfntAaket_61JiA9z57BqwtY3xHuUUw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 44784
last-modified: Mon, 20 Sep 2021 18:04:19 GMT
server: UploadServer
etag: "15c7aaa9b6cdb4a828136c690ed57262"
x-goog-hash: crc32c=OF/D+A==, md5=FceqqbbNtKgoE2xpDtVyYg==
x-goog-generation: 1632161059706301
cache-control: public,max-age=300,no-transform
x-goog-stored-content-length: 44784
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 28 Sep 2021 13:58:41 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame E1BF 12 KB
5 KB 8ms
7ms Document
text/html 142.250.186.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.nzz.ch/deutschland
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Tue, 28 Sep 2021 13:52:25 GMT
expires: Wed, 28 Sep 2022 13:52:25 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 290
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame C8F7 783 B
534 B 16ms
16ms Document
text/html 142.250.181.228
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.228 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f4.1e100.net

Software

GSE /

Resource Hash

e67625b120a197ceb1443d3fa2e8da141631cc60ae3284a5ca8950743e62b234

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-oRsKE1JSzyeMNrBElIZYzQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.nzz.ch/deutschland
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Tue, 28 Sep 2021 13:57:15 GMT
date: Tue, 28 Sep 2021 13:57:15 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-oRsKE1JSzyeMNrBElIZYzQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8487
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESENl5uE51PzJDahbfj8nyCI0&google_cver=1&google_push=AYg5qPJdSg2JqekZWEXpUMyiITANKd0bQbdeLY6S3T_Rrhl1TyaksoYMss0bDLOpkEr9Fm6Iu20HdWfmG9DyNLgI...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPJdSg2JqekZWEXpUMyiITANKd0bQbdeLY6S3T_Rrhl1TyaksoYMss0bDLOpkEr9Fm6Iu20HdWfmG9DyNLgIUxkw2DfybRIE

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPJdSg2JqekZWEXpUMyiITANKd0bQbdeLY6S3T_Rrhl1TyaksoYMss0bDLOpkEr9Fm6Iu20HdWfmG9DyNLgIUxkw2DfybRIE

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 28 Sep 2021 13:57:15 GMT
Server: MT3 3984 0e3af3b master zrh-pixel-x26 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPJdSg2JqekZWEXpUMyiITANKd0bQbdeLY6S3T_Rrhl1TyaksoYMss0bDLOpkEr9Fm6Iu20HdWfmG9DyNLgIUxkw2DfybRIE
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 28 Sep 2021 13:57:14 GMT

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 8487 0
141 B 39ms
16ms Image
text/plain 34.96.105.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEAtoDfsE0BT9gvAkfDIY2uc&google_cver=1&google_push=AYg5qPI_MoNIYhj8p18wy4eQATQF4kP6Ax_Tb8BHyOIi5F9guQEjwalkKSzwDaZ9hsiauaIdNPlmxZpiro6gsl3lCVbYFxaJjP9I
Requested by: Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:15 GMT
via: 1.1 google
alt-svc: clear

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8487
Redirect Chain

https://px.adhigh.net/p/gm/rub?google_gid=CAESEAJDnJbjxVgwfPKY8MMM3GY&google_cver=1&google_push=AYg5qPLJW-RlFnUqGnoIDGN1jNIx5wmiLbnjLZWb4R-qNPCN60EeqPdaha5w7tbxDF7rLzdvQ-gGoSAHfAOf7gam6Sc-tklYN17-
https://px.adhigh.net/p/gm/rub?google_gid=CAESEAJDnJbjxVgwfPKY8MMM3GY&google_cver=1&google_push=AYg5qPLJW-RlFnUqGnoIDGN1jNIx5wmiLbnjLZWb4R-qNPCN60EeqPdaha5w7tbxDF7rLzdvQ-gGoSAHfAOf7gam6Sc-tklYN17-&...
https://cm.g.doubleclick.net/pixel?google_nid=gint&google_push=AYg5qPLJW-RlFnUqGnoIDGN1jNIx5wmiLbnjLZWb4R-qNPCN60EeqPdaha5w7tbxDF7rLzdvQ-gGoSAHfAOf7gam6Sc-tklYN17-&google_hm=qAZrUPSI5xoAAikABlF8LLH...

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gint&google_push=AYg5qPLJW-RlFnUqGnoIDGN1jNIx5wmiLbnjLZWb4R-qNPCN60EeqPdaha5w7tbxDF7rLzdvQ-gGoSAHfAOf7gam6Sc-tklYN17-&google_hm=qAZrUPSI5xoAAikABlF8LLH_aw%3D%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:15 GMT
server: nginx
access-control-allow-origin: *
x-backend-id: f4-ru
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=gint&google_push=AYg5qPLJW-RlFnUqGnoIDGN1jNIx5wmiLbnjLZWb4R-qNPCN60EeqPdaha5w7tbxDF7rLzdvQ-gGoSAHfAOf7gam6Sc-tklYN17-&google_hm=qAZrUPSI5xoAAikABlF8LLH_aw%3D%3D
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8487
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJsrOfNgLCqZYHHzJYtNwYc&google_cver=1&google_push=AYg5qPK9ffyEddHTeDmAw4tUWt5ZL_Wd1Ll_sVqpXrvnvrj3tmR-yAVOoeKlCS3Rcoxub2MC2jfR9Mm23IihFQZA99G7eTc...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPK9ffyEddHTeDmAw4tUWt5ZL_Wd1Ll_sVqpXrvnvrj3tmR-yAVOoeKlCS3Rcoxub2MC2jfR9Mm23IihFQZA99G7eTccJ_Dq&google_hm=ODY4MTY5NjEyNDg2NzkyOT...

170 B
188 B

19ms
19ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPK9ffyEddHTeDmAw4tUWt5ZL_Wd1Ll_sVqpXrvnvrj3tmR-yAVOoeKlCS3Rcoxub2MC2jfR9Mm23IihFQZA99G7eTccJ_Dq&google_hm=ODY4MTY5NjEyNDg2NzkyOTk0OA%3D%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 28 Sep 2021 13:57:15 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPK9ffyEddHTeDmAw4tUWt5ZL_Wd1Ll_sVqpXrvnvrj3tmR-yAVOoeKlCS3Rcoxub2MC2jfR9Mm23IihFQZA99G7eTccJ_Dq&google_hm=ODY4MTY5NjEyNDg2NzkyOTk0OA%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8487
Redirect Chain

https://sync3.sniperlog.ru/?src=ggl_nga&google_gid=CAESENGvA2_rZcH-xHXwXyPhvvo&google_cver=1&google_push=AYg5qPJCDVfOpjtlvWqRu69KfLLqSKdxmKcxzvNxIymSpTzy84g3XxPh7zx81FO4Qe2-QgOmWJu0CXqB3xV0mwrxMhEu...
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AYg5qPJCDVfOpjtlvWqRu69KfLLqSKdxmKcxzvNxIymSpTzy84g3XxPh7zx81FO4Qe2-QgOmWJu0CXqB3xV0mwrxMhEuM8JAf1DV

170 B
188 B

33ms
18ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AYg5qPJCDVfOpjtlvWqRu69KfLLqSKdxmKcxzvNxIymSpTzy84g3XxPh7zx81FO4Qe2-QgOmWJu0CXqB3xV0mwrxMhEuM8JAf1DV

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 28 Sep 2021 13:57:15 GMT
Server: nginx
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: //cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AYg5qPJCDVfOpjtlvWqRu69KfLLqSKdxmKcxzvNxIymSpTzy84g3XxPh7zx81FO4Qe2-QgOmWJu0CXqB3xV0mwrxMhEuM8JAf1DV
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8487
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEIjZg2leT3zvNZMegzo47Bk&google_cver=1&google_push=AYg5qPKkA7WosIjH6fXbfjhGbTMV7vqCobqxILmw93E3V3nfUawUdG27g1WyYE24_R8mxmvd2wLRNyNvh2bxsgEuqsmeCVP5VlBl
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPKkA7WosIjH6fXbfjhGbTMV7vqCobqxILmw93E3V3nfUawUdG27g1WyYE24_R8mxmvd2wLRNyNvh2bxsgEuqsmeCVP5VlBl&goog...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTU5MTE3ODQzNTIxMTEzNTQ5MDc%3D&google_push=AYg5qPKkA7WosIjH6fXbfjhGbTMV7vqCobqxILmw93E3V3nfUawUdG27g1WyYE...

170 B
188 B

33ms
18ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTU5MTE3ODQzNTIxMTEzNTQ5MDc%3D&google_push=AYg5qPKkA7WosIjH6fXbfjhGbTMV7vqCobqxILmw93E3V3nfUawUdG27g1WyYE24_R8mxmvd2wLRNyNvh2bxsgEuqsmeCVP5VlBl

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTU5MTE3ODQzNTIxMTEzNTQ5MDc%3D&google_push=AYg5qPKkA7WosIjH6fXbfjhGbTMV7vqCobqxILmw93E3V3nfUawUdG27g1WyYE24_R8mxmvd2wLRNyNvh2bxsgEuqsmeCVP5VlBl
date: Tue, 28 Sep 2021 13:57:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET

pixel
cm.g.doubleclick.net/ Frame 8487
Redirect Chain

https://cs.chocolateplatform.com/pub?pid=ebda&google_gid=CAESEM5hHE5nyMB6fS3G_d8VhA8&google_cver=1&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJA3DOzksWs60aFUPvIdzydTtj...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtMmVjYzdlN2U4OTNiNDFmZTVkYjYwYjM4MDY3NTE2ZTk=&google_push=AYg5qPLQQ1kFl18s-zz6QvO1TabAAlS9nYvM9-zXQy2RAFIOUeZtwXCie_hXOJ...

0
0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 8487 0
49 B 38ms
17ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LM0wIk22zvbIHK82a1wi1gZ3Jfat9C-CBzf_9s2pyVXIwcXg2eyUJmPqSG0SC0AXYYFX_9

Requested by

Host: 6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com
URL: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:15 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 88D2
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEK7rMAse0MTB7pkmIFV3dT0&google_cver=1&google_push=AYg5qPJ-uyVkOTK3AGOQcPwx1TOduzNmFIkE3zQU7iQXMk-8yyFFEQ5VAJPv95GmMEmmb28K4DMmIoO...
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=8&google_gid=CAESEK7rMAse0MTB7pkmIFV3dT0&google_cver=1&google_push=AYg5qPJ-uyVkOTK3AGOQcPwx1TOduzNmFIkE3zQU7iQXMk-8yyFFEQ5VAJPv95GmMEmmb...
https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=THnFr8fYRven8ot8pyt3NGFTHzs

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=THnFr8fYRven8ot8pyt3NGFTHzs

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:14 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=THnFr8fYRven8ot8pyt3NGFTHzs
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 88D2
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEJFnmp5zpJA1OTU7pkF_S28&google_cver=1&google_push=AYg5qPJx1a-KCd6iigMDZkecZo9Lie0LDL712HJ1zUzz4rELCjotPw8iIO-Tv18-6_g0ldqNjf7OCJOqUuJoGAaebb4dl1djP1o
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=N0RBNDg0MUMyRTJCN0Y5Nw==

170 B
188 B

18ms
17ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=N0RBNDg0MUMyRTJCN0Y5Nw==

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=N0RBNDg0MUMyRTJCN0Y5Nw==
date: Tue, 28 Sep 2021 13:57:15 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H2 200 dot.gif
s0.2mdn.net/ Frame 88D2 43 B
598 B 47ms
15ms Image
image/gif 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEEpgOMwTl7_JZ6w_ZVv2xx8&google_cver=1&google_push=AYg5qPIj2vSDLxcr_utqTM_RzVTbIMDZx8cgk7mff7ca0f5XmSeFXVvjIVVWB3j6CKGbiapNZK3GjTgD3JeTK7Bpt7MlhhBrhgU

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f6.1e100.net

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:15 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Sep 2021 13:57:15 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 88D2
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEIg7mLTunJQ7g4juZePnVkw&google_cver=1&google_push=AYg5qPInpmI9HJnfGO56SfkOBGtWHsr5CNp74BYnUqwdEWxKMW87d-uPQiRKbSrudkZJXUOnOJBzYPTEHjd-bFXxkI42l_UPsX0
https://rtb.openx.net/sync/dds?google_gid=CAESEIg7mLTunJQ7g4juZePnVkw&google_cver=1&google_push=AYg5qPInpmI9HJnfGO56SfkOBGtWHsr5CNp74BYnUqwdEWxKMW87d-uPQiRKbSrudkZJXUOnOJBzYPTEHjd-bFXxkI42l_UPsX0&o...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPInpmI9HJnfGO56SfkOBGtWHsr5CNp74BYnUqwdEWxKMW87d-uPQiRKbSrudkZJXUOnOJBzYPTEHjd-bFXxkI42l_UPsX0&google_hm=gbkWkUBLwyw9wkvbIVlPKQ==

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPInpmI9HJnfGO56SfkOBGtWHsr5CNp74BYnUqwdEWxKMW87d-uPQiRKbSrudkZJXUOnOJBzYPTEHjd-bFXxkI42l_UPsX0&google_hm=gbkWkUBLwyw9wkvbIVlPKQ==

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:14 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPInpmI9HJnfGO56SfkOBGtWHsr5CNp74BYnUqwdEWxKMW87d-uPQiRKbSrudkZJXUOnOJBzYPTEHjd-bFXxkI42l_UPsX0&google_hm=gbkWkUBLwyw9wkvbIVlPKQ==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: m4jof65rbovp9m1mfktrda4pp0ko9u7v

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 88D2
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_veOCQuoQkqfSXxER7MDGw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

16ms
16ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_veOCQuoQkqfSXxER7MDGw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJpdQ4OAprFolbU0o2M82rczfz7wRYz0qe80KUkO9pTxjTTY8qnylcTDDatn7zXVR9Yq2na9KfjTzu_GPEywjZc0F95eM7W

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_veOCQuoQkqfSXxER7MDGw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJpdQ4OAprFolbU0o2M82rczfz7wRYz0qe80KUkO9pTxjTTY8qnylcTDDatn7zXVR9Yq2na9KfjTzu_GPEywjZc0F95eM7W
date: Tue, 28 Sep 2021 13:57:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET

pixel
cm.g.doubleclick.net/ Frame 88D2
Redirect Chain

https://cs.chocolateplatform.com/pub?pid=ebda&google_gid=CAESEAjuVyFwKys0MgQIA3P2AX8&google_cver=1&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZTnbvS61OXfjGUhs96m8qr1wZ1...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtYWVkYjE4NjAzYzNiNDQzZjUzMGE3MjViMTZmODgwOGE=&google_push=AYg5qPJ4M_lt8AapvNjnZIaBXihDsysE0Yp8hxPGs8iqTiMTuWRpHuzLm6ntZT...

0
0

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame 88D2 0
44 B 765ms
249ms Image
text/plain 18.182.119.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEL5Ckee8904iAYXObuuFuKg&google_cver=1&google_push=AYg5qPKBhrl-t9JWI3rQb1nep5lGdaT103SA7QxGM36kFz14UBw0eqS3NdCPLjGBsJcND89jsY33onqZgFXw9FZ9FXTMV171jvTU
Requested by: Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.182.119.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-182-119-142.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:15 GMT
server: awselb/2.0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 88D2 0
253 B 29ms
16ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KaFpnkTePj0OxmdheCKSUapOzE8eaGoXLiQUKgGShFC51Zee3Ia7grYkz6y8qn02Gra0_6

Requested by

Host: cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com
URL: https://cd16bc80e491b46cd5d90a44c17c5946.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 13:57:15 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 3D59 0
0 24ms
24ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021091501&jk=180415192231688&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s51-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 WAz-nyaJu9uVRUq8NsxhsXGtXViWwv7lV4sP3qP2SqA.js Show response
pagead2.googlesyndication.com/bg/ Frame D9A5 35 KB
13 KB 7ms
7ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WAz-nyaJu9uVRUq8NsxhsXGtXViWwv7lV4sP3qP2SqA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

580cfe9f2689bbdb95454abc36cc61b171ad5d5896c2fee5578b0fdea3f64aa0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 17:18:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13388
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 23:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 27 Sep 2022 17:18:46 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame C8F7 0
0 48ms
48ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021091501&jk=3489286934335887&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s51-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 WAz-nyaJu9uVRUq8NsxhsXGtXViWwv7lV4sP3qP2SqA.js Show response
pagead2.googlesyndication.com/bg/ Frame E1BF 35 KB
13 KB 7ms
7ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WAz-nyaJu9uVRUq8NsxhsXGtXViWwv7lV4sP3qP2SqA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

580cfe9f2689bbdb95454abc36cc61b171ad5d5896c2fee5578b0fdea3f64aa0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 17:18:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13388
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 23:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 27 Sep 2022 17:18:46 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame B1B9 0
0 33ms
32ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gpt_2021091501&jk=180415192231688&bg=!qqmlqe3NAAZNQyuQTUM7ACkAdvg8WjJ3BIxOJca_ZNiKPzubwqzdaxacd2IdlHNGkTBdsSme-C3HbgIAAACZUgAAAAtoAQeZAuT8GerSSiTLLRdUjsozjXByTaW53qQF9srLbxSPrHIY1GQJW88RY4BFlmkuhZYTNszAd36JssYYzKyTPZxLbBeCGAh-quprnL4lZ--OitfpW4v7nlL5G_P5j1C_DlU7Xf7dZYiD-xokdJ0TXlw0AZVNdBQ9un2e9y56negMhyNT2zADOJdABpU4MX9MS0nnIztKdluvNy1TySmt3SPojzs7iyQdBIThksznrWn2nWGd2aVln1muxu_JLZFUnlL2gz69mL42QYUMLhdqM4207RUjSUeiGL0SFY9dQ5QSny9ZdX2UO-QtlBEzgEJ-eUlekJMfUzlNI3L7VioivQh3Q3YAHi6CDwVMowVOtoPNn8TlSRlRK5d4sp286QVWU3o51idcbJ2SLPRFhGdVsRuOpluB15HY_-MuPG5WNvntS8uQlSkVdvFkloQ4wV1zDUkN4ssb7ryehen5VM3w4q5bu-Rp9CinspIlgR1S_ZC7Yn292oyDvMRz1w5GJ6RlhrwfYkw_rJjp-XHFPOQUgBl237w928aKjaxeHkqcnJ-XGh68Qq684u6plTfa2fPNIJtEfRD7Jq42mOWLxQVLoIYzr9n0MF1_9NWdHAKQ3PZYOsdhYnOt-2q9wN2mnu_P0C10rc8oH_gNeWYo92j1VsH6m1mNU27N-2_6ivyXHuNSI2Wyak7EO-1BRmAa8SFIjXMQq0tSLg191WCFEXwu8Wdr3nw0OGvRA9vbORlZyPwwSGvDe9vDvsdJ5rK-rsmZMCAKZ1AXVUuUN6pzhTQrW3S244erXBhBozQlt5YTso1ksywjskyi7JHP90dxqhO9m-9fack-PwBvJpJrRO8gpKahjOZIyVR1Z4om40njpLQmdFVorDi3_V9fGLdtPaYUSPPgQA1A3lOLmfQghEK92ZMMEp1Xn5cPZ_iawFNUxZzxCpuUWpbwL2LluNDiXz_q8-87Czj2DOBP66Sl37PmZoff3NaO8O9wZQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s51-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 9AB4 0
0 25ms
24ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gpt_2021091501&jk=3489286934335887&bg=!BQalBkLNAAZNQyuQTUM7ACkAdvg8Woodx5CRO066bx1tgnkdhPTmySNzs4heICkJ1jWCLCiThdlMLgIAAACRUgAAAAxoAQeZAtOTxxu_O0eQ9jdxLtpSf3_r0NeXwqbvNUE-A1v6WZhhzoxRGb9dyGJRilrP6Y2GTxPMt-6soH7SQBQUi21Q79bdikPeZ9yR6iNmejIiGxhT0dT1z2fekJB7fNcZxYzS_gmlJ7c6ysHP48dKO3BWMd3Dg7VDJqRLAJKBxgsXek1z2iU2evfkcabn1CNfR9oTeswmHssrFaZp4xH8M29Z8_GNrmIlX5G-9wYinKrn6n4MUzKEAQMEWf_0gX5WeD3sgioii1jYFpE3gJUO8FuJ78tdszfL3GKWntK3tzQdaw4CMU9irQczaOalh8jU7RD2i3oM8PUiR6ObVwTJsIUt6Wu616hzK0dYyZ4rVwXGqU2GrKje69WPACB2GTlV6KyKaARsJh-C_ToG1OB9-7s7W1BpKMQJ9U72kC3XgYIeDi0Iq7n87w3wT-V6jxlT1cx2IQkfSybqx8sXld01ap7YcuNluMR19Khver8LAXDtqf129abND3mvYf9VKTDcNoBbDm3s58goRrHCKoHD7rosJ37gnv-4KplhOe32BxLM3oAiVimkWel4yckUqfeV2DjKVkEfN5KtaKbHKeSrYozxOzwqfI1ctqLKnPhjG2ndxB9uwqN0m2NmcePfA_gvgaIPfGv6t1yHCNflXBpZkQ3MimnSbRHHKVRmUUMzemdRuJag-auEiPKOCHQGtNly_6gSnIoW7lmydcn_H3s-XggCOTCzhwRwroJIYtDLjKkrcaYguIU014JnoM0AE72zvHUi_djuQvDR2ORzcwu-npv5Ho60hWbIe-U9Omo8dx6MtEUqr6nQqUvghuVqM5aRCy9VwCjJlzsZeveNwz3KuRChQOoWI2Cf2e6VhNnPJmxdn68RRkxujqlPC0svn8iFC4Lab7oDnflyX-pIy3uL_ULh5zke-1sQqujIMHHFjOUAShEiCD2liZ4nuWHn4vgkPydK3fWV7v8
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s51-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nzz.ch/deutschland
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2CE4 42 B
64 B 52ms
37ms Fetch
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsutqHKMMPHIljMjXjdk-_Voc1Cl5VIDQ4YsDFpIjGg6S7JwNbMyw7le1vYyw6dfpp9T7sxhgmbQVDE3YKdDe4JqjE1mGc2-freKBYirb3PqYw6aR6k&sai=AMfl-YTeh4-RGIJE3IarurH5XD6GOGOBzCYI-9mDguKdd9-LiJA9kvty3QYE4oHU4QydJG-KA676ymx4Zeo8oKuxLdzWhYbZb5pW5E1Re-hYIAE4dAQprahr7kZVg6X5&sig=Cg0ArKJSzPaaF5TEwW_mEAE&cid=CAASFeRoYVX0sEz0EycToHXntL73fuO_tQ&id=lidar2&mcvt=1000&p=0,0,251,994&asp=254,74,505,1068&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210927&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=1232760442&rs=4&met=mue&la=1&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1632837434823&rpt=298&isd=0&lsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6551e64a844d522bd0360a6d25e5b1d2.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Sep 2021 13:57:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 104F 42 B
64 B 42ms
41ms Fetch
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv69_UH6MR6Zygy0d7HqSAj0og6CX7oD4itrQRloNtMAvIuEJrEcQqU1M9vCxEImlq2njkBFbO4nq8zL969jqUR-EFKM4gJ8ALaOwb_Tixku8rTYLQ&sai=AMfl-YS0DidGd9L1nQ2lQB3lBEhUaewOoraeEjIsLUqy4ObRZZbwlgvwaRwixJsGwz2htb2X1oCPSHrfLmoUK7oYCOgvIGdTsLNbCFzx1xHnRoYV4dB1tFscLZbI-FE&sig=Cg0ArKJSzMuYyPXfM7KiEAE&cid=CAASFeRoziqtwTWgbyTzE7affo_IsJON1Q&id=lidar2&mcvt=1009&p=0,0,1000,500&asp=0,1274,1000,1774&mtos=0,0,1009,1009,1009&tos=0,0,1009,0,0&v=20210927&bin=7&avms=nio&bs=0,0&mc=0.6&if=1&app=0&itpl=22&adk=3713083756&rs=4&met=mue&la=1&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1632837434846&rpt=283&isd=0&lsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS