simcast.com Open in urlscan Pro
45.79.244.12 Public Scan

55.133.120.34.bc.googleusercontent.com

Software

nginx/1.21.3 /

Resource Hash

268303e45b1924ab0778d9a9f8392169acfb740426fc78f97d94fce5a251659b

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 02 Sep 2022 14:55:07 GMT
X-Proxy-Origin: 178.162.209.142; 178.162.209.142; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 4f1115c1-5c3c-413c-a0a4-1b1823c80c00
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://simcast.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 472
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 pb Show response
ad.360yield.com/ 0
165 B 108ms
18ms XHR
text/plain 52.57.13.85
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.360yield.com/pb
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.13.85 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-13-85.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Fri, 02 Sep 2022 14:55:07 GMT
access-control-allow-credentials: true
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1 200
OK bidRequest Show response
in-appadvertising.com/api/ 56 B
548 B 450ms
93ms XHR
application/javascript 169.63.109.126
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: https://in-appadvertising.com/api/bidRequest?bidId=106eff7ad23beeca&pubId=30557&sectionId=10399&vers=7.10.0&url=https://simcast.com/?d=updatepopcorntime.xyz&pcid=802&rid=152&a=0&sizes=728x90&tr_wd=0&tr_hd=0&tr_vs=visible
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 169.63.109.126 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: 7e.6d.3fa9.ip4.static.sl-reverse.com
Software: nginx/1.16.1 /
Resource Hash: cb3f04dce74453115950cb5443aee1319ff30b189f306fe533ffc782c7fbfb51

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 02 Sep 2022 14:55:08 GMT
Content-Encoding: gzip
Server: nginx/1.16.1
Transfer-Encoding: chunked
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,OPTIONS,POST
Content-Type: application/javascript
Access-Control-Allow-Origin: https://simcast.com
Cache-control: no-cache
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type, Content-Length, X-Requested-With
Expires: 0

POST
H2 200 bid Show response
s.seedtag.com/c/hb/ 11 B
402 B 85ms
38ms XHR
application/json 35.244.182.124
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://s.seedtag.com/c/hb/bid
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.182.124 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 124.182.244.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 02 Sep 2022 14:55:07 GMT
via: 1.1 google
server: nginx
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
etag: W/"b-OSzRjQUfcriHUprCmY2lR0nxM48"
vary: X-HTTP-Method-Override
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT, HEAD
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11

POST /
prebid.smilewanted.com/ 0
0

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 86ms
63ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 75ea724ff6033acff027f4acbf98f9c62bfa25c71aa1f7170bdae1b8f2307d86

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 02 Sep 2022 14:55:07 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 109ms
83ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 7303ce979cff11a9bf8a5c058d70614f5917bc2fedc6adb02270fea4a30a749b

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 02 Sep 2022 14:55:07 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 103ms
78ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 6b2425bcdce31159c1ae61df2cf9e9db762f72f53dc2ce0387d0b9dc24153eb4

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 02 Sep 2022 14:55:07 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 113ms
90ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 0d1f8dcfa58d7bad57de870c6f0a8022d44485b770bd837059b024a9a9c725b5

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 02 Sep 2022 14:55:07 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 168ms
144ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 8f095972681326307d558169bd8af4448a62357c32043c15b054910ec6684b8d

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 02 Sep 2022 14:55:07 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 106ms
81ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: d0f21f7bab9b9a33ae22f5e2ade6da3e447195160cb15bec48cc3759bbf146c6

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 02 Sep 2022 14:55:07 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 95ms
71ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: cb04b0b5dee9d41bd83e5c6e66bd35d71b977fae5429e4df954cb2b42efb56c4

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 02 Sep 2022 14:55:07 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 116ms
95ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: eb6772d22283cf8e67a6426849698993e490c1a2549dbeaaa267aa0b8307857e

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 02 Sep 2022 14:55:07 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
293 B 78ms
58ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 4196b90cb3895fd71c98159d232ebb87bc2ff607d652ff289f9ac3e0e2fefcbb

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 02 Sep 2022 14:55:07 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 114ms
94ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 87fb39db5ba0d246f51e7cbfdd3cc3f0f97eb7cac77b212962c9d2e67edc37ee

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 02 Sep 2022 14:55:07 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 90ms
70ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: c0692351fb5d669ae92093236e86cb66667045ced800c3557b9af2ad6f90514e

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 02 Sep 2022 14:55:07 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 204ms
180ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 9f0417fbb9eba94192a669512480fe1ab934ee07cab8b66cb8197d3d6b17fce7

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 02 Sep 2022 14:55:07 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
885 B 145ms
96ms XHR
application/json 34.107.148.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUQWX43D
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 375be9366ae318abf83f913e770484096d9228ad5b792b37ec9af771283d560e

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:07 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
154 B 122ms
17ms XHR
text/plain 3.122.24.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.122.24.216 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-122-24-216.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Fri, 02 Sep 2022 14:55:07 GMT
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
153 B 142ms
36ms XHR
text/plain 3.122.24.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.122.24.216 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-122-24-216.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Fri, 02 Sep 2022 14:55:07 GMT
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
153 B 167ms
62ms XHR
text/plain 3.122.24.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.122.24.216 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-122-24-216.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Fri, 02 Sep 2022 14:55:07 GMT
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
153 B 125ms
20ms XHR
text/plain 3.122.24.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.122.24.216 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-122-24-216.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Fri, 02 Sep 2022 14:55:07 GMT
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
153 B 189ms
84ms XHR
text/plain 3.122.24.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.122.24.216 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-122-24-216.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Fri, 02 Sep 2022 14:55:07 GMT
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
153 B 146ms
42ms XHR
text/plain 3.122.24.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.122.24.216 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-122-24-216.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Fri, 02 Sep 2022 14:55:07 GMT
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
153 B 127ms
22ms XHR
text/plain 3.122.24.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.122.24.216 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-122-24-216.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Fri, 02 Sep 2022 14:55:07 GMT
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
153 B 124ms
20ms XHR
text/plain 3.122.24.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.122.24.216 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-122-24-216.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Fri, 02 Sep 2022 14:55:07 GMT
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin

POST
H/1.1 200
OK / Show response
ghb.adtelligent.com/v2/auction/ 5 KB
2 KB 1405ms
1220ms XHR
application/json 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/v2/auction/
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 36bcd05c10e7f310aed3141bf36497d14fab167329446da713c5dc69db3b2a40

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 02 Sep 2022 14:55:08 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://simcast.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 1292

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 215 B
645 B 88ms
23ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=simcast.com&callback=_gfp_s_&client=ca-pub-9565037823771164

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208300101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9565037823771164&plah=simcast.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

eab7573ba40f25ba45f0dbe1f67f38f084b9e8215c1e63679ad74b47c58fba9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 201
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 63ms
24ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=simcast.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 02 Sep 2022 14:55:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 62ms
23ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=simcast.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 02 Sep 2022 14:55:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 49ms
48ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dupdatepopcorntime.xyz%26pcid%3D802%26rid%3D152%26a%3D0&tn=DIV&cls=gdpr-block&ign=false&pw=1600&ph=1200&x=0&y=1060.8

Requested by

Host: simcast.com
URL: https://simcast.com/?d=updatepopcorntime.xyz&pcid=802&rid=152&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 48ms
47ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: simcast.com
URL: https://simcast.com/?d=updatepopcorntime.xyz&pcid=802&rid=152&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 169D 603 B
68 B 84ms
54ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9565037823771164&output=html&adk=1272721408&adf=3838797007&lmt=1662130507&plat=1%3A16777216%2C2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dupdatepopcorntime.xyz%26pcid%3D802%26rid%3D152%26a%3D0&ea=0&pra=5&wgl=1&easpf=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=0&asnd=0&asnp=0&asns=0&asmat=1&asptt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662130507462&bpp=2&bdt=1483&idt=221&shv=r20220831&mjsv=m202208300101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3846861429158&frm=20&pv=2&ga_vid=401720583.1662130508&ga_sid=1662130508&ga_hid=452882297&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842&oid=2&pvsid=3383624281325534&tmod=1746180343&uas=0&nvt=1&ref=http%3A%2F%2Fupdatepopcorntime.xyz%2F&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=246

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 14:55:07 GMT
expires: Fri, 02 Sep 2022 14:55:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 49ms
21ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=452882297&t=pageview&_s=1&dl=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dupdatepopcorntime.xyz%26pcid%3D802%26rid%3D152%26a%3D0&dr=http%3A%2F%2Fupdatepopcorntime.xyz%2F&ul=en-us&de=UTF-8&dt=Simcast%20News%20portal.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAAC~&jid=1265842578&gjid=294726477&cid=401720583.1662130508&tid=UA-205158314-1&_gid=1981841705.1662130508&_r=1&gtm=2ou8v0&z=1144630354

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 187621-164323601241456.js Show response
js-sec.indexww.com/ht/p/ 39 KB
13 KB 58ms
9ms Script
text/javascript 23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/p/187621-164323601241456.js
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: f82f6cf1599100b7836d8b8aa4bd5394e997849487dd6110d70908440c97fa64

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Fri, 02 Sep 2022 14:55:08 GMT
Content-Encoding: gzip
Last-Modified: Fri, 02 Sep 2022 14:25:35 GMT
Server: Apache
ETag: "901f28-9a4f-5e7b280df14b0"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=1960
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 13270
Expires: Fri, 02 Sep 2022 15:27:48 GMT

GET
H2 200 css
fonts.googleapis.com/ 3 KB
704 B 62ms
26ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:600

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3262c2bd70d868ed379b89eb25e964bf826721f17189a5170c352d20a7563f94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 02 Sep 2022 14:12:37 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 02 Sep 2022 14:55:08 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 02 Sep 2022 14:55:08 GMT

GET
H2 200 icon
fonts.googleapis.com/ 569 B
869 B 61ms
26ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/icon?family=Material+Icons

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e2f2597386660b972fe84faa90af129a353e7e8f9990df6f3b14d0165468350f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 02 Sep 2022 14:55:08 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 02 Sep 2022 14:55:08 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 02 Sep 2022 14:55:08 GMT

GET
H3 200 OverlayScrollbars.min.css
cdnjs.cloudflare.com/ajax/libs/overlayscrollbars/1.13.1/css/ 20 KB
5 KB 25ms
15ms Stylesheet
text/css 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/overlayscrollbars/1.13.1/css/OverlayScrollbars.min.css

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

58a8a37fc288ebcb1babc66777ac8c7a922e145d307567c8b7a824dc959c41f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 17336692
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4023
timing-allow-origin: *
last-modified: Wed, 16 Dec 2020 13:04:39 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5fda05e7-4e34"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dS6hWBqWClZRXPthJVFm%2FqjP7ddIDcwMj3sKgALyqvOkhbFxnKQmSpJTywurNYjA3GxlEj6BGGYiyZ1%2FMLRlF%2BcVvQapGRxdtvv%2FZYHi1tyAGfGYs47nNqbX%2BsVnKwH7Ts4fOlOx4cFFhaYHLHGo8oFS"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 744715bc5b93bb95-FRA
expires: Wed, 23 Aug 2023 14:55:08 GMT

GET
H3 200 OverlayScrollbars.min.js Show response
cdnjs.cloudflare.com/ajax/libs/overlayscrollbars/1.13.1/js/ Frame EE51 53 KB
21 KB 23ms
19ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/overlayscrollbars/1.13.1/js/OverlayScrollbars.min.js

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee61ec65bd3bc8cc949991393cfd5aca248620bc53e8ac94f9afe44c30961c0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 838735
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 20502
timing-allow-origin: *
last-modified: Wed, 16 Dec 2020 13:04:39 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5fda05e7-d208"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EXAOmD1cfvEDXRKuHXnwleSxMl%2Bv4hlWIZtEman9p%2BI0iBWDzabOAzfQ49vzaNmZeZaohMGxdIo%2FiXKYEb5nVBWEiS98zP1TVYyD3yxAYXUOlaY%2FVGajU55aH5IkSsxlf5H2za5r1on8xhF88hrCAPkc"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 744715bc5b95bb95-FRA
expires: Wed, 23 Aug 2023 14:55:08 GMT

GET
H2 200 prebid.js Show response
d29xw9s9x32j3w.cloudfront.net/players/library/prebid/6.12.0/ Frame EE51 334 KB
101 KB 438ms
402ms Script
application/javascript 18.66.97.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/players/library/prebid/6.12.0/prebid.js
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-101.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c9fcabd6766d79a49d07a82461fed0b6e2a9bde6bd066d5107c4aabc9a7cbf36

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 23:36:58 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P2
etag: W/"1c7777ec3f15f66750ea282b9545a85d"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript
via: 1.1 367a4718be97a49df7ac0500a986437a.cloudfront.net (CloudFront)
cache-control: no-cache
x-amz-cf-id: 9q_X3Upy2oUzCDURivJvaU83R9ESSCGj6JtWDhDCzcGYYemcpg2Oyw==

GET
H2 200 comScore.gt.min.js Show response
d29xw9s9x32j3w.cloudfront.net/players/library/streamsense/6.3.4.190424/ Frame EE51 335 KB
59 KB 44ms
9ms Script
application/javascript 18.66.97.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/players/library/streamsense/6.3.4.190424/comScore.gt.min.js
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-101.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37da4f4e9645bcde259d1669db9d2548d9ff4f80e72bbe405232924129ae4db7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 12:24:02 GMT
content-encoding: gzip
last-modified: Thu, 16 Jan 2020 23:25:25 GMT
server: AmazonS3
age: 9067
etag: W/"4a51b8991a6b67323936c2eb62e3518e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 367a4718be97a49df7ac0500a986437a.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: FRA56-P2
x-amz-cf-id: 14dX2QoimODpaKwM9nX9Pl6qawqt2aIr0Vux17DYJZh4-Okxkcm1Zw==

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 376 KB
126 KB 77ms
26ms Script
text/javascript 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7cda432fd42a7521a36ef8ea1cf96b14d1049e16f25c32d9fb78d71113267c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 128229
x-xss-protection: 0
expires: Fri, 02 Sep 2022 14:55:08 GMT

GET
H2 200 reddit.png
d29xw9s9x32j3w.cloudfront.net/images/social/ 1 KB
1 KB 51ms
16ms Image
image/png 18.66.97.101
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/images/social/reddit.png
Requested by: Host: simcast.com
URL: https://simcast.com/?d=updatepopcorntime.xyz&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-101.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9861f51d1896f195c45f603bdc6b7f1455817966f5da945371c922a6f8797711

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 15:32:20 GMT
via: 1.1 367a4718be97a49df7ac0500a986437a.cloudfront.net (CloudFront)
last-modified: Fri, 24 Apr 2020 20:07:21 GMT
server: AmazonS3
age: 84168
etag: "cb93bb50e5d021cc38de445a672c18a2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
content-length: 1094
x-amz-cf-id: 2-FVv3PPDLAHI2Co1w8jvuVrHwpJa1li-G_OieVWyFC-XLTfGkoxyw==

GET
H2 200 facebook.png
d29xw9s9x32j3w.cloudfront.net/images/social/ 322 B
638 B 51ms
17ms Image
image/png 18.66.97.101
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/images/social/facebook.png
Requested by: Host: simcast.com
URL: https://simcast.com/?d=updatepopcorntime.xyz&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-101.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0597ab745938c4a2cc0818fc2447beb211629e484fed0b4143bdd6fa5724be61

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 15:51:21 GMT
via: 1.1 367a4718be97a49df7ac0500a986437a.cloudfront.net (CloudFront)
last-modified: Fri, 24 Apr 2020 20:07:21 GMT
server: AmazonS3
age: 83028
etag: "311cf2edc46e82f2a6911332b7db54e1"
x-cache: Hit from cloudfront
content-type: image/png
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
content-length: 322
x-amz-cf-id: LfY2BjvRRnxhVZVov5Vb0sJILfFFLVlfKscFzkX13BOIpP0bw41Veg==

GET
H2 200 twitter.png
d29xw9s9x32j3w.cloudfront.net/images/social/ 832 B
1 KB 51ms
17ms Image
image/png 18.66.97.101
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/images/social/twitter.png
Requested by: Host: simcast.com
URL: https://simcast.com/?d=updatepopcorntime.xyz&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-101.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 94a557b756089fc7dde1c857bb1a2f776dff6aeec3ceead5c2fa2304433b88ee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 03:41:07 GMT
via: 1.1 367a4718be97a49df7ac0500a986437a.cloudfront.net (CloudFront)
last-modified: Fri, 24 Apr 2020 20:07:21 GMT
server: AmazonS3
age: 40442
etag: "8be584e844dabfe22970a0cb943c047e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
content-length: 832
x-amz-cf-id: Zj7LL2GrF7c7M4QoHvzHtDAktu6OWwZysgshyN5ey9KmVoXKaF32HQ==

GET
H2 200 email.png
d29xw9s9x32j3w.cloudfront.net/images/social/ 773 B
1 KB 52ms
17ms Image
image/png 18.66.97.101
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/images/social/email.png
Requested by: Host: simcast.com
URL: https://simcast.com/?d=updatepopcorntime.xyz&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-101.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3b7f1a6aeceeb60c709478e55147a48f4031ac6617b3ab089210f1f1f59b7204

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 00:27:06 GMT
via: 1.1 367a4718be97a49df7ac0500a986437a.cloudfront.net (CloudFront)
last-modified: Fri, 24 Apr 2020 20:07:21 GMT
server: AmazonS3
age: 58395
etag: "4bd445ddc3f9d6101690e15cfc1a04f0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
content-length: 773
x-amz-cf-id: WKnDMCQm3BcIDbhS31sZAEOclL9_wlHVh72dMufNVMcfMt9o_Zr0og==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
187 B 321ms
95ms Ping
image/gif 54.152.91.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=l-4HPEKJUipDngVr&instance=330429&version=7.7.2&age=220902&cmd=PRE_INIT&key=eKVKXbhX&seq=1&order=1&absoluteTime=2880&relativeTime=0.1&canonical=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&EXTREF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&serverHost=embed.sendtonews.com
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.91.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-91-168.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:08 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H2 200 data_read.php Show response
embed.sendtonews.com/player4/ 39 KB
8 KB 203ms
201ms Fetch
text/html 34.199.89.150
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://embed.sendtonews.com/player4/data_read.php?cmd=loadInitial&session=l-4HPEKJUipDngVr&instance=330429&version=7.7.2&age=220902&ESG_key=eKVKXbhX&type=FULL&EXTREF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&ogSet=1
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.199.89.150 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-199-89-150.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 847a02761b8b61a6a7c637f39d44d438e8ac9146e998a66a32e64501af1ce8e9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:08 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=1
content-length: 7772
expires: Fri, 02 Sep 2022 14:55:09 GMT

GET
H2 204 analytics.min.js Show response
cdn.resonate.com/analytics.js/v1/200302733/ Frame EE51 0
96 B 64ms
16ms Script
text/plain 104.18.13.242
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.resonate.com/analytics.js/v1/200302733/analytics.min.js

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.13.242 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
server: cloudflare
cf-ray: 744715bcaefa6983-FRA
date: Fri, 02 Sep 2022 14:55:08 GMT
vary: Accept-Encoding

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ Frame EE51 166 KB
43 KB 83ms
10ms Script
application/javascript 18.66.108.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.108.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-108-49.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37bdde71eda05551adae1974b43916d2fc58ca04bc1b8325aab65e2668152b66

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Fri, 02 Sep 2022 14:48:17 GMT
via: 1.1 0dec5f752f0f332c449471a83f050dd2.cloudfront.net (CloudFront), 1.1 3a21078459f955a33f79dacf082781c4.cloudfront.net (CloudFront)
last-modified: Thu, 01 Sep 2022 20:50:54 GMT
server: AmazonS3
age: 412
etag: W/"d9d3c87337955401df6a2e4474e61700"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-pop: FRA60-P1, FRA56-P5
content-encoding: gzip
x-amz-cf-id: FSQd0EtVX1y8QjfkxrtaEiQNvi-X5O2a2WxcVPM-c2tN3QL-cPg6NQ==

GET
H2 200 / Show response
id.sv.rkdms.com/identity/ 2 B
163 B 315ms
120ms XHR
application/json 3.219.23.242
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://id.sv.rkdms.com/identity/?vendor=idsv2&sv_cid=5274_04512&sv_pubid=SENDTONEWS&sv_domain=simcast.com
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/187621-164323601241456.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.219.23.242 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-219-23-242.compute-1.amazonaws.com
Software: nginx/1.20.2 /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: https://simcast.com
date: Fri, 02 Sep 2022 14:55:08 GMT
access-control-allow-credentials: true
server: nginx/1.20.2
content-length: 2
vary: Origin
content-type: application/json

GET
H2 200 rid Show response
match.adsrvr.org/track/ 63 B
386 B 122ms
32ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=187621
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/187621-164323601241456.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 006bd98893e942b2432219c083669647b4c7620d9dc041acd27c59b113f5e442

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Fri, 02 Sep 2022 14:55:08 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 63
expires: Sun, 02 Oct 2022 14:55:08 GMT

GET
H2 451 identity Show response
api.rlcdn.com/api/ 44 B
356 B 63ms
21ms XHR
text/plain 34.120.133.55
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.rlcdn.com/api/identity?pid=2&rt=envelope

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/187621-164323601241456.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.133.55 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

da45962a1fb4a049c9367ebe9b1b628f071d7a4c9997ee807c01d23f4866e19c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Fri, 02 Sep 2022 14:55:08 GMT
via: 1.1 google
x-content-type-options: nosniff
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
access-control-allow-methods: GET, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame EE51 6 KB
3 KB 25ms
9ms XHR
application/javascript 18.66.108.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.108.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-108-49.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-amz-version-id: tKimXuvhjexkvOlm5D.ynBWfUtiJgbbH
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 45934
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Wed, 24 Aug 2022 19:06:24 GMT
server: AmazonS3
date: Fri, 02 Sep 2022 02:09:35 GMT
vary: Accept-Encoding,Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 edffe6978db53d114a80cda421e0b6b8.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA56-P5
x-amz-cf-id: Ux6AQOqmb1MqvZPQ8qdLfpfGsP-78AU8gqnKRhaKacf22rGkZyX8JQ==

GET
H3 200 bridge3.528.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 6996 637 KB
206 KB 43ms
15ms Document
text/html 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.528.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9bca797e35294210a471d8fedbcb73598cecbdb14fc19b93eae0f1b5ccffdf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 415145
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 210604
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Sun, 28 Aug 2022 19:36:03 GMT
expires: Mon, 28 Aug 2023 19:36:03 GMT
last-modified: Fri, 26 Aug 2022 23:46:55 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ 44 KB
17 KB 102ms
27ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Sep 2022 14:55:08 GMT

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ Frame EE51 248 B
602 B 9ms
8ms XHR
application/json 18.66.108.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fsimcast.com&pubid=6c3f03cd-6fa8-4477-ac05-2c0f4f8da092
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.108.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-108-49.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 7beb96ef759b267b4159270a64ca009646a2e9a725882896b3dd431198b92058

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 13:06:48 GMT
via: 1.1 3a21078459f955a33f79dacf082781c4.cloudfront.net (CloudFront)
server: Server
age: 6499
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://simcast.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-length: 248
x-amz-cf-id: HTfyb7dUgyrAffmDFnJQtSnwPHN_qwSal1m-f-RRpuY9qIuC5C6ZIQ==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 96ms
95ms Ping
image/gif 54.152.91.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=l-4HPEKJUipDngVr&instance=214330429&version=7.7.2&age=220902&cmd=GET&key=eKVKXbhX&c_id=12018&seq=1&order=2&absoluteTime=3122&relativeTime=242.1&canonical=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&EXTREF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&playerCfg=FL
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.91.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-91-168.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:08 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

POST
H2 200 data_stn_l.php
timber.sendtonews.com/timber/ 0
142 B 570ms
133ms Ping
text/html 35.170.30.54
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://timber.sendtonews.com/timber/data_stn_l.php?CMD=GET&ESG_key=eKVKXbhX&ES_key=eKVKXbhX&ES_ID=30800&S_RKEY=PxOCAD1ClE&USR_ID=214330429&ST_usrKey=l-4HPEKJUipDngVr&SM_ID=2212212&C_ID=12018&C_companyName=Adapex&version=70070020&sC_ID=8783&AC_ID=2008&TYPE=FLOAT&EXTREF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&PLAYERCODE=LVFNLN&OGSET=1&REFONLY=1&STRIPQUERY=1&serverHost=embed.sendtonews.com
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.170.30.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-170-30-54.compute-1.amazonaws.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 02 Sep 2022 14:55:08 GMT
cache-control: max-age=1
server: Apache
content-type: text/html; charset=UTF-8
content-length: 0
expires: Fri, 02 Sep 2022 14:55:09 GMT

GET
H2 200 0.js Show response
player.sendtonews.com/bidderFiles/ 4 KB
2 KB 449ms
13ms Script
application/javascript 18.66.147.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://player.sendtonews.com/bidderFiles/0.js
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-73.fra60.r.cloudfront.net
Software: Apache /
Resource Hash: 7f1d279703b902aee3682bf47afc04d7d9a4417e08a137638cd8dcce1141c450

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:15:30 GMT
content-encoding: gzip
age: 2570
x-cache: Hit from cloudfront
content-length: 1394
access-control-allow-origin: *
last-modified: Thu, 03 Mar 2022 21:08:40 GMT
server: Apache
etag: "e75-5d956cd664600-gzip"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 dd4531988f4862a3b186f9d3356a6a74.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: FRA60-P4
accept-ranges: bytes
x-robots-tag: noindex, nofollow
x-amz-cf-id: IjPHU7m7L45mP2okFwn2q8hMJUS6jO_yaAx8OdaVRdXYpgUcGynpsQ==
expires: Fri, 02 Sep 2022 15:12:18 GMT

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVI.woff2
fonts.gstatic.com/s/opensans/v34/ 16 KB
16 KB 475ms
47ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4ffc35ac4d5e3f1546a4c1a879f425f090ff3336e0fce31a39ae4973b5e8c127

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 29 Aug 2022 18:56:32 GMT
x-content-type-options: nosniff
age: 331116
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16756
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:16:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 29 Aug 2023 18:56:32 GMT

GET
H2 200 flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
fonts.gstatic.com/s/materialicons/v139/ 125 KB
126 KB 441ms
15ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/materialicons/v139/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/icon?family=Material+Icons

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 20:33:24 GMT
x-content-type-options: nosniff
age: 66104
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 128352
x-xss-protection: 0
last-modified: Thu, 25 Aug 2022 00:26:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Sep 2023 20:33:24 GMT

GET
H2 200 cjbnu8fglt6k9g1s86cm3n6v5loj86hk.jpg
d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/ 19 KB
20 KB 25ms
8ms Image
image/jpeg 18.66.97.101
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/cjbnu8fglt6k9g1s86cm3n6v5loj86hk.jpg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=updatepopcorntime.xyz&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-101.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a6d8145c0d597de34bfe23cad08eeb21792ed31e9fb628f6a65edad5106e7884

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 20:52:35 GMT
via: 1.1 4d0ae7ca3bb5e2d6eaa1450e1906adb4.cloudfront.net (CloudFront)
age: 64954
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 19472
last-modified: Thu, 01 Sep 2022 20:46:15 GMT
server: AmazonS3
etag: "e7716bcd8e2f265e1da9603a8c654f31"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
x-amz-cf-id: dgFoqsMNG8yxdkGSbCTNlMfdeNNG_fatg0oha8N12mooIRDj9f4xGA==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 95ms
95ms Ping
image/gif 54.152.91.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=l-4HPEKJUipDngVr&instance=214330429&version=7.7.2&age=220902&cmd=RTP&key=eKVKXbhX&c_id=12018&seq=1&order=3&absoluteTime=3142.3&relativeTime=262.4&sC_ID=8783&sm_id=2212212&load=1&status=LVFNLNIY&ac_id=2008&EXTREF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&playerCfg=FL
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.91.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-91-168.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:08 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

POST
H2 200 data_stn_l.php
timber.sendtonews.com/timber/ 0
143 B 549ms
132ms Ping
text/html 35.170.30.54
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://timber.sendtonews.com/timber/data_stn_l.php?CMD=RTP&ESG_key=eKVKXbhX&ES_key=eKVKXbhX&ES_ID=30800&S_RKEY=PxOCAD1ClE&USR_ID=214330429&ST_usrKey=l-4HPEKJUipDngVr&SM_ID=2212212&C_ID=12018&C_companyName=Adapex&version=70070020&sC_ID=8783&AC_ID=2008&TYPE=FLOAT&EXTREF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&PLAYERCODE=LVFNLN&OGSET=1&REFONLY=1&STRIPQUERY=1
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.170.30.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-170-30-54.compute-1.amazonaws.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 02 Sep 2022 14:55:08 GMT
cache-control: max-age=1
server: Apache
content-type: text/html; charset=UTF-8
content-length: 0
expires: Fri, 02 Sep 2022 14:55:00 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ Frame EE51 23 B
489 B 48ms
38ms XHR
text/javascript 18.66.108.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dupdatepopcorntime.xyz%26pcid%3D802%26rid%3D152%26a%3D0&pr=http%3A%2F%2Fupdatepopcorntime.xyz%2F&pid=kFl7vKJIZ1gkA&cb=0&ws=300x150&v=22.8.252032&t=2000&slots=%5B%7B%22id%22%3A%22standard%22%2C%22mt%22%3A%22v%22%7D%5D&schain=1.0%2C1!sendtonews.com%2CVRAfdwVZOg7jMyH8bxgoOA%2C1%2C%2C%2C&pubid=6c3f03cd-6fa8-4477-ac05-2c0f4f8da092&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.108.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-108-49.fra56.r.cloudfront.net

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:08 GMT
via: 1.1 3a21078459f955a33f79dacf082781c4.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P5
x-amz-rid: 3E9NRTHXW0XWFHBV61XT
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 23
x-amz-cf-id: FtgRDdWkdPW_Fo3nQb2JCcGmbGBlmwEIzY28QGjTYhU_NUOdAE2yGw==

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ Frame EE51 53 KB
17 KB 92ms
18ms Script
application/javascript 92.123.21.200
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: updatepopcorntime.xyz
URL: http://updatepopcorntime.xyz/?app_id=T4PSEC&hid=9a19de2de347e5fa3864eee56e1bc6a3&ver=6.2.1.14&os=WIN060101
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.123.21.200 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-21-200.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:08 GMT
content-encoding: gzip
last-modified: Tue, 01 Jun 2021 17:06:57 GMT
server: Apache
etag: "d398-5c3b75e9ebb41-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17087
expires: Fri, 02 Sep 2022 15:10:08 GMT

POST
H2 200 headerstats Show response
as-sec.casalemedia.com/ 0
496 B 48ms
24ms XHR
text/plain 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/headerstats?s=340102&u=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dupdatepopcorntime.xyz%26pcid%3D802%26rid%3D152%26a%3D0&v=3
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/187621-164323601241456.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ni1DrW%2BiJbcLAzFjRKNQPsWcauyjrfoiR4WTN4Rtzzk%2F73F3qeiyHwn3d3xYGwBLE1pjmoltcjZyQFnvAEvOXFEjFIDcstYZu1RX2enh6UAef5AfUzsmVqdBFIi78HvtO1tjxp%2BzZTA%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://simcast.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 744715c118709ba6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 97ms
67ms XHR
application/json 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220831&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

209da155fc330fab571e5f9726d4c0388b475e59512b2cee28bc45984ea81af2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11043
x-xss-protection: 0

POST
H/1.1 204
No Content 229991 Show response
search.spotxchange.com/openrtb/2.3/dados/ Frame EE51 0
1 KB 166ms
32ms XHR
application/json 185.94.180.123
SPOTX-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://search.spotxchange.com/openrtb/2.3/dados/229991?src_sys=prebid
Requested by: Host: d29xw9s9x32j3w.cloudfront.net
URL: https://d29xw9s9x32j3w.cloudfront.net/players/library/prebid/6.12.0/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.94.180.123 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

X-spotx-Exception-RESULT: exception
Date: Fri, 02 Sep 2022 14:55:09 GMT
X-SpotX-Timing-Transform: 0.000320
X-spotx-Exception-Message: SpotMarket execution was halted.
X-SpotX-Timing-Page-Mux: 0.000892
X-spotx-Exception-0-RESULT: failure
X-SpotX-Timing-Page-Require: 0.000446
X-spotx-Exception-0-ID: MARKET_HALTED
Connection: keep-alive
X-spotx-Exception-0-Message: Halting market due to GDPR regulations and DPA not being signed by publisher
X-SpotX-Timing-Page-Cookie: 0.000002
X-SpotX-Timing-Page: 0.015723
Pragma: no-cache
X-SpotX-Timing-Page-Context: 0.000365
X-fe: 035
Last-Modified: Fri, 02 Sep 2022 14:55:09 GMT
Server: nginx
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0
X-SpotX-Timing-SpotMarket-Primary: 0.011835
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, OPTIONS
Content-Type: application/json
Access-Control-Allow-Origin: https://simcast.com
X-SpotX-Timing-Page-Misc: 0.001831
X-SpotX-Timing-Page-Exception: 0.000020
X-SpotX-Timing-SpotMarket-Secondary: 0.000000
X-SpotX-Timing-Page-URI: 0.000012
X-spotx-Exception-ID: SPOTMARKET.HALTED
Access-Control-Allow-Headers
X-SpotX-Timing-SpotMarket: 0.011835
Access-Control-Allow-Credentials: true
Expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ Frame EE51 19 B
503 B 54ms
31ms XHR
application/json 18.158.177.133
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.12.0&referrer=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dupdatepopcorntime.xyz%26pcid%3D802%26rid%3D152%26a%3D0&tmax=3000

Requested by

Host: d29xw9s9x32j3w.cloudfront.net
URL: https://d29xw9s9x32j3w.cloudfront.net/players/library/prebid/6.12.0/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.158.177.133 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-177-133.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
accept-ch: sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink,user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame EE51 173 B
398 B 146ms
8ms XHR
application/json 52.57.28.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: d29xw9s9x32j3w.cloudfront.net
URL: https://d29xw9s9x32j3w.cloudfront.net/players/library/prebid/6.12.0/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.28.111 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-28-111.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: daf31a3d6b04feba21ec74f5cca4a4756ceea7d6ba4fa8752060224f1779b88e

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
x-prebid: pbs-java/1.97.0
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 167
expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame EE51 138 B
829 B 15ms
15ms XHR
application/json 185.89.210.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: d29xw9s9x32j3w.cloudfront.net
URL: https://d29xw9s9x32j3w.cloudfront.net/players/library/prebid/6.12.0/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.90 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

75d6d707eabe4747584f888b3eaa778ba740262028438eb037aff6d9cbf9f530

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 02 Sep 2022 14:55:09 GMT
X-Proxy-Origin: 178.162.209.142; 178.162.209.142; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: c6977193-962a-4e9d-8eff-de2d168f11fe
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://simcast.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 138
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 cygnus Show response
htlb.casalemedia.com/ Frame EE51 36 B
538 B 37ms
26ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=438214&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%2293f7e20607fb67%22%2C%22site%22%3A%7B%22ref%22%3A%22https%3A%2F%2Fsimcast.com%2F%3Fd%3Dupdatepopcorntime.xyz%26pcid%3D802%26rid%3D152%26a%3D0%22%2C%22page%22%3A%22https%3A%2F%2Fsimcast.com%2F%3Fd%3Dupdatepopcorntime.xyz%26pcid%3D802%26rid%3D152%26a%3D0%22%2C%22keywords%22%3A%22search%2Cnews%2Cautomotive%2Cbeauty%2Ceducation%2Cevents%2Cfashion%2Cfinance%2Cgames%2Chealth%2Chome%2Cinsurance%2Clegal%2Cpets%2Cproperty%2Cshopping%2Csports%2Ctechnology%2Ctransport%2Ctravel%2Cutilties%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A0%2C%22iu%22%3A1%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.12.0%22%2C%22userIds%22%3A%5B%5D%2C%22fpd%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2210bd7f7b420699f%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438214%22%7D%2C%22video%22%3A%7B%22context%22%3A%22instream%22%2C%22mimes%22%3A%5B%22video%2Fx-m4v%22%2C%22video%2Fmpeg%22%2C%22video%2Fmp4%22%2C%22application%2Fjavascript%22%2C%22video%2Fwebm%22%2C%22video%2Fogg%22%5D%2C%22minduration%22%3A5%2C%22maxduration%22%3A30%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%2C7%2C8%5D%2C%22w%22%3A761%2C%22h%22%3A428%2C%22sizes%22%3A%5B%5B761%2C428%5D%5D%2C%22playerSize%22%3A%5B%5B761%2C428%5D%5D%2C%22placement%22%3A1%2C%22linearity%22%3A1%2C%22api%22%3A%5B2%5D%2C%22battr%22%3A%5B9%5D%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22sendtonews.com%22%2C%22sid%22%3A%22VRAfdwVZOg7jMyH8bxgoOA%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%7D%7D
Requested by: Host: d29xw9s9x32j3w.cloudfront.net
URL: https://d29xw9s9x32j3w.cloudfront.net/players/library/prebid/6.12.0/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e75f086c16c5acf68c876036b61bc3597787f021ecc9668f51acadb72115d2d4

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Alu0kyzTlJGy6AwfUuTQJFr6pHC%2FPJL8EdzLX75pfEYLcYnBC3ZqfW%2F9kOj%2BPr9QFOh5OY27TfXxBwMW1BhJt4%2BqrDjDP6q1cNroPB%2B9DeN2Oz26Term4jq6Xg8fX8Z2Agj9kP78"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 744715c14b999007-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 36
expires: 0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame EE51 0
112 B 74ms
14ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: d29xw9s9x32j3w.cloudfront.net
URL: https://d29xw9s9x32j3w.cloudfront.net/players/library/prebid/6.12.0/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Fri, 02 Sep 2022 14:55:09 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 42ms
14ms Preflight
application/json 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsimcast.com%2F&domain=simcast.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 02 Sep 2022 14:55:08 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 669655
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsimcast.com%2F&domain=simcast.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=th07dHxVK29IK0c4eGM2UFNINVhtd1pUZTNoKzhvQ2Q4VnhxQTRTSVJrWDg1dHNVN0NMS0pPTTE4Mm9XMXcvQUJyZ1Z2NmFCMkIrZE0vRjRqRkRtVVJhL2JCTGpmYmRGb3l1bm9CMGo0OTVBeXBQeGVBdFZSRDMyT1BqUl...

355 B
642 B

293ms
15ms

XHR
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=th07dHxVK29IK0c4eGM2UFNINVhtd1pUZTNoKzhvQ2Q4VnhxQTRTSVJrWDg1dHNVN0NMS0pPTTE4Mm9XMXcvQUJyZ1Z2NmFCMkIrZE0vRjRqRkRtVVJhL2JCTGpmYmRGb3l1bm9CMGo0OTVBeXBQeGVBdFZSRDMyT1BqUlhYSnhVR1hFYy94YktuTVppanJLL1hSa2ZQT3FqbzRyUVcrQzJQMDNVdkNKUm9VMDVpdXN3d3FxeGVDYzVkdHFJbEticm0zcitpT2hPaEUzNmRXaDA2TkkwSGtHSWpIRE9RVTdWcVJYakpsVFNvYVBRNjB3PXw&cppv=2

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4b53acfa7abbdf478824718b9b1c1678102d02187935d3905fe49b059d6e19e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:08 GMT
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 643106
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: Kestrel
location: https://mug.criteo.com/sid?cpp=th07dHxVK29IK0c4eGM2UFNINVhtd1pUZTNoKzhvQ2Q4VnhxQTRTSVJrWDg1dHNVN0NMS0pPTTE4Mm9XMXcvQUJyZ1Z2NmFCMkIrZE0vRjRqRkRtVVJhL2JCTGpmYmRGb3l1bm9CMGo0OTVBeXBQeGVBdFZSRDMyT1BqUlhYSnhVR1hFYy94YktuTVppanJLL1hSa2ZQT3FqbzRyUVcrQzJQMDNVdkNKUm9VMDVpdXN3d3FxeGVDYzVkdHFJbEticm0zcitpT2hPaEUzNmRXaDA2TkkwSGtHSWpIRE9RVTdWcVJYakpsVFNvYVBRNjB3PXw&cppv=2
strict-transport-security: max-age=31536000; preload;
access-control-allow-methods: GET
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 718616
content-length: 0
expires: 0

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 55ms
23ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=simcast.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090101.js?cb=31069313

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 54ms
25ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=simcast.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090101.js?cb=31069313

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 68 KB
28 KB 415ms
414ms XHR
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3383624281325534&correlator=1620545142372948&eid=31069313%2C31068366%2C31069101&output=ldjh&gdfp_req=1&vrg=2022090101&ptt=17&impl=fifs&iu_parts=22181265%3A22632072816%2Csmc_970v_1%2Csmc_300v_2%2Csmc_300v_1%2Csmc_sticky_footer&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=970x90%7C728x90%7C728x250%7C970x250%2C300x250%7C300x100%7C320x100%7C336x280%2C300x250%7C300x100%2C728x90&ifi=2&adks=43960066%2C878967863%2C3419004007%2C1105315089&sfv=1-0-38&fsapi=false&prev_scp=refresh_count%3D0%26hb_cs%3Dcurrent%26hb_bd%3D1%26hb_adomain%3Dbusinessinfoline.com%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D970x90%26hb_pb%3D0.03%26hb_adid%3D1510397825cecfd7%26hb_bidder%3Dadtelligent%26anh%3Dtrue%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dadhesion&cust_params=arTest%3Dtrue%26wvr%3D3%26wie%3Dtop%26cndl%3D1%26cnrtt%3D0%26cntp%3Dna%26cnet%3D4g%26cnsd%3Dfalse%26wrc%3Dfr%26gpt_l%3D500%26wrap_l%3D1600%26ccp%3Dunknown%26sesdepth%3D1%26page_r%3D600%26padpr%3D19%26idl_envtest%3Dna%26lipbtest%3Dna%26lotamePanoramaIdtest%3Dna%26uids%3Dpubcid%26uids_c%3D1%26waai%3D600%26waae%3D1500%26pbglobal%3Daaw%26tif%3Dtrue%26lui%3D2s&sc=1&cookie=ID%3Da336525ab0e887d7-22368ac810ce0019%3AT%3D1662130507%3ART%3D1662130507%3AS%3DALNI_MbBIH92GmcJ60rKMh1PXvUVYwUCnA&abxe=1&dt=1662130509077&lmt=1662130509&dlt=1662130505978&idt=1451&adxs=315%2C791%2C1230%2C0&adys=193%2C1059%2C288%2C1947&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C1&ucis=1%7C2%7C3%7C4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dupdatepopcorntime.xyz%26pcid%3D802%26rid%3D152%26a%3D0&ref=http%3A%2F%2Fupdatepopcorntime.xyz%2F&frm=20&vis=1&psz=1600x0%7C417x0%7C339x0%7C1600x1877&msz=1600x0%7C417x0%7C339x0%7C728x0&fws=0%2C0%2C0%2C128&ohw=0%2C0%2C0%2C0&ga_vid=401720583.1662130508&ga_sid=1662130508&ga_hid=452882297&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090101.js?cb=31069313

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6d67414de32e9bb2a57736e26efe18092f199b3421e70e38741a2771286a2b17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28639
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame FD45 6 KB
4 KB 112ms
21ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090101.js?cb=31069313

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 14:55:09 GMT
expires: Sat, 02 Sep 2023 14:55:09 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 61ms
24ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 02 Sep 2022 14:55:09 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 64ms
14ms Preflight
application/json 178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 02 Sep 2022 14:55:09 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 461404
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 587A 13 KB
5 KB 46ms
14ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 5569
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 13:22:20 GMT
expires: Sat, 02 Sep 2023 13:22:20 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 04B3 783 B
1 KB 61ms
24ms Document
text/html 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

dd06622a56b13cb7bc7ac7ecea5d32b1122b29e8a15d1bbac1a20f300b391087

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-s0nsHOYxAc3GSYRpnMJfbQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-s0nsHOYxAc3GSYRpnMJfbQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 14:55:09 GMT
expires: Fri, 02 Sep 2022 14:55:09 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 n3962p0n65r8n8r3155p63noq574r80nplaylist.m3u8 Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/ 291 B
832 B 10ms
7ms XHR
application/x-mpegurl 18.66.97.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/n3962p0n65r8n8r3155p63noq574r80nplaylist.m3u8
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-101.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2b2bb7e018b8e257a3e9dc2f3c1742fd3538ab003086894a8dd677f70193e4d4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 20:52:36 GMT
via: 1.1 4d0ae7ca3bb5e2d6eaa1450e1906adb4.cloudfront.net (CloudFront)
age: 64954
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 291
last-modified: Thu, 01 Sep 2022 20:42:29 GMT
server: AmazonS3
etag: "346731fd979c9f93513c5cb609812ddd"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: application/x-mpegURL
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
x-amz-cf-id: P1vVRcxFnVxxI_P_bhfxBeQeh9LvO_k5U-l3fP7BzyI6JJiSeWV2WQ==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 97ms
95ms Ping
image/gif 54.152.91.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=l-4HPEKJUipDngVr&instance=214330429&version=7.7.2&age=220902&cmd=IMA&key=eKVKXbhX&c_id=12018&seq=1&order=4&absoluteTime=3838.7&relativeTime=958.8&EXTREF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&playerCfg=FL&recoveryMethod=SSAI&imaVersion=3.528.0&blocked=false&recovered=false&hasAdParams=true
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.91.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-91-168.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 97ms
96ms Ping
image/gif 54.152.91.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=l-4HPEKJUipDngVr&instance=214330429&version=7.7.2&age=220902&ldt=BIDS&key=eKVKXbhX&c_id=12018&seq=1&order=5&absoluteTime=3839.2&relativeTime=959.3&sm_id=2212212&visiblestatecd=I&soundcd=OFF&alt=0&sC_ID=8783&load=1&status=LVFNLNIY&ac_id=2008&prebid.cid=0&prebid.bidders.spotx.time=173.5&prebid.bidders.triplelift.time=56.1&prebid.bidders.rubicon.time=149.6&prebid.bidders.appnexus.time=22.8&prebid.bidders.ix.time=40.3&prebid.bidders.pubmatic.time=94.7&prebid.start=3655.2&prebid.time=174.2&prebid.timeout=3000
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.91.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-91-168.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 30ms
29ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=simcast.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 28ms
28ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=simcast.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 50000o6r11r0rs5474760r5p0117874sbase.en.vtt
d29xw9s9x32j3w.cloudfront.net/videos/cc_text/ 8 KB
8 KB 8ms
7ms TextTrack
text/vtt 18.66.97.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/cc_text/50000o6r11r0rs5474760r5p0117874sbase.en.vtt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-101.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c687b3e15baf2d382faaa7fa2b444d876c224d6d4c3b889b43de8c4258591df3

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 20:52:36 GMT
via: 1.1 4d0ae7ca3bb5e2d6eaa1450e1906adb4.cloudfront.net (CloudFront)
age: 64954
x-cache: Hit from cloudfront
content-length: 7977
last-modified: Thu, 01 Sep 2022 20:44:04 GMT
server: AmazonS3
etag: "f68e715f48ab35789b1e953923501796"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: text/vtt
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
x-amz-cf-id: ASaRyzkAgB2XnMr_uft7eIx60fi55UFiVDUt8aMvsDOXhs-fmWPbxg==

GET
H2 200 n3962p0n65r8n8r3155p63noq574r80n.m3u8 Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/ 2 KB
849 B 13ms
13ms XHR
application/x-mpegurl 18.66.97.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/n3962p0n65r8n8r3155p63noq574r80n.m3u8
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-101.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 23e654771d4743afe2d50ed14a5d2d969446bd56228e31d227e5bc4c0c86213c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 20:55:10 GMT
content-encoding: gzip
age: 64800
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
access-control-allow-origin: *
last-modified: Thu, 01 Sep 2022 20:44:00 GMT
server: AmazonS3
etag: W/"43c6ab022ec80b2ec4c5c4c4dfed26e0"
vary: Accept-Encoding,Origin
access-control-allow-methods: GET, HEAD, POST
content-type: application/x-mpegURL
via: 1.1 4d0ae7ca3bb5e2d6eaa1450e1906adb4.cloudfront.net (CloudFront)
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
x-amz-cf-pop: FRA56-P2
x-amz-cf-id: e4KDTJf6AJPGkCXQ3ckpDqswj9Rd1k7ryb4eVo491oeX90O0Un2oiw==

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 6996 33 KB
2 KB 142ms
82ms XHR
text/xml 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F92056281%2C22632072816%2Fsimcast.com-premium&env=vp&gdfp_req=1&unviewed_position_start=1&ad_rule=1&output=xml_vmap1&sz=480x270&ciu_szs=300x60&description_url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dupdatepopcorntime.xyz%26pcid%3D802%26rid%3D152%26a%3D0&hl=en&vpa=auto&vpmute=1&vconp=2&cmsid=2460952&vid=2212212&us_privacy=false&cust_params=sessionKey%3D214330429-l-4HPEKJUipDngVr%26schain%3Dsendtonews.com%2CVRAfdwVZOg7jMyH8bxgoOA%26content%3D8783%26placementType%3DPremium%26embed%3DeKVKXbhX%26domain%3Dsimcast.com%26player_size%3Dlarge%26player_width%3D761%26player_height%3D428%26player_type%3Dfloat%26version%3D7.7.2%26player_status%3DLVFNLNIY%26play_code%3D2008%26view100%3D1%26excl_cat%3Dstl_id00157%26rand%3D3%26iris_id%3Diris_3ba9a6e1f5ed7c22%26iris_context%3Dic_2453406%2Cic_7095941%2Cic_0291942%2Cic_2416407%2Cic_7753435%2Cic_1612662%2Cic_8328276%2Cic_5043113%2Cic_3890383%2Cic_1809360%2Cic_5058676%2Cic_7502096%2Cic_3393155%2Cic_9677800%26us_privacy%3Dfalse&sdkv=h.3.528.0&osd=2&frm=0&vis=1&sdr=1&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&u_so=l&ctv=0&mpt=stnvideo%2Fplayer&sdki=44d&ptt=20&adk=2458199627&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.528.0&sid=8B96DAA6-51A8-4E83-8233-FD5B7CE01E58&nel=0&eid=44754420%2C44760950%2C44765701&ref=http%3A%2F%2Fupdatepopcorntime.xyz%2F&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dupdatepopcorntime.xyz%26pcid%3D802%26rid%3D152%26a%3D0&dlt=1662130505978&idt=2971&dt=1662130509198&cookie=ID%3Da336525ab0e887d7-22368ac810ce0019%3AT%3D1662130507%3ART%3D1662130507%3AS%3DALNI_MbBIH92GmcJ60rKMh1PXvUVYwUCnA&correlator=1712113448480798&scor=4212447610414867&ged=ve4_td3_tt0_pd3_la3000_er0.0.0.0_vi0.0.1200.1600_vp0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.528.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

10c0218ffb9b9a569506883861c4b4ff728060099699000e6eef9a018a5e9608

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1611
x-xss-protection: 0
google-lineitem-id: 0
pragma: no-cache
server: cafe
google-creative-id: 0
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 n3962p0n65r8n8r3155p63noq574r80n-00001.ts Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/ 350 KB
351 KB 10ms
10ms XHR
video/mp2t 18.66.97.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/n3962p0n65r8n8r3155p63noq574r80n-00001.ts
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-101.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8774d99c6d76f5eb7890fb6c670636c0dfea10fb9f2d01a7c6cbdb0266efa0c1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 20:55:11 GMT
via: 1.1 4d0ae7ca3bb5e2d6eaa1450e1906adb4.cloudfront.net (CloudFront)
age: 64799
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 358892
last-modified: Thu, 01 Sep 2022 20:43:55 GMT
server: AmazonS3
etag: "d00bd8783f11af2ad5da23fc85581fc2"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: video/mp2t
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
x-amz-cf-id: Zb-ptWEH8G56t1vySpxRprtW7rk-TVNv3bK8_qOEyjwM540kTEKu0Q==

GET
H3 200 JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js Show response
pagead2.googlesyndication.com/bg/ Frame 587A 36 KB
16 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

248d0f732763fd82701728aff2902d3e6b079e73f1ea00c1c4bb749f45e9226f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 12:54:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7233
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15957
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Sep 2023 12:54:36 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 04B3 0
0 47ms
47ms Image
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220831&jk=3383624281325534&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

GET
BLOB 200
OK fec624d5-5c74-413e-9e66-835ebbb1885f
https://simcast.com/ 93 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://simcast.com/fec624d5-5c74-413e-9e66-835ebbb1885f
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9850487a52d056b4cd76c894a5852c37a6c40e604db6af1c7e413848aa1f6774

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Content-Length: 94909
Content-Type: text/javascript

GET
H2 200 n3962p0n65r8n8r3155p63noq574r80n.m3u8 Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/1000k/ 2 KB
824 B 9ms
8ms XHR
application/x-mpegurl 18.66.97.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/1000k/n3962p0n65r8n8r3155p63noq574r80n.m3u8
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-101.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 84646762272c360b8ec32a54d917b41b3a7bf6b1a7b1e22cd129c5ee93782af1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 20:55:12 GMT
content-encoding: gzip
age: 64798
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
access-control-allow-origin: *
last-modified: Thu, 01 Sep 2022 20:44:26 GMT
server: AmazonS3
etag: W/"634e9cccaad4b61ba22e6c8861ca2577"
vary: Accept-Encoding,Origin
access-control-allow-methods: GET, HEAD, POST
content-type: application/x-mpegURL
via: 1.1 4d0ae7ca3bb5e2d6eaa1450e1906adb4.cloudfront.net (CloudFront)
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
x-amz-cf-pop: FRA56-P2
x-amz-cf-id: 6_EPGbDirB0FlCxHdVOB47zyWn0gg8gc-dFHRV0b9LqFePSDHrjZYQ==

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 587A 0
10 B 17ms
17ms Image
text/plain 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?-hxZ4g
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 95ms
95ms Ping
image/gif 54.152.91.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=l-4HPEKJUipDngVr&instance=214330429&version=7.7.2&age=220902&cmd=INV&key=eKVKXbhX&c_id=12018&seq=1&order=6&absoluteTime=4020.6&relativeTime=1140.7&alt=0&sC_ID=8783&sm_id=2212212&load=1&status=LVFNLNIY&ac_id=2008&EXTREF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&playerCfg=FL
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.91.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-91-168.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

POST
H2 200 data_stn_l.php
timber.sendtonews.com/timber/ 0
142 B 128ms
128ms Ping
text/html 35.170.30.54
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://timber.sendtonews.com/timber/data_stn_l.php?CMD=INV&ESG_key=eKVKXbhX&ES_key=eKVKXbhX&ES_ID=30800&S_RKEY=PxOCAD1ClE&USR_ID=214330429&ST_usrKey=l-4HPEKJUipDngVr&SM_ID=2212212&C_ID=12018&C_companyName=Adapex&version=70070020&sC_ID=8783&AC_ID=2008&TYPE=FLOAT&EXTREF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&PLAYERWIDTH=761.125&PLAYERCODE=LVFNLN&OGSET=1&REFONLY=1&STRIPQUERY=1
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.170.30.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-170-30-54.compute-1.amazonaws.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 02 Sep 2022 14:55:09 GMT
cache-control: max-age=1
server: Apache
content-type: text/html; charset=UTF-8
content-length: 0
expires: Fri, 02 Sep 2022 14:55:10 GMT

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 6996 156 B
142 B 257ms
229ms XHR
text/xml 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?slotname=%2F92056281%2Fsimcast.com-premium&sz=480x270&ciu_szs=300x60&cust_params=sessionKey%3D214330429-l-4HPEKJUipDngVr%26schain%3Dsendtonews.com%2CVRAfdwVZOg7jMyH8bxgoOA%26content%3D8783%26placementType%3DPremium%26embed%3DeKVKXbhX%26domain%3Dsimcast.com%26player_size%3Dlarge%26player_width%3D761%26player_height%3D428%26player_type%3Dfloat%26version%3D7.7.2%26player_status%3DLVFNLNIY%26play_code%3D2008%26view100%3D1%26excl_cat%3Dstl_id00157%26rand%3D3%26iris_id%3Diris_3ba9a6e1f5ed7c22%26iris_context%3Dic_2453406%2Cic_7095941%2Cic_0291942%2Cic_2416407%2Cic_7753435%2Cic_1612662%2Cic_8328276%2Cic_5043113%2Cic_3890383%2Cic_1809360%2Cic_5058676%2Cic_7502096%2Cic_3393155%2Cic_9677800%26us_privacy%3Dfalse&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dupdatepopcorntime.xyz%26pcid%3D802%26rid%3D152%26a%3D0&unviewed_position_start=1&output=xml_vast4&env=vp&gdfp_req=1&ad_rule=0&video_url_to_fetch=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dupdatepopcorntime.xyz%26pcid%3D802%26rid%3D152%26a%3D0&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F105.0.5195.52%20Safari%2F537.36%2Cgzip(gfe)&vad_type=linear&vpos=preroll&pod=1&ppos=1&lip=true&min_ad_duration=0&max_ad_duration=30000&vrid=1263268&sid=8B96DAA6-51A8-4E83-8233-FD5B7CE01E58&adk=2458199627&correlator=1712113448480798&dlt=1662130505978&dt=1662130509372&ged=ve4_td3_tt0_pd3_la3000_er313.20.468.320_vi0.0.1200.1600_vp100_ts0_eb24171&idt=2971&is_amp=0&omid_p=Google1%2Fh.3.528.0&osd=2&ptt=20&ref=http%3A%2F%2Fupdatepopcorntime.xyz%2F&scor=4212447610414867&sdk_apis=2%2C7%2C8&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&us_privacy=false&vis=1&u_so=l&eid=44754420%2C44760950%2C44765701&hl=en&frm=0&cmsid=2460952&mpt=stnvideo%2Fplayer&sdki=44d&sdkv=h.3.528.0&sdr=1&vconp=2&video_doc_id=2212212&vpa=auto&vpmute=1&nel=0&cnc=22632072816&kfa=0&tfcd=0&ctv=0&cookie=ID%3Da336525ab0e887d7-22368ac810ce0019%3AT%3D1662130507%3ART%3D1662130507%3AS%3DALNI_MbBIH92GmcJ60rKMh1PXvUVYwUCnA

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.528.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6BF2 6 KB
3 KB 44ms
14ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090101.js?cb=31069313

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 14:55:09 GMT
expires: Sat, 02 Sep 2023 14:55:09 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 528F 6 KB
3 KB 32ms
15ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090101.js?cb=31069313

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 14:55:09 GMT
expires: Sat, 02 Sep 2023 14:55:09 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6ECF 6 KB
3 KB 31ms
16ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090101.js?cb=31069313

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 14:55:09 GMT
expires: Sat, 02 Sep 2023 14:55:09 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 0A64 6 KB
3 KB 30ms
17ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022090101.js?cb=31069313

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 14:55:09 GMT
expires: Sat, 02 Sep 2023 14:55:09 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame D01B 174 KB
54 KB 374ms
135ms Document
text/html 2a02:2638::b
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YxIZTQACZ0UIEd2aAA5b1kdIq9x64_KIo5wwCQ&u=%7C%2B3FqC%2B1HDc8DvrsZITjhbK0%2BNrxnhYx%2BH3vy5CzCI6g%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNB-Ap14Pg0HmFAf1GHAR2jvULOd3YfT8Kie5-AMuoqyTirKgE-lWZeqPULGzE4HXtHRo7W7jK_gZhTec_TEVV4ypFxgJszksIGU56urFev0yvQOlXHqKNXSZspRrSsacgfFN9BWlV86M6Tyi1PG1gW5_U_tLxh2N6RCfzKmQyxgHpbdfC4ww86SsD0rKnEj9kiOp99x-SiuIupZCeL839KBOf-Yy4fS43Nm1xv2rkD5gpKhYbufS1n_THc0zoUToOlrZJkE57aCQ0TNarFbXHKj5O-ehLxwm7Ndhwmp8o2aURcTqRdtFe5Yky8pYYxyu2DzwMoDjA_yzuIU59UrvjJ21aj8QolvIFHLO_v31EcYNvD3L46ZxnzGWD5wzScNLC4S9kogI3zYS67oK-yUtAl_P5irdtlwayeLWvCjC2bf6X0FW-RtB4r8rjtoHxEwj-EorPTW1kGQSKKg6w9uetdVhhEUlAWFCNeg8UAwm_8UoVunycZ63-ZUy0bSeZg5IuB-xzeDl6BMfbBVtfGijZvTRAyLpconbGDwWhz_iDErJqsRxI9wfnBN-osCgjYb4xaFnyX9jaIjYRIMswcts_d2cbgX0TUNdQKzG6FQ65GVI&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCNwi0TRkSY8XOCZq7x_AP1re52AHJntKxXNWdkfdwwI23ARABIABglcKmgrAHggEXY2EtcHViLTEwNjI5NzI4NjE1NTMzMDOgAdW20uoDyAEJqQJY9IrfrcWwPuACAKgDAaoEqAJP0AYSg_pBhyRwFRaqIyBiWMzKWEv2jKeIgFjY2yFJczDRo6hxYEVZOM8jdpQaX3Tzux-yqJT97crsohtmkKJQTIJ3NVMSnDu6rXnAkVEkMlBr2XnNCZsVAaqtWn3AXzaWyS3Xn72x9CcxkA6nQTrMajIHRhP9BgOLbtvv6Y9bSUvC4ccbaKmDgGlavvgwPmupKZmG_wZgeIGk6vNGb7-OLWpQ_5PzbSOAn2MKHwvQ4RDubnfosdzA4BE4469LiH16r7d1XUlka6PE73GfhJps2_YETuHh8bvR3mH9K-QUg2V9CZ20_Q27eymxkyCdECsalP4bIlcUPGH4it9MF8heYi9mQr_7Opdx0W-f3dT47q2-Vwb--v8zST4FW6TLSZ00EW57ULufh-AEAYAGx83PmN-e7an5AaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_31dcQlmOeT36N-_R4CU5n9EiRDNA%26client%3Dca-pub-1062972861553303%26adurl%3D

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

feb4aa972d487607498cac59bca433c3d1bc2eb86f3e74854a22be9939839190

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 14:55:09 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=L5b0wfv38TYFZfKo76_TPrMDPSTKxmSUFj3ZBXjf5xGrkxr1HMax5641J20WMYfQ6bSwGnfd7QV1456g-ksEFE8Wg1S4vEoUdrC3HQ_PxxTt-uITqSGj3ICQNuf42SfgWplTnC0qA_zYnf7ERWg2y2MOpz2fjqXV3-qqOXJkAwqnRjkyydhPOu5BxTfka9bKGyuDbkko575pQoTUbkNZNLb8q-ekJBDlWLHEq83HXglUIPK3ubVvrVt4o8HaKYLky77XEg"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 119811367
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/ Frame 6BF2 3 KB
1 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/window_focus_fy2021.js

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:40:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 903
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Sep 2022 14:40:06 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9B28 1 KB
749 B 15ms
13ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 5994
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 13:15:15 GMT
etag: 48472445140208031
expires: Sat, 03 Sep 2022 13:15:15 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/ Frame 6BF2 17 KB
7 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:49:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 368
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Sep 2022 14:49:01 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 6BF2 0
0 54ms
24ms Image
text/html 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQZMpcLyv07wa6Nk96RpXEADBH11fHeQmKuplIbzce3WtoGALC0BJWb2GiqNr9kDCknhQgUEgnySvsiOH-dOMKV1X0CYw
Requested by: Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 6BF2 22 KB
7 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 16:52:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79356
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 01 Sep 2023 16:52:33 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6BF2 142 KB
44 KB 102ms
54ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e851345505ee432c9397d60e5d91929ab4e5921f75c91f359b0939a879304b7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44792
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661945761880069"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 02 Sep 2022 14:55:09 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3776 624 B
297 B 54ms
51ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYrsLG0gEwAQ&v=APEucNUrxqn--hOV_fPPdgdDVRZpFDz7hzMh7pQ2aWXt1lpCi00IkVL_iJZQEWXAHi-7BDIrT0JraeZ-djCW3QTxnI-ZnFIQipHwrFVksUiOR05F0uetJQMlZ5pr0a44EIdAjkooq_-d2_JeqtInV8bhV2_3vzX1IoK__ejYwfGUWh6Ub5FLCFKvXWCGYb7wb7sj6euY9QIC9ko6kQCyMRV8pOdVZ15MQQ

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 14:55:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 528F 72 KB
26 KB 68ms
66ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4df152d8092ca4305ba2a0a3d82e98f84724d71eda19667f9e70768024a4f1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26194
x-xss-protection: 0
server: cafe
etag: 10777501457061102784
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 02 Sep 2022 14:55:09 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 528F 42 B
63 B 52ms
49ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CNFqxeBvIkcsA6bzZ4abZTuoESMsgFg4gHnMN4Nu8Bw0lTMSFy14zTXaIhED_NSaiw2m03eacPCIV-88eDR6PTdDmZoX2OBmp_0QwH1YQWUp990FY

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 528F 0
20 B 50ms
46ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=16173565658170488438&x=1&ct=76

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/ Frame 528F 3 KB
1 KB 17ms
14ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/window_focus_fy2021.js

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:40:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 903
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Sep 2022 14:40:06 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/ Frame 528F 17 KB
7 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:49:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 368
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Sep 2022 14:49:01 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 528F 0
0 52ms
26ms Image
text/html 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSHLit-iYMBgztUC3qfVjVq35uJCBs0wCyTAqtOVGG0hXiGfckhBUqueEWZk-r0dXil2iHcby3F35JW5NE6LfxwkdJ4xg
Requested by: Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 528F 142 KB
44 KB 134ms
88ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e851345505ee432c9397d60e5d91929ab4e5921f75c91f359b0939a879304b7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44792
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661945761880069"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 02 Sep 2022 14:55:09 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 528F 0
20 B 51ms
49ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=dbg&cor=16173565658170488438&x=1&ct=76&dl=0&ds=0

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 6BF2 0
0 63ms
61ms Fetch
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cmi1TTRkSY8XOCZq7x_AP1re52AHJntKxXNWdkfdwwI23ARABIABglcKmgrAHggEXY2EtcHViLTEwNjI5NzI4NjE1NTMzMDOgAdW20uoDyAEJqQJY9IrfrcWwPuACAKgDAaoEpQJP0AYSg_pBhyRwFRaqIyBiWMzKWEv2jKeIgFjY2yFJczDRo6hxYEVZOM8jdpQaX3Tzux-yqJT97crsohtmkKJQTIJ3NVMSnDu6rXnAkVEkMlBr2XnNCZsVAaqtWn3AXzaWyS3Xn72x9CcxkA6nQTrMajIHRhP9BgOLbtvv6Y9bSUvC4ccbaKmDgGlavvgwPmupKZmG_wZgeIGk6vNGb7-OLWpQ_5PzbSOAn2MKHwvQ4RDubnfosdzA4BE4469LiH16r7d1XUlka6PE73GfhJps2_YETuHh8bvR3mH9K-QUg2V9CZ20_Q27eymxkyCdECsalP4bIlcUPGH4it9MF8gcYA70xTBnKSjtxcxP4HIA57m04QzQ4n2HgQOjqRvVZYWxu-po7-AEAYAGx83PmN-e7an5AaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgECACgP6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItMTA2Mjk3Mjg2MTU1MzMwMxiB1Bw&sigh=n8SMhbRZY5Q&uach_m=[UACH]&cid=CAQSPACsnQUx_WouOORe99Poij7a7A3PvIh4czaud2hz8I1ESdNcfl6Ei-eEjeOpRB4h5jkppc156DuMBOtSfhgB&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd
Requested by: Host: updatepopcorntime.xyz
URL: http://updatepopcorntime.xyz/?app_id=T4PSEC&hid=9a19de2de347e5fa3864eee56e1bc6a3&ver=6.2.1.14&os=WIN060101
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame 6BF2 0
0 103ms
14ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=k5CTFOv_CsoH-gGdg2ICAgAAANzcIsRkPmtirXdIVgk5jtsQTBkSY4i660jtn1aPtfiIABIAAA&wp=YxIZTQACZ0UIEd2aAA5b1kdIq9x64_KIo5wwCQ&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd

Requested by

Host: updatepopcorntime.xyz
URL: http://updatepopcorntime.xyz/?app_id=T4PSEC&hid=9a19de2de347e5fa3864eee56e1bc6a3&ver=6.2.1.14&os=WIN060101

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
server: Kestrel
server-processing-duration-in-ticks: 293205
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame E2F0 624 B
297 B 50ms
49ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKnk7gEQrLv-ARitq6rRATAB&v=APEucNXF15FprtJ2h-Ar8t8KyevasWEMh6WDHM96GS3-pZUBqAS_nlgy8gNMANqPk9rWlW8rD_L59UwJMp8kSjpEZsv52uMOFnGWWofuMPASD0qmwbSHG-KYlVBLGKTlmmtOTleDWYitgW62GwffUanEe2jQaG6xZ5vhDRvJBVlska42Q7EfXNI9v3v3gQlZMS_fhc42QE_X8N-1JSeB-ihn9iZ_ibmFQw

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 14:55:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 6ECF 72 KB
26 KB 105ms
104ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4df152d8092ca4305ba2a0a3d82e98f84724d71eda19667f9e70768024a4f1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26194
x-xss-protection: 0
server: cafe
etag: 10777501457061102784
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 02 Sep 2022 14:55:09 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6ECF 42 B
63 B 49ms
47ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BV6Z5psd-4e_nfpeMsd6aqvJhpvzeIc-Ictt9rxfqNsztFxSP4rx7fEDwsPFByWr7cnrY07LY1xaGFq7C5jcCOKcf5YtKBPxtacqsmYsK8uHQHilo

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6ECF 0
20 B 51ms
50ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=12153759712928513128&x=1&ct=119

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/ Frame 6ECF 3 KB
1 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/window_focus_fy2021.js

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:40:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 903
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Sep 2022 14:40:06 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/ Frame 6ECF 17 KB
7 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:49:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 368
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Sep 2022 14:49:01 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 6ECF 0
0 44ms
23ms Image
text/html 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSuJMUpNoRO_NR90N1O4pRKfCdpMWL7q8Acvhj9fPEwJZutqUuPfbrOD31gowLp3CRiIscYwI69k56XGmYqaCSPipnAxw
Requested by: Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6ECF 142 KB
44 KB 114ms
74ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e851345505ee432c9397d60e5d91929ab4e5921f75c91f359b0939a879304b7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44792
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661945761880069"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 02 Sep 2022 14:55:09 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6ECF 0
20 B 49ms
49ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=dbg&cor=12153759712928513128&x=1&ct=119&dl=0&ds=0

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8AF6 624 B
297 B 53ms
52ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEY3df7zQEwAQ&v=APEucNUB4laDp6bPrk1Q2ubar99pAFaM16OsJTHo8ID48hp6kmG0uzvM0NI1UpYQGYgXpbt4Qdx2qqs1p1FpZ3QyXV-rX70MODGPx-EgdvbQWT4DFD9aAuPpE1s_tqYhHkYOh7OwExViiB5Qt3C1Hi8eI4oIKgNPQ3hFA8EFgQDv2EM-2-QAFp5U5QHpBD6Vxo2YZr2FNgeDq8PkiEpZNxtPijhWnVHMTQ

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 14:55:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 0A64 72 KB
26 KB 145ms
142ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4df152d8092ca4305ba2a0a3d82e98f84724d71eda19667f9e70768024a4f1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26194
x-xss-protection: 0
server: cafe
etag: 10777501457061102784
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 02 Sep 2022 14:55:09 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0A64 42 B
63 B 52ms
49ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AZHC6Acp_XXsqIlBS6ZPtA12fTc5jY8gRvZtcfrjlfG_dvp-LUbLRye7fW6-jXoJWEZz_3P023Xh6y1-orZdhgQmNnwg8nI47jNbSjADypG9CwNZc

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0A64 0
20 B 50ms
47ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=1103312503237363940&x=1&ct=76

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/ Frame 0A64 3 KB
1 KB 15ms
12ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/window_focus_fy2021.js

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:40:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 903
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Sep 2022 14:40:06 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/ Frame 0A64 17 KB
7 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:49:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 368
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Sep 2022 14:49:01 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 0A64 0
0 41ms
23ms Image
text/html 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSeAVW52QjWQJxisq0JzzonR3q45qPrtjpz5viu0uP1k9CZtbtNN0aK5HfZDCAOOdG2ncL12P_fKMP5jldskBp9ONYG1Q
Requested by: Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0A64 142 KB
44 KB 108ms
71ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e851345505ee432c9397d60e5d91929ab4e5921f75c91f359b0939a879304b7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44792
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661945761880069"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 02 Sep 2022 14:55:09 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0A64 0
20 B 50ms
48ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=dbg&cor=1103312503237363940&x=1&ct=76&dl=0&ds=0

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 6BF2 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 48c8deedd5cb9941925e23b431c22d2840cdefb9d9c33ca0b17adcfef5189fc6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 9B28
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEOOuxwSrZSd9_D_wHuNcCm8&google_cver=1&google_push=AehlK4AA8FHwBcTUmLt7YjlGCaEJtM-wdsN6RftnT8gZDcwtZhjuEcNFlITwAY9rQUtMyekkNorPXw6WhTQXB_Gt5eiXrUfwpYA
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODgxOTkzMDcwNTE4MDUyMDc2OA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEOOuxwSrZSd9_D_wHuNcCm8&google_cver=1

43 B
398 B

44ms
14ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEOOuxwSrZSd9_D_wHuNcCm8&google_cver=1
Requested by: Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEOOuxwSrZSd9_D_wHuNcCm8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 9B28
Redirect Chain

https://match.adsby.bidtheatre.com/adxcookie?id=&google_gid=CAESEEakqESXfkzSxrXMRX_3YBM&google_cver=1&google_push=AehlK4ANJZKpPyGqgAxgrAXIHMEneBGdfpCpIfv65WQHwUvV1YUuDfSe7ZQjwwQ0lBkxsg2dj7sJD3Y2Roh...
https://cm.g.doubleclick.net/pixel?google_nid=bt&google_push=AehlK4ANJZKpPyGqgAxgrAXIHMEneBGdfpCpIfv65WQHwUvV1YUuDfSe7ZQjwwQ0lBkxsg2dj7sJD3Y2Rohf-kw-Q6K6JZ9YAPU

170 B
232 B

24ms
24ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bt&google_push=AehlK4ANJZKpPyGqgAxgrAXIHMEneBGdfpCpIfv65WQHwUvV1YUuDfSe7ZQjwwQ0lBkxsg2dj7sJD3Y2Rohf-kw-Q6K6JZ9YAPU

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=bt&google_push=AehlK4ANJZKpPyGqgAxgrAXIHMEneBGdfpCpIfv65WQHwUvV1YUuDfSe7ZQjwwQ0lBkxsg2dj7sJD3Y2Rohf-kw-Q6K6JZ9YAPU
Date: Fri, 02 Sep 2022 14:55:09 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9B28
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEKLsCSu7AjXB-aPWrYM58gw&google_cver=1&google_push=AehlK4DdpFzrB3kJECdZkYLIhRMlJ_6fSJQSYEmb7ijGPF7-R0liHWCRGx-JPFxvpLF6hZtnODIuFPZ1no7JYeDcHPy3...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEKLsCSu7AjXB-aPWrYM58gw&google_cver=1&google_push=AehlK4DdpFzrB3kJECdZkYLIhRMlJ_6fSJQSYEmb7ijGPF7-R0liHWCRGx-JPFxvpLF6hZtnODIuFPZ1no7JYe...
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgoogle
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgoogle
https://x.bidswitch.net/sync?dsp_id=59&user_id=8b964080-d463-4a05-8ecf-c7efd60c190a&ssp=google
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AehlK4DdpFzrB3kJECdZkYLIhRMlJ_6fSJQSYEmb7ijGPF7-R0liHWCRGx-JPFxvpLF6hZtnODIuFPZ1no7JYeDcHPy3dwLCtlJ6&google_hm=IF7n_BhzQra6jIH-fuh-yQ==

170 B
188 B

30ms
30ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AehlK4DdpFzrB3kJECdZkYLIhRMlJ_6fSJQSYEmb7ijGPF7-R0liHWCRGx-JPFxvpLF6hZtnODIuFPZ1no7JYeDcHPy3dwLCtlJ6&google_hm=IF7n_BhzQra6jIH-fuh-yQ==

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AehlK4DdpFzrB3kJECdZkYLIhRMlJ_6fSJQSYEmb7ijGPF7-R0liHWCRGx-JPFxvpLF6hZtnODIuFPZ1no7JYeDcHPy3dwLCtlJ6&google_hm=IF7n_BhzQra6jIH-fuh-yQ==
Date: Fri, 02 Sep 2022 14:55:10 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H3 200 dot.gif
s0.2mdn.net/ Frame 9B28 43 B
65 B 54ms
21ms Image
image/gif 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEBFvkzmqaZTBmmZYfoppMLI&google_cver=1&google_push=AehlK4AElu2cjrUTumY7O--O8b-Wy1-BCnOzauR-LkRDgkjmbnx6Xide2cl3M1u1kBD7LsRe3emkPT1SsRNavK32h2JlCRbpM5s

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 03 Sep 2022 14:55:09 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9B28
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESELv1fC2vJIu9C7GQQLIXFUc&google_cver=1&google_push=AehlK4CsA7QAigPkuYl4g9lC9Bdi_n2iziLdXWUQs4KPcB9Bvf2QdjPp9Tp7NB5UN6btsGohM6TTc0_dBvYRUN0v1...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESELv1fC2vJIu9C7GQQLIXFUc&google_cver=1&google_push=AehlK4CsA7QAigPkuYl4g9lC9Bdi_n2iziLdXWUQs4KPcB9Bvf2QdjPp9Tp7NB5UN6btsGohM6TTc0_dBvYRUN0v1...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AehlK4CsA7QAigPkuYl4g9lC9Bdi_n2iziLdXWUQs4KPcB9Bvf2QdjPp9Tp7NB5UN6btsGohM6TTc0_dBvYRUN0v1UNLV46Bm-8&google_hm=FP9fuGZHQ-8dS2W0RVW0lfAD

170 B
188 B

27ms
26ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AehlK4CsA7QAigPkuYl4g9lC9Bdi_n2iziLdXWUQs4KPcB9Bvf2QdjPp9Tp7NB5UN6btsGohM6TTc0_dBvYRUN0v1UNLV46Bm-8&google_hm=FP9fuGZHQ-8dS2W0RVW0lfAD

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 02 Sep 2022 14:55:09 GMT
pod: X-Sovrn-Pod: ad_ap6ams1
location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AehlK4CsA7QAigPkuYl4g9lC9Bdi_n2iziLdXWUQs4KPcB9Bvf2QdjPp9Tp7NB5UN6btsGohM6TTc0_dBvYRUN0v1UNLV46Bm-8&google_hm=FP9fuGZHQ-8dS2W0RVW0lfAD
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
access-control-allow-credentials: true
connection: close
access-control-allow-headers: X-Requested-With, Content-Type

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 9B28
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEN...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AehlK4BBOOjOCeFw4pzZRzlJt4a5EQxXh0tK-j3iztf53F2rm6iOKq5LoMsBet2bITJjr0DeTTPJ8gvJ3SQdu7NZRslVDbpcJrOI&google_hm=

170 B
243 B

25ms
24ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AehlK4BBOOjOCeFw4pzZRzlJt4a5EQxXh0tK-j3iztf53F2rm6iOKq5LoMsBet2bITJjr0DeTTPJ8gvJ3SQdu7NZRslVDbpcJrOI&google_hm=

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AehlK4BBOOjOCeFw4pzZRzlJt4a5EQxXh0tK-j3iztf53F2rm6iOKq5LoMsBet2bITJjr0DeTTPJ8gvJ3SQdu7NZRslVDbpcJrOI&google_hm=
pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
cache-control: no-store, no-cache, must-revalidate
expires: 0
etag: OPTOUT
content-type: text/html

GET
H2

200

spacer.gif
an.yandex.ru/resource/ Frame 9B28
Redirect Chain

https://an.yandex.ru/mapuid/google/CAESEAkNsYJUrVRxWkyZzxQufRI?ext-param=AehlK4DQcJwHMoGqvlhPcsANPIeyqf82ae9lAJVcclppK_CZjbmRbE2j5AlmzuwxIJh-6ZD3GljyNvaN9axKDFpfpmnqJlgxr7Xf6w&partner-tag=yandex_ag...
https://an.yandex.ru/mapuid/google/CAESEAkNsYJUrVRxWkyZzxQufRI?redir-setuniq=1&ext-param=AehlK4DQcJwHMoGqvlhPcsANPIeyqf82ae9lAJVcclppK_CZjbmRbE2j5AlmzuwxIJh-6ZD3GljyNvaN9axKDFpfpmnqJlgxr7Xf6w&partn...
https://cm.g.doubleclick.net/pixel?google_nid=yandex_ag&google_hm=CAESEAkNsYJUrVRxWkyZzxQufRI&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
https://an.yandex.ru/resource/spacer.gif

43 B
144 B

61ms
58ms

Image
image/gif

2a02:6b8::90
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/resource/spacer.gif

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: gzip
last-modified: Wed, 18 Apr 2001 10:28:03 GMT
strict-transport-security: max-age=31536000
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif
x-xss-protection: 1; mode=block
expires: Fri, 18 Aug 2023 14:55:09 GMT

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://an.yandex.ru/resource/spacer.gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 237
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 9B28 0
232 B 68ms
21ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Jizc97hhtyR3OJ-7T5bZEyT7zERm81QZo59C9quAwLew-HXSX3ltK1dbfPMQgJRJPDFvjTkA

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 p
sb.scorecardresearch.com/ Frame EE51 43 B
265 B 60ms
9ms Image
image/gif 13.32.121.17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=18065638&ns_type=hidden&ns_st_sv=6.3.4.190424&ns_st_smv=5.10&ns_st_it=c&ns_st_id=1662130508480&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=303945&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.3.4.190424&ns_st_pn=1&ns_st_tp=1&ns_st_ci=2212212&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_ap=0&ns_st_dap=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_st_ldw=0&ns_st_ldo=0&ns_ts=1662130509637&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1157&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc12&ns_st_ge=Sports&ns_st_st=SendtoNews&ns_st_ce=0&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Cheddar%20News&c3=sendtonews&c4=Business&c6=*null&c7=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dupdatepopcorntime.xyz%26pcid%3D802%26rid%3D152%26a%3D0&c8=&c9=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dupdatepopcorntime.xyz%26pcid%3D802%26rid%3D152%26a%3D0
Requested by: Host: simcast.com
URL: https://simcast.com/?d=updatepopcorntime.xyz&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-17.fra60.r.cloudfront.net
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
via: 1.1 b3fce8903671f8346e7a6a138d2d4610.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P1
content-length: 43
x-amz-cf-id: hF5kY0piENYQ_0aW9whgJ1rQZFFlbd1kUDMy4tEN3G59SrX9h-9Rzg==
x-cache: Miss from cloudfront
content-type: image/gif

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 95ms
95ms Ping
image/gif 54.152.91.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=l-4HPEKJUipDngVr&instance=214330429&version=7.7.2&age=220902&cmd=PLAY&key=eKVKXbhX&c_id=12018&seq=1&order=7&absoluteTime=4305.8&relativeTime=1425.9&alt=0&sC_ID=8783&sm_id=2212212&load=1&status=LVFNLNIY&ac_id=2008&EXTREF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&playerCfg=FL
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.91.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-91-168.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

POST
H2 200 data_stn_l.php
timber.sendtonews.com/timber/ 0
142 B 130ms
129ms Ping
text/html 35.170.30.54
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://timber.sendtonews.com/timber/data_stn_l.php?CMD=PLAY&ESG_key=eKVKXbhX&ES_key=eKVKXbhX&ES_ID=30800&S_RKEY=PxOCAD1ClE&USR_ID=214330429&ST_usrKey=l-4HPEKJUipDngVr&SM_ID=2212212&C_ID=12018&C_companyName=Adapex&version=70070020&sC_ID=8783&AC_ID=2008&TYPE=FLOAT&EXTREF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=updatepopcorntime.xyz%26pcid=802%26rid=152%26a=0&PLAYERWIDTH=761.125&PLAYERCODE=LVFNLN&OGSET=1&REFONLY=1&STRIPQUERY=1&pposition=home
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/20220824/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.170.30.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-170-30-54.compute-1.amazonaws.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 02 Sep 2022 14:55:09 GMT
cache-control: max-age=1
server: Apache
content-type: text/html; charset=UTF-8
content-length: 0
expires: Fri, 02 Sep 2022 14:55:01 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 3776
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1&C=1

43 B
843 B

23ms
22ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYrsLG0gEwAQ&v=APEucNUrxqn--hOV_fPPdgdDVRZpFDz7hzMh7pQ2aWXt1lpCi00IkVL_iJZQEWXAHi-7BDIrT0JraeZ-djCW3QTxnI-ZnFIQipHwrFVksUiOR05F0uetJQMlZ5pr0a44EIdAjkooq_-d2_JeqtInV8bhV2_3vzX1IoK__ejYwfGUWh6Ub5FLCFKvXWCGYb7wb7sj6euY9QIC9ko6kQCyMRV8pOdVZ15MQQ
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

cf-ray: 744715c5ed399049-FRA
pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CK6%2BQ%2BJkXOcqORPf8V6Af8yPpHcze8WtBs2kQr8WYfPzELndcDyseOxHPx65HFa6CcbmesszQvA%2BWicEz2EqNnsVNitvt6w%2B244leS4ZUb4UnODYi7jPnjIVpuyYIfgwCEoOWi4ENXjixg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cl8h31ck5wEkYWbKlRdq9T%2FVuzyhfRnWYzCBLU7LBNWvXMgkTQvqbRHrfR8AeITEygzsaI4ORpiR67IYpLD%2Filyo9TXdOux0E1%2FyZue0%2BH76FtDRFTzfKTxHC4hSsxTEY7NSM1hkPPNWgg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1&C=1
cache-control: no-cache
cf-ray: 744715c59aab9164-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 3776
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YxIZTZ4AHinAAFq6XpVkNAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1

43 B
843 B

30ms
30ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYrsLG0gEwAQ&v=APEucNUrxqn--hOV_fPPdgdDVRZpFDz7hzMh7pQ2aWXt1lpCi00IkVL_iJZQEWXAHi-7BDIrT0JraeZ-djCW3QTxnI-ZnFIQipHwrFVksUiOR05F0uetJQMlZ5pr0a44EIdAjkooq_-d2_JeqtInV8bhV2_3vzX1IoK__ejYwfGUWh6Ub5FLCFKvXWCGYb7wb7sj6euY9QIC9ko6kQCyMRV8pOdVZ15MQQ
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

cf-ray: 744715c63db29049-FRA
pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EM4%2FPJBUhKvEKOG1mahTu1ieZN5bohw7RWJazmPMyT63M2QQ2YqF9fUOGVbtIhmvNUgdZ5FaJRlsldObt4gycrYtHQ%2F1nT9yF2zUwkc0addTnyCHWBtB%2BWGSOdKekRMpyT0iZIPZp2rgfw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3776
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMrxFSe3IQMY_hLTpZzkGgg&google_cver=1

43 B
1019 B

37ms
25ms

Image
image/gif

185.89.210.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMrxFSe3IQMY_hLTpZzkGgg&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYrsLG0gEwAQ&v=APEucNUrxqn--hOV_fPPdgdDVRZpFDz7hzMh7pQ2aWXt1lpCi00IkVL_iJZQEWXAHi-7BDIrT0JraeZ-djCW3QTxnI-ZnFIQipHwrFVksUiOR05F0uetJQMlZ5pr0a44EIdAjkooq_-d2_JeqtInV8bhV2_3vzX1IoK__ejYwfGUWh6Ub5FLCFKvXWCGYb7wb7sj6euY9QIC9ko6kQCyMRV8pOdVZ15MQQ

Protocol

HTTP/1.1

Server

185.89.210.90 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 02 Sep 2022 14:55:09 GMT
X-Proxy-Origin: 178.162.209.142; 178.162.209.142; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: ae59a352-5d50-4a80-91e8-b543066b4218
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMrxFSe3IQMY_hLTpZzkGgg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3776
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU3MDAwODY2MTY0ODI4NzMz

170 B
188 B

48ms
26ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU3MDAwODY2MTY0ODI4NzMz

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 02 Sep 2022 14:55:09 GMT
X-Proxy-Origin: 178.162.209.142; 178.162.209.142; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9587fc11-1be6-4e3d-8c15-a80c5444fb29
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU3MDAwODY2MTY0ODI4NzMz
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame E2F0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1&C=1

43 B
845 B

23ms
23ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKnk7gEQrLv-ARitq6rRATAB&v=APEucNXF15FprtJ2h-Ar8t8KyevasWEMh6WDHM96GS3-pZUBqAS_nlgy8gNMANqPk9rWlW8rD_L59UwJMp8kSjpEZsv52uMOFnGWWofuMPASD0qmwbSHG-KYlVBLGKTlmmtOTleDWYitgW62GwffUanEe2jQaG6xZ5vhDRvJBVlska42Q7EfXNI9v3v3gQlZMS_fhc42QE_X8N-1JSeB-ihn9iZ_ibmFQw
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

cf-ray: 744715c5ed3c9049-FRA
pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gcgY%2FpOqLLYPI1nlRZQc5pcDdCEIsFZNYN4EMP4gYxnbSOC7An65VwhzJXkHBMSdKLHVaXxDKw%2FaQ%2F1FDsZcHwaiMY5znBLz7Tz9i5DIkkjfHIHPY3xIJg5Px5gBpsQ7Do0EmhdEPDXqiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i5ZAGEstFG9F9sEvOQsbjFw%2FsRxS2ySKaIduJIC%2BPSGphut2jxKVw3lrcCsWMbwILbIyYoxJUtNBlxsG%2BZdObT9CMiTdmoCOh7uaXhaxQuakfuPojpTuoQ6KVoFw4PyqzMXuyVo%2Fb%2F%2B6mA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1&C=1
cache-control: no-cache
cf-ray: 744715c59aa89164-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame E2F0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YxIZTbEebdtGR.UL574J8QAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1&google_hm=2

43 B
845 B

20ms
20ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKnk7gEQrLv-ARitq6rRATAB&v=APEucNXF15FprtJ2h-Ar8t8KyevasWEMh6WDHM96GS3-pZUBqAS_nlgy8gNMANqPk9rWlW8rD_L59UwJMp8kSjpEZsv52uMOFnGWWofuMPASD0qmwbSHG-KYlVBLGKTlmmtOTleDWYitgW62GwffUanEe2jQaG6xZ5vhDRvJBVlska42Q7EfXNI9v3v3gQlZMS_fhc42QE_X8N-1JSeB-ihn9iZ_ibmFQw
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

cf-ray: 744715c64dd39049-FRA
pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2mPrJg2xsVkKt%2BM3xtBFj6NYGoFkucO3wjZ5dA%2BzG4UNe0IHksWur5WnqfFMykEIz8CUsgKQs%2Fjr1mxCAlrju8z3tGhhLP0EJ06Cr9fAOBGUzU%2FihjrUCAzamJs%2F15u4ZUb4bfob2GoZQQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame E2F0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMrxFSe3IQMY_hLTpZzkGgg&google_cver=1

43 B
1019 B

25ms
13ms

Image
image/gif

185.89.210.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMrxFSe3IQMY_hLTpZzkGgg&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKnk7gEQrLv-ARitq6rRATAB&v=APEucNXF15FprtJ2h-Ar8t8KyevasWEMh6WDHM96GS3-pZUBqAS_nlgy8gNMANqPk9rWlW8rD_L59UwJMp8kSjpEZsv52uMOFnGWWofuMPASD0qmwbSHG-KYlVBLGKTlmmtOTleDWYitgW62GwffUanEe2jQaG6xZ5vhDRvJBVlska42Q7EfXNI9v3v3gQlZMS_fhc42QE_X8N-1JSeB-ihn9iZ_ibmFQw

Protocol

HTTP/1.1

Server

185.89.210.90 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 02 Sep 2022 14:55:09 GMT
X-Proxy-Origin: 178.162.209.142; 178.162.209.142; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: e171d181-2b0f-4ef3-b70c-18aaa8b67099
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMrxFSe3IQMY_hLTpZzkGgg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E2F0
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA1NjAwNTA2Mzg4NTEzNzExNg%3D%3D

170 B
188 B

25ms
25ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA1NjAwNTA2Mzg4NTEzNzExNg%3D%3D

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 02 Sep 2022 14:55:09 GMT
X-Proxy-Origin: 178.162.209.142; 178.162.209.142; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: b8bce1ba-fd6d-40b0-934e-74aee935dabb
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA1NjAwNTA2Mzg4NTEzNzExNg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 8AF6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1

43 B
846 B

34ms
34ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEY3df7zQEwAQ&v=APEucNUB4laDp6bPrk1Q2ubar99pAFaM16OsJTHo8ID48hp6kmG0uzvM0NI1UpYQGYgXpbt4Qdx2qqs1p1FpZ3QyXV-rX70MODGPx-EgdvbQWT4DFD9aAuPpE1s_tqYhHkYOh7OwExViiB5Qt3C1Hi8eI4oIKgNPQ3hFA8EFgQDv2EM-2-QAFp5U5QHpBD6Vxo2YZr2FNgeDq8PkiEpZNxtPijhWnVHMTQ
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

cf-ray: 744715c80fff9049-FRA
pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5eW1WdWkONafYlOOib001REpv66jm6By7DQyB2BdokyNCO6tehW9%2Ff3LxJ0rgcNux%2F%2FfdK%2BeKdD0ftwDNMIZ8youqMHa5v1VTFnpWGZPX1O55962kKwJ7tVH5t%2Fxx55xnHy97dE8R%2BdPJQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 8AF6
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YxIZTUMHWS1IcVtW-0FulwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1

43 B
848 B

27ms
26ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEY3df7zQEwAQ&v=APEucNUB4laDp6bPrk1Q2ubar99pAFaM16OsJTHo8ID48hp6kmG0uzvM0NI1UpYQGYgXpbt4Qdx2qqs1p1FpZ3QyXV-rX70MODGPx-EgdvbQWT4DFD9aAuPpE1s_tqYhHkYOh7OwExViiB5Qt3C1Hi8eI4oIKgNPQ3hFA8EFgQDv2EM-2-QAFp5U5QHpBD6Vxo2YZr2FNgeDq8PkiEpZNxtPijhWnVHMTQ
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

cf-ray: 744715c64dce9049-FRA
pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t57Tapt94HxpD%2F6Gv%2BbQS1xeDvz5NbUvjnK5dMKHdVt79n39JyO2Qu1hBr7SPoHsSbAFPlF4%2BhIRplWSUFzYSVB6leKiXGdk8kent%2BbH0PwmcLOlyZoAaXrL4j3%2FLgLbTPeuenJu9%2F5M%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAbnrXsK1wyzNLmDKVNkbSs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 8AF6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMrxFSe3IQMY_hLTpZzkGgg&google_cver=1

43 B
1019 B

41ms
25ms

Image
image/gif

185.89.210.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMrxFSe3IQMY_hLTpZzkGgg&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEY3df7zQEwAQ&v=APEucNUB4laDp6bPrk1Q2ubar99pAFaM16OsJTHo8ID48hp6kmG0uzvM0NI1UpYQGYgXpbt4Qdx2qqs1p1FpZ3QyXV-rX70MODGPx-EgdvbQWT4DFD9aAuPpE1s_tqYhHkYOh7OwExViiB5Qt3C1Hi8eI4oIKgNPQ3hFA8EFgQDv2EM-2-QAFp5U5QHpBD6Vxo2YZr2FNgeDq8PkiEpZNxtPijhWnVHMTQ

Protocol

HTTP/1.1

Server

185.89.210.90 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 02 Sep 2022 14:55:09 GMT
X-Proxy-Origin: 178.162.209.142; 178.162.209.142; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: e97bab79-6797-4c6a-8f96-0d4dfec519a5
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMrxFSe3IQMY_hLTpZzkGgg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8AF6
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA1NjAwNTA2Mzg4NTEzNzExNg%3D%3D

170 B
188 B

30ms
29ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA1NjAwNTA2Mzg4NTEzNzExNg%3D%3D

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 02 Sep 2022 14:55:09 GMT
X-Proxy-Origin: 178.162.209.142; 178.162.209.142; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: c67a1f3a-05c4-4fc1-89d7-6cbe690e1cab
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA1NjAwNTA2Mzg4NTEzNzExNg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 528F 0
20 B 47ms
46ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2844378667544&version=m202207220101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 528F 0
20 B 47ms
47ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2844378667544&version=m202207220101&ct=76&x=1&cor=16173565658170489000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 528F 81 KB
34 KB 76ms
75ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A5dVhBAWwIAWfJ4XkkwLySlvFjwB3KoCYUzd1OrAo1xTxO96cvBUBFLq43zkjZWugXPiYJuFEWk9yXGJSPD4J0QV-si9uOnsyfiq-Sffdpw0ALsCuSNsGs153WWtbHNaKVSRKeVC_0xUtP9S_OQ6YCjU5l2g&dbm_d=AKAmf-BpN8jldtx64YK-3LoWm0sCw75EsPsPGqUAuSbjT3YD-3-LqwOB1-dIxBj2JAzL33K8p1aUORXZxlnZsmmC6tw4mFxj8lzeSk3QSrEWUdlgItIs4P-ysWBcWYxVmY9bh0Y1c-tPVruM1qqGHeWd_-HZEvmVaXj5p5Zhfm0oUkxkRT-iR6Y0KH-HWNMBZlYEi5w4F808LUjAeN-GOMmQd5dHsbIvpyw_ByCQwJl1XGW4zWYcbgay91UOXC7upgPk_CkPrLlJ4BP3W0v-E_hr2nxGDNP_GU-1_rEDQecybRtoptOoRMxz3yAg3qBUk60JT_KOVjugekakArKGc9xzB9nem-qm6FaEZKa2xLH65aYLXSV8sHpvL3Aum2c9AIWH2GZIgDFjkwYvoREECFWHMJVUjZQr77IPKDadJ8R-_KIjyMelwDzAgLmkqBFA3rXzLDQh-ZrHKJuAtMc1Yzv4EM1E7SPsw7DtcMpaVSpYEu_WTF6nxGi5t4QaQr1zyfQ8k2NLs_ATmMBjoCj9DGdsvClkoOYl7RPNdu8S4r3TgN-Gb_CCey1CPStCPKtXcHN97hnBEDCqajoPgmxVUOyTwuRx7RB9TOfRcTSTK6HogfuSNqLiJMr2EkmYaieR5FB0TpQSgQ5vWuDfW31pdqfyKU2yVM5Hd0WUz8P8nvJo6b8ic9LCCDyCyLPhicNkXBHxa34Q_fjfmJgjisDmEXCuNDxjtk5ek7ybun-tfCwo-dTDea1UiuT_q6XTzSfPtAguat4GYtDYeBzbrZsLW6KHNGYhvdFEllFZu4-Px8dqxgb1kBy7Zpzr11V9reqvgpvuGzeSMac84rx4YIV-u4Z68SdCYxd4so2-QPzTIRIHbP51pzcgj5iFt3LoQf42kYxTm2WEX_-JLRkUNRGjylryNmTDj77ld2lTZBZ1Drpl5zntw4MSvV-ufSIex6drkaFyPTr19LHQCzsd-_MV_teBc8Dzfs-GWunNigff7cDEyQCaVNPH8hI7ObhK5B6O21vw7nPtHPtqtq-gqzEceEjFD8rSWE2TM9BstEY3m18E24kPVpJ1NWDjzJao7uZ1DNjdKzzPwPNZqIX4r4h-XPpz_RbbbbmvA7dCf0UibCv1v5Zz5132Q06C-m4UKaLdNngBLQ6i6vUGVCrOJ-zYdUupL7_Y1dX-N_WAcHDmcemuN2eN1SAPJYdzHmtKN31GTckYll1C2jYfPSQ2PdxoIVPNzrnunloQHNngzJmWyX3qN-7C-u8g_NnFC6oCmpz3TOK_1LNXzofdv87DyZwhCCeQ6FcmMIHJFJqSPbr4bDFOT3VXit8MUxOIhIhyGhdXeI-ODixAPwdXrMvIZYWlZMtLqLtbX3m1okxxNaHfbTB-3AUiRdIgcHuIn69HsgOsbW7-DYHq8UpRibIc4SWHWGNqByLIscDKKHZfKNy9ejjqu1_6bY-coCjswKb8mTERM8E_JG8kYMaAqs3_lZDUjTww_nUhL-iMiBA-YWPMG_8R2M7RMVrMhLDWnjvOztW0vLG285hAT1r0IKvRBDyDVfq8MR_ktWw-7DL6-iGnaYHeuKrxFTISzOqwNUoJDA5An5loEWWT5hps2Ws_lFcBXewkehHe_TOx8NSloeDspNo1a3F784ikaMTjHyx0Y0dXCUB9vvYkDrPs7zmpH5-dxllYW0G9eo3ZKeajLe96qrSOZ67lr9R475Hd8GSL_CUMwaT1WmTyHFAvZ027oEqgKVzYDwESBmrkwnaRynSXupx4MNN9RjXG4UIwTQeR3nlBZdQcVRxKM7LiGaxJiy6Asj4PDImuIbToSd38h3YeYBZ3ZPKsqsqKzZLBZqtWJA0fvJeFIBbntnABbqqsZIIAIDGMFJ4wX-JLAGyz25zbHsVypOB-0ocTHhL0uuQrEGAHBNqFXxA3Hd4lZjvuZQccjjV3lB36b4HT1kyP1-JGuK9c_i2ryyTPexW7DArmtFUL3xjOnLNNDvCcq1qpMRJVykSIcqG_Bx0GUxl53ZTSGHqmjkNRys7hv6lUXUORP_RsOT9HnKY2NXj1-FGX0rdIbT3v0SveKsfrCdi6X1XiNGPniITnw2aCxR2b9aWU_K0Wv2CjJju855-bNyNXTpz3hUG9DidGrTPO3dczh9XGYheT0iJhJUCkGA7xMl9H1Gq9BJAupfDCDsNhz_czhHRzzzVAyeeHKwI1tdv6vaRVXan3fhl4WgSUl3WRVLKnJRaJEeqYRcs5cxfll7ekX8GeAgbfoZMBigNeoLGtT1BmwUT6iU9WbG0pUibkKDyYlui5iq_aaN2vwH85M1fEzpHgR491gNXf8khJhfWLCu1_CtSO6JI9Kw3MTx9z7xdNHwy4QVsUOeuKRqCSPKZk6FM-V9RI4bK6bY7M3v5rMOMjJ1XCnYOykqGaNBUmssMZ1T_mBbGcxui8u7vzUu8BeoJ6RUk7iplnAqvLhdj5qVeQ76hKp0q8ta9Rsl2ynXhnJnihUktBS0Wq7s_zx6X6H3U550Yfe3xCzJT_xekXe-QqEg24AyF9dduA_y35_-eJLthniZLSgiLT12dL5xVeez_yxgxLvVUF09aNVWhugFkgtQbDJ29ObQjrl9NNrakbTzDndFZ4kxwAoQ012WLtW4BNbXmWhI3wB0ZSXQvholkh4f7KUzMSfqiLjamuIejhQDbyLqXPvaAKupBtGqfhAe1GTgLVlj6cyyIFSd81y6IyLxUeoZIFNTXxlVI6_Daq4BeOrKVi1cOvZ-OBegcu-U11eMzuLOpE3qaRX31KRFgAlc9CyuJ5srNNay8rdQikfQyo1SuYaw-0neVFa1bAzJzqLJpL646Wj6GpQnvCYnGjBesjvvZLRXvhuYRwppQoAC2s1bJKxsE9ESQHIiSISmdFrh93gJAXWU3vkknEmSelB0RKEIlx_TwvjSBJDsLpTfNe0xiqhvGTQmrJeQ_pOVQiAQBwWoP0d-k4KUt5vTqfFVHC6MgiyTmjqI9nmRAH5N9hMLKYeuL8x75AVcFgsITVq4hJXQVFJY3wqEvlpaBTYRj1xaH8_m49wD_59IP8-sLvywgyoeRPY_Wt5_XZMB5_YnJd6WpZwGY0sREq9IG5t-sPFFzwhLLbKfs6T1OVy_AWZ3TYJxFQrPrUiaxJHEjTKlxa3P12RNYddmDF7TJuOOihTIzGTba6mevqPCdpXw3zJRtlj1O958CLoCQ96c4K3W73_ZuJKh0lzJMvGgwq4V6DoHZYOWlu2wqKaEg8kTrJ1b9URkO3c_LBJX4TIJQOSrv6XHpFknIA3O5HlwvE4RtLK_MuQSPgw-oNC8jrk807WRSOLEXejG-ICOXWH1vhFzoAsNjDn-6wDL_W-aQKV6P8ojzXGLfHMifgnJvXvpDZPg0FVcEDnUUnYivuBQy02l4dIp2f3Z3WnyXU1YHyiDtFK-oFTXoM48MuzuT7QrlhGtXSle_Gs3d3ZNCHaqa-UFBDm7ovROYREQ&cid=CAASJeRoYpWdNmxx9yJ77tRIfwn6bBDVG8SKRt7EiuGIGTmmkL137p0&dv3_ver=m202207220101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=0&iif=1&cor=16173565658170489000&idt=74&cac=0&dtd=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a29790b2c32e9b425ac5ab3d75d3f91a4765a42aa26003c2c7c3e5a1fd7fecec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34816
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6ECF 0
20 B 47ms
46ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2819455466876&version=m202207220101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6ECF 0
20 B 47ms
47ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2819455466876&version=m202207220101&ct=119&x=1&cor=12153759712928514000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6ECF 82 KB
34 KB 71ms
70ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DN3ZA5P4iDWWfy34KP3lRhcb0SvC_Lb0SfHkyfBebAvrbOSDZ2zHvjz_1cTic6g--pP6LZcdDzvpaAHQjOVemkH5WfeocZACEI6DlSfwLblc-QfTNEt34B3Jj7IwHGu9bML-V3oKo4LjGQkNR0vlKeY1fKrx2mv36AmCVZBopNdUA6bpU&cry=1&dbm_d=AKAmf-BpyruNboNrALc59QD8yDW-e3fZ09EOVY_D-MmOG_ER70ogH4ztnmqsEgzAPwDkqSQnYUmcqJaKsySAO8s_yMkLc99A1vJdpdLzxgy47EvgTVh0P4IGZfwnLlQMmWG-ADDqaoxdS-vslDIco1NtSaC01oObioOiJ7SqogKpqDYZ0yDSfoNaYVGRhCN_2_3hAqG1QKJ4nooSXUq34ODCoC7Koa8xOdJRlkq1HVETcN9hnjtAqclFH6AQoXYShf0iRXiaEzaiKKA1UNoKEH5YbDFe9rSiFgjsXoxlP6Q_hCOU4a-DsqhfVrXR5ZDhV9KWi3Yz7cm1Ho7XOXFB1Nay6NbggC1Q3ojLrNJPPVVqnm-Qkn6m1xjegBMwlR9mbGVDSoqEFpWC460CV2-rMafP3-WVjibCRZwA2Qy8ceOnL8K3fUb7xQ2FoZYVFTUe7QTzCZ2Cbsn8ogFjI6_U_DxBswqvL5QBaPo5UkJolukL-L1LXHrFQ0kdSUiyGfEizPLzgPVZhwXFaVtHEZbiTx4cs3k0UyWl7chVlNTeH9HJDyH5bqJ_LBWeVY2IbGF2b7La9xHf2xwFE7YbSYECgyuAuhtyQakpnGLc3aNHx0DSxTJaOrljSRr_RY-XMvdqi26Gr8gNhRAxjf8ZRUV2D18AOgb9f2JvyQphxJC9anazroqhiq4dWB3klFWEcRDx7PiSBGe9fbRDuxsYJlcFEkUhNwJ-WiqNTIdpan9ILTlIV7IUA_yMZZc5SAgbc42G_UjosWe-yaRloUe78UuDgOVOyii8mjt5NkGUTn1hxZbgeH7YVjiA9h0319dvb9eIuDpZzHgL7Ab0T16I7yiwtq4IRz8FdrmfEw_hp1oTfdfG7jKWcnPxHQYSsBXpVxo7oP4ClZ9atalfFyhEFrNGvNzUel6cGLkl8rWpA3Mwei4YJg5R8nb0XLv-HtiIoVTAvVg-LiE7VLuHfzqBo9Qd3XSpDnzFaSUgm5tuEu5YpZo06WdtrKbufv6LbmjVDDoOHkUfrCdYsDqNnuEQD6MJnKsV2BW_2qt-06J-7yfxAvQbpB5Is-3RcEicPuPolSGsdsBP72dUiVTDM7Ak6jGmn2yo91RVfSLYTq-PtK-WgABC8x0bJweGQimXSrSCCNJs8lyCPMWF2jmkbbcggTjDfUMfWv7qo2nqZv2vKvTOGx07VN-0yBwY6JAN1zyeDumq6LdPFY-Jt268Yu_IG9dRyrOtOaQA_H3sYKHCknuHXQz41zaABI_l5H0H4tJqwn0u7XrO9Kh8lzdHgFsopvE7OHruI19RUnYp91q3glZdP9wgVcgk2NE6s_ePkiEZlhXkpmLDwvT9w3YlRpfcxZTOaoCpXd3QQs73c9ww3gpDOdW07t_eUhc3lpx0_Kv6P_BecKvJ53f5cuEn-WA-1-1PwVCP04CN9cPzjlB7XZLsdvB9mlgsfRhX5ODeflngyOxPXXFvKXv7sZWCzdJt49oJXRyKn6duGXY64VCdirgNqtpekl0P6dpBiPFQkdZCieK4BLNFAA3Vvs3u8tH7Nkm9f7tIale4tYe9QVmiy1Lu2RoopiBOBktcychncOHQI7wJdfnyxzWiPuP7lkbb99PRi-z5f1Cblt-rFHKTgT3bLz1p5iFbLSpk4aLPV9kwLg8AJ5STzhUAfw8GXF6Q8obTKgdlbVwEXqmBfsEzGgqt5GYR_6sXHo8-1dToYHFVWVZJHePV6-S_9L5e_PpQ2UxvfF-OwGQ4nN7FXqLRvqMFTnT4qUsU4Y5FS0WZSiQuvCFq9MmykXALCnNxm3x_18vEqc7irTAykjbpfve-eEj6IXumDgbiGPoHpLTU7w5eZX1oJA1hNnTHW_dWz_OfB5UtHWeCol_Ax3O3My1TzUyvvFNMYGQ_Ly49AbSXOb06Y5UajGKlOa40QexnYlT_IE1HaVcHbDLcSY3UfbxKjvRuM7Xou8X33RHFxbKB-wuCEhQAI1FeDV8ru3-DZsqCFNCsOKy4ga4Mr-N0mb9yv7LHRx_lqyB4I-pzGgrfI1Yr37wT9nHOwhhSyekjdgjk0GbVIOZWM9vVRhB8qmQ5YIM-wViLxzQookKRaILdgaDlbqx23dOLvips097c9JFdMkvu30yWij3gx-aNzpQpHunPcAKM_K03r7-6xtQ9A9GZLKwi3v1bQe1uYsQ74d8LwyBiOxeYYSckloGgveqBFEAosju-qhpBdQzrqOJ3kpo8SU9kAntKAlXF-RLEQdWzNw0ZNjlTUnVzArqs0U1KMs9o3KLB1xVFAmeRIUArSUq_2Rq0g1UGS2F_f1UxSUCpkeOK6DaFKr1vjUj1TDasscWbYF08SLvY6qiyppVKpBYaZS00OJM4e4HRnQyEhnNa_oPPDgqTwsC2yJ53Oq0GWbfrOH_z2fSbc-uU3qilewTxi8Z50q1YRQ0R1vuLpx7wuyvbHtqnWWT34dVILuxac9e07Y_I0kYwX2Ldnhu6SSzPL_p6VZLcQ64rTzDm4d4zu9BhFC13gOsgET6kvNZ02L1YY3sYKKN8flZk4KJjbD3bZChLLFrtSN6eRsvO7Lkn6_leismwQcIskN4luG4aMau6agtxMdO1loGyys1Lu0Cs7fgLqwev39SAlVu28opLZu_iaEzHYvaCFZflC8JdSZj-5KHY3VuN7w9TnrHDkbo3fbkuT3tZlIGwwz6YGuAvmsygVz9ZjISK3qGnHIT0SxBcCWCN1t6CX4TAvvBvbHNeQFXcx1seIidbWUP-elemB4QCD73Xs_a7rImC9ii64cD3CkOrHYGPVdBnTdyG-AT85ukh73U0dsNuQZyatvwjAgq61xKFWIJgDrR483C9kTgDY9m7yzHy_QFtAbkw9oBztylyhWNm6MJgHik6nP8aNHVx4qjMByyFHyMnxYPLnjVIkQ1n5Fu7995RCLs7DWNyF3McQ0Id3uJOkquLfgvZYmjySjIhOvdtkmdkQD0vWrUg0adcY8FUNPDTS2x7umRek90TV9SU7y16VG6cc8QDuU-sU-ScqAu1k3shmX5dupwhvo2baeeL-6EwI4m2T_aYIEHWPJkewM0iek_8hLRr5kP_J3GKblojenJPI9ZUOyv2hIcqYH_kjhY6EX8b5Wtqi7tIh1kCtyX9vAV_6b9XTL6otEEQEzmCZ6OKr4dkEQ885bFqhVR74XELqyN98OU7E8_fR6HVnNXhLrZCes4KkBgkAl7p-G55JdUQDRhg1HiONBvUszBOLRBOpwjzNMJotyc3I4iIp5X_6XZ1xyXIbQnN01XcP9hQnPRmRd-lPI-DFKK_JXOtBSWnqLhmDP4YAu4NHL1Vzim77T-4bvulqb4cLespHJ0mLoOpzuJa9qFYRP8mrM1sMnmcBZUmC3x3iVnX0L5vkiS4aGe-D8eG3TLfWxgE_LKIgJp7L9K8Mqeuxf8Qn6cmZ9M367v8AwU96I82GFSvI6TN6yH1UXO2HaESRz50eqp79mMSTcqCZ5fXMxbE0rKTNustYFv5_QxmaZKLqGQns0PTPV1HBqwDgzaxnVIwQdTWXVKJ1zMhHKi4FCeh0eI2C0NVKUMWiwFtIqDNizyRj8JfPyAHNo6hWa9jE2VwcvnFrWTYpOVhLdxYVCT6pTMOEgyrPSpwM6OE4YE-6UoVOFN60ilQGk5rQrDJ4MOB7W7qa726TtNzzNYNbNJQ68XZ3pcPpyPxeVVf75EQKfPqNIW4KyEtUmY2CAqnwaDkSnq2Crkc5bHN3eTrRQFFqMnpiXpymOSfr3-RgfhVQtcUho61x_hl8u7c6e_iCH_VVnvMQG6im_WkKYZME3_eRwl53xrPKl9FeVr0819MgHAOumh5R6siw8HnqCTZ-7CgY_sAylDPbLzqd4SEseVLwOZ6dojiZX1zgCPIsCmcltJZAzJJq2_i9lrzYRzCoIlkDVCh-h-KYXkpj_BaahL-Z8A3eZJ2-lj-DXwXGvcTpwewpdM8XrEVaKDztPogKo3gxE8a6q3SXpdh9mRQH73prOwOSWSvmLY&cid=CAASJeRofkwqjEhZH8NcPu1phx-kRqPrk6vbQG4ewIdoDmRFHrDELoE&dv3_ver=m202207220101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=0&iif=1&cor=12153759712928514000&idt=110&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de22342ed23baa8dc7174e414def1e8ee2a82e44147e8df97a59ffbb6cfa9b8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34760
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0A64 0
20 B 47ms
47ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8935654144500&version=m202207220101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0A64 0
20 B 48ms
48ms Ping
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8935654144500&version=m202207220101&ct=76&x=1&cor=1103312503237364000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0A64 81 KB
34 KB 78ms
78ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CG1MWQtaMihVJDzpzi6FrFXWVkQ33vBOAykdL0zFS49Wbe_OOZWaMajn_R7WEMIQE8liXbBS_vaT5Lx_gHFaIIvv1Qd_kleUAxxbQqdOS6puFoOhad-TaaLnGsVz83UH_25Q-FX2BzMU6iFAWMPwMZF-ylVg&dbm_d=AKAmf-CIcvAJpEZQ9rrupCpy_PLEthYlkjAd3OXRaAzztE1k6p71Nc5-VuO-OE7VqqdTcfGII1MPwh4MnIJPxRLEmtNRqv2UypodZHwSihT9ak3m_b2zP-tC7gyaMbj4dg-FbAus6hhpkfNvBmxpRRhzYqgAIbHKFOmdz5CLi94vPKu-mOZKQ-kuDg6Mp2r8g58hFWNIUEuRRnmCBVGQD59PubCsQTTaN1V3AZmju3eBPWSPg856gYBbyJCoE4cQkFU0SfY_R2Q-NiUFXf4yoklm3wl6Nlqk1_Vl4RlP1XMxQdDNlfowqvRI6u0xQNtV2lDLr0Q1Ay7kxl1dYlO8wVb1gNg7_8PmBbgyYlUqRomJcX332Zkhn7LrELI8GOERLwspntIzx-I_S7ZD8WwEfVTxppI7F_j1cpJrkBa8jclH6oaQx_sjdA-ThfM6gqfMMx-g7yKR9Vt52VC2CMxvQiV03N7SzGVjof0JEg1iCbbXG3aZ9evG0rmAgEiq5mfDE9jFLGydUSzYtaZ49CP332Nd7-GHtTsEb5gqoXXvxUWu_6G9BEzAH-TL9F_WHJ3oL4lgH7otC-MIUuYz82rALIgCkJFA_qM8vte4o966zzCfMrgf5LxEVUjrc5JqVwJtos5-L7H4PdMbG0EvfomYiC_wpVT6RBmJ8-kmBFzxsNodoNo1mARqv8tNsDssq8naddkNGZHlCLOz48ZiNrcCgRX-0XM_Na34paMx6crWTL0eUAgMVGXyAC97il_k3JX7n2zRljOad8hEZA7y4F4pl9Quc2GwgWqSmv4DKPvRNRVOH_u3ePDG_Fb8fMXuprVZSJurAECV6KnEneOYDttKqgJzxkLmKBXTAEstIdgCp5cHJXmegNIE4QUnBnzilyFaxGEEiWG7HpHYAzh-CWOiEQle3Xe1ytdd0tjfmx-Y7FDyWdC3QNnRYtFGKnPJjjhy3Y7lwLFRLKAoJVMQiIU8xkYx3nmfGkAMq2o72-gMYNh3Rq4FXYz_opqhPPQ6Cj3n7VwSbq_uEqpmWzL011uOFT-RvS9y3qtmIzt1wrIsaHItIVONsIEg7rCtXijzpoXtclaYIqbZuNbcOjFMb6mUyqMgZmQ9DtqvZWFDTlHqGC9BhQojV-_JuutIyHaWCxyWrG6BXJLs5L12WQ6HamAnMe5D0Qva3Hd0qG3AkmU8tpnVFWlE9sPGT-GRRPH4uaJgQ7KrUlfcTrzAQOArXom2ptzN1mMo69SIsSBE1fh_ZV9G11IgQsxF3PN1lXkrnEn-P1QBhJmzSUAsmUOjDx2Pfv6BdPmdu7Vl-9PJsoLQxbGm_3TFKR4d1YhrtCM3TNKHAGjxHVf8b73670nc2B1ctdtJ4zjeEMyvOYmWy2lHS0660QVDM825agFgotzgh59P8dapsdiL74ci2UcG2EH87dAkg4-qT6NXQG3WmdhpULp2M3KCLLiITIRxOv_zFBgbxzXw9Qm8C--_7c1YXw00hU79W1Xm4FYrxgxE6R7jwWFMYppyXN9w0FUd9sF52gisCdsr72pnFwwhLnNixiljpLA416W20rW_WStiG_h-D4pDKc-0NthK-rlIRksGNXJkwSKjSqig0e4z-eB6tiZP-wucWXKKYzpxzcvmzc8TXzAHZ69o7vYZpCA2bqa4gIkUC0GL6kR0swEEwxp8iAytcMgAvQWkBFXhrp9nWp1zwML2QzKuoMPwJXgMvloxprA3Fe6fWHPcfBibjPRrliQ71yB7T8dJ1AiSdwDOUYXCt0n00EgI6Zxj_ghJ5e1I05UPaAZK8u_6zrbzfaR8uR-KuAblny0mPWelbrCoG8sg2OeWkt3ghLXbo9OKpWiWX8KRsoUJiBY_Uiy2wTxgeCPfWHFpfe-F3R1FcZdr5GyXqPvlVElN4e7xeXA92OnwDeuG2tFZ4u3uzSa7NUfWFiNMg4v81ws3yw5xIwDlWfhdTPBV52OqaFKEPASQCYrhfb97fRvhdD9Hy7cgI2hJrwhYYNXPDsS5lwW8tRykj7bsm2kMg97qhhl0sRwNg3LEGwoenLn5-x0lFVENFoJybbn7HLvim--p9USidxKuewjAWSKB8yfNOj-QoF1Mrn8aN_lrLz9IIm_m29DSrGyRAdkTF8l3gI9jCgRL-iimER7DagfdEebzJzvx-CBipOemAzIKioevL43ilfFIkfcW-4jv0qapfGOhN82_MfArS5OYRnMYDUf89P_3LpxWPQLJCxofJCNwXmu3R_FurXYOthVg3BoF28wKv21ynTWUwwzMUDyfv4giqNtgu6kvj0nI5gXKn6JYTw5LJbNP6fJzTpnYVOTTyrBnMt5-eYR6CTDILYTqhbf6nDVWTqX9ohj94aHsZLSkoxwqdzOBZ3amAkXUzt5ZEZJBuB-SJWS_yh_B1ReNyiu9REga7nXKgkvQaNoYWkgYk5evpvZH2nJT-u-si8K4Zr5KdBrtu3RcZ2zp9Rq-pD9z2EmvEuVB7aJowpdGE-BWQdc6R6wR9SSblCfR976wkHUolbYBf1cqOgDj9QelyLe57mJq_7KU2yT1WKU0Ja6t495G5zkvfRlFgrEJbh8f30S4wegqnmcbTxcl1CuYR9_ZXIgVx8SbVv9PJc4nwpM5li7ZlHQIfnIwYjjLb7vSOLhcv_FyOIlNY83M4Emgklmodm60B5DHOLdFBD0WQT0lTR7pg_LQxXOXDWPjSoWb38P-3gLLI_Mr3rQ82-buy-7QmT94orWN_7B_4Ez3J5znolYrXQTBsgt9DGTpGM7bBEaxOs4U4rMErTA0Kz-OCUjjRFiRv4eOAuYTnBgmGhu-6AETlwsMrgx8NWEmHPdxqyixMnyDyPSekM5NjfFVUandR6Nn0xqRX3gHC_kNXEXGbXY1Cxm6Jni8JSuTk_BnaupMnd8Qa_GFpbEXxv6A2Sg7BQk-bS3ieK9-WFLX0e2ZymTWfBOh1S3EXGKkqwAS3ngMRqrb6uljy6qRlGu1Q60FfYvWpkRWWZgdGlo0QRUq68Ffxv8i9LjJ6ui0KSWOewyn5m-neGtoR7QB5ncLjS1uEx45jHHifpivK6eo7vkoQlG6S2tvY-YQc39dsjVy-Wk9lwRdoTzzFzJNm1QHjeyAykoxHFhtkps8XxhNONDz2fX6N-9WgFZJd5pSsZQOGJZcY9y89QSOIrJ5274ieCnOg-Rt147UEV-wbF1FPMinZm6wv_b3alcNVZ6bqZoxGlounVJo5CRVFECwaehtHGjZJbV8ZA83DZXRgQMN6GeC7KKeCkP5Kzy1xSVudFpdt1xnfBR9pU32o-O_izKGlAM20njPEX0WrZ33R3IaeNBtwiLQ8axGSO3gUouMZgifrH_6odePgxMkkz_9pQ1PuLck3i-ygzN7Na-6EpBMNu61jYAZoJVuBt3xSbBv9YTPn9iHCJNhU1NDWq8a-Tp58fkimECurjRhfbjFS_DJkoBDiP6dIzMv3tOhjckNLUzvV6XrkSIZhQ&cid=CAASJeRomq1U62USEHUkejksi4fbgE2PUfZSM6dKeDvgAKHNQyfpYbQ&dv3_ver=m202207220101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=0&iif=1&cor=1103312503237364000&idt=150&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0facb63b0526559e639f826f06d42413b58ee7f7a532726940ba28085e7893f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34884
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 528F 170 KB
59 KB 44ms
16ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Requested by

Host: updatepopcorntime.xyz
URL: http://updatepopcorntime.xyz/?app_id=T4PSEC&hid=9a19de2de347e5fa3864eee56e1bc6a3&ver=6.2.1.14&os=WIN060101

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Origin: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 16:51:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79417
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60311
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Sep 2022 16:51:32 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/elements/html/ Frame 528F 8 KB
3 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A5dVhBAWwIAWfJ4XkkwLySlvFjwB3KoCYUzd1OrAo1xTxO96cvBUBFLq43zkjZWugXPiYJuFEWk9yXGJSPD4J0QV-si9uOnsyfiq-Sffdpw0ALsCuSNsGs153WWtbHNaKVSRKeVC_0xUtP9S_OQ6YCjU5l2g&dbm_d=AKAmf-BpN8jldtx64YK-3LoWm0sCw75EsPsPGqUAuSbjT3YD-3-LqwOB1-dIxBj2JAzL33K8p1aUORXZxlnZsmmC6tw4mFxj8lzeSk3QSrEWUdlgItIs4P-ysWBcWYxVmY9bh0Y1c-tPVruM1qqGHeWd_-HZEvmVaXj5p5Zhfm0oUkxkRT-iR6Y0KH-HWNMBZlYEi5w4F808LUjAeN-GOMmQd5dHsbIvpyw_ByCQwJl1XGW4zWYcbgay91UOXC7upgPk_CkPrLlJ4BP3W0v-E_hr2nxGDNP_GU-1_rEDQecybRtoptOoRMxz3yAg3qBUk60JT_KOVjugekakArKGc9xzB9nem-qm6FaEZKa2xLH65aYLXSV8sHpvL3Aum2c9AIWH2GZIgDFjkwYvoREECFWHMJVUjZQr77IPKDadJ8R-_KIjyMelwDzAgLmkqBFA3rXzLDQh-ZrHKJuAtMc1Yzv4EM1E7SPsw7DtcMpaVSpYEu_WTF6nxGi5t4QaQr1zyfQ8k2NLs_ATmMBjoCj9DGdsvClkoOYl7RPNdu8S4r3TgN-Gb_CCey1CPStCPKtXcHN97hnBEDCqajoPgmxVUOyTwuRx7RB9TOfRcTSTK6HogfuSNqLiJMr2EkmYaieR5FB0TpQSgQ5vWuDfW31pdqfyKU2yVM5Hd0WUz8P8nvJo6b8ic9LCCDyCyLPhicNkXBHxa34Q_fjfmJgjisDmEXCuNDxjtk5ek7ybun-tfCwo-dTDea1UiuT_q6XTzSfPtAguat4GYtDYeBzbrZsLW6KHNGYhvdFEllFZu4-Px8dqxgb1kBy7Zpzr11V9reqvgpvuGzeSMac84rx4YIV-u4Z68SdCYxd4so2-QPzTIRIHbP51pzcgj5iFt3LoQf42kYxTm2WEX_-JLRkUNRGjylryNmTDj77ld2lTZBZ1Drpl5zntw4MSvV-ufSIex6drkaFyPTr19LHQCzsd-_MV_teBc8Dzfs-GWunNigff7cDEyQCaVNPH8hI7ObhK5B6O21vw7nPtHPtqtq-gqzEceEjFD8rSWE2TM9BstEY3m18E24kPVpJ1NWDjzJao7uZ1DNjdKzzPwPNZqIX4r4h-XPpz_RbbbbmvA7dCf0UibCv1v5Zz5132Q06C-m4UKaLdNngBLQ6i6vUGVCrOJ-zYdUupL7_Y1dX-N_WAcHDmcemuN2eN1SAPJYdzHmtKN31GTckYll1C2jYfPSQ2PdxoIVPNzrnunloQHNngzJmWyX3qN-7C-u8g_NnFC6oCmpz3TOK_1LNXzofdv87DyZwhCCeQ6FcmMIHJFJqSPbr4bDFOT3VXit8MUxOIhIhyGhdXeI-ODixAPwdXrMvIZYWlZMtLqLtbX3m1okxxNaHfbTB-3AUiRdIgcHuIn69HsgOsbW7-DYHq8UpRibIc4SWHWGNqByLIscDKKHZfKNy9ejjqu1_6bY-coCjswKb8mTERM8E_JG8kYMaAqs3_lZDUjTww_nUhL-iMiBA-YWPMG_8R2M7RMVrMhLDWnjvOztW0vLG285hAT1r0IKvRBDyDVfq8MR_ktWw-7DL6-iGnaYHeuKrxFTISzOqwNUoJDA5An5loEWWT5hps2Ws_lFcBXewkehHe_TOx8NSloeDspNo1a3F784ikaMTjHyx0Y0dXCUB9vvYkDrPs7zmpH5-dxllYW0G9eo3ZKeajLe96qrSOZ67lr9R475Hd8GSL_CUMwaT1WmTyHFAvZ027oEqgKVzYDwESBmrkwnaRynSXupx4MNN9RjXG4UIwTQeR3nlBZdQcVRxKM7LiGaxJiy6Asj4PDImuIbToSd38h3YeYBZ3ZPKsqsqKzZLBZqtWJA0fvJeFIBbntnABbqqsZIIAIDGMFJ4wX-JLAGyz25zbHsVypOB-0ocTHhL0uuQrEGAHBNqFXxA3Hd4lZjvuZQccjjV3lB36b4HT1kyP1-JGuK9c_i2ryyTPexW7DArmtFUL3xjOnLNNDvCcq1qpMRJVykSIcqG_Bx0GUxl53ZTSGHqmjkNRys7hv6lUXUORP_RsOT9HnKY2NXj1-FGX0rdIbT3v0SveKsfrCdi6X1XiNGPniITnw2aCxR2b9aWU_K0Wv2CjJju855-bNyNXTpz3hUG9DidGrTPO3dczh9XGYheT0iJhJUCkGA7xMl9H1Gq9BJAupfDCDsNhz_czhHRzzzVAyeeHKwI1tdv6vaRVXan3fhl4WgSUl3WRVLKnJRaJEeqYRcs5cxfll7ekX8GeAgbfoZMBigNeoLGtT1BmwUT6iU9WbG0pUibkKDyYlui5iq_aaN2vwH85M1fEzpHgR491gNXf8khJhfWLCu1_CtSO6JI9Kw3MTx9z7xdNHwy4QVsUOeuKRqCSPKZk6FM-V9RI4bK6bY7M3v5rMOMjJ1XCnYOykqGaNBUmssMZ1T_mBbGcxui8u7vzUu8BeoJ6RUk7iplnAqvLhdj5qVeQ76hKp0q8ta9Rsl2ynXhnJnihUktBS0Wq7s_zx6X6H3U550Yfe3xCzJT_xekXe-QqEg24AyF9dduA_y35_-eJLthniZLSgiLT12dL5xVeez_yxgxLvVUF09aNVWhugFkgtQbDJ29ObQjrl9NNrakbTzDndFZ4kxwAoQ012WLtW4BNbXmWhI3wB0ZSXQvholkh4f7KUzMSfqiLjamuIejhQDbyLqXPvaAKupBtGqfhAe1GTgLVlj6cyyIFSd81y6IyLxUeoZIFNTXxlVI6_Daq4BeOrKVi1cOvZ-OBegcu-U11eMzuLOpE3qaRX31KRFgAlc9CyuJ5srNNay8rdQikfQyo1SuYaw-0neVFa1bAzJzqLJpL646Wj6GpQnvCYnGjBesjvvZLRXvhuYRwppQoAC2s1bJKxsE9ESQHIiSISmdFrh93gJAXWU3vkknEmSelB0RKEIlx_TwvjSBJDsLpTfNe0xiqhvGTQmrJeQ_pOVQiAQBwWoP0d-k4KUt5vTqfFVHC6MgiyTmjqI9nmRAH5N9hMLKYeuL8x75AVcFgsITVq4hJXQVFJY3wqEvlpaBTYRj1xaH8_m49wD_59IP8-sLvywgyoeRPY_Wt5_XZMB5_YnJd6WpZwGY0sREq9IG5t-sPFFzwhLLbKfs6T1OVy_AWZ3TYJxFQrPrUiaxJHEjTKlxa3P12RNYddmDF7TJuOOihTIzGTba6mevqPCdpXw3zJRtlj1O958CLoCQ96c4K3W73_ZuJKh0lzJMvGgwq4V6DoHZYOWlu2wqKaEg8kTrJ1b9URkO3c_LBJX4TIJQOSrv6XHpFknIA3O5HlwvE4RtLK_MuQSPgw-oNC8jrk807WRSOLEXejG-ICOXWH1vhFzoAsNjDn-6wDL_W-aQKV6P8ojzXGLfHMifgnJvXvpDZPg0FVcEDnUUnYivuBQy02l4dIp2f3Z3WnyXU1YHyiDtFK-oFTXoM48MuzuT7QrlhGtXSle_Gs3d3ZNCHaqa-UFBDm7ovROYREQ&cid=CAASJeRoYpWdNmxx9yJ77tRIfwn6bBDVG8SKRt7EiuGIGTmmkL137p0&dv3_ver=m202207220101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=0&iif=1&cor=16173565658170489000&idt=74&cac=0&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:51:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 226
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Sep 2022 14:51:23 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/ Frame 528F 30 KB
12 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35700fd4dc1a4008ab66bc0e57c19689f6daca9368bfd2a6beea1b86dc0159d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:52:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 177
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11778
x-xss-protection: 0
server: cafe
etag: 15541287485089275602
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Sep 2022 14:52:12 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 6ECF 106 KB
37 KB 24ms
14ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: updatepopcorntime.xyz
URL: http://updatepopcorntime.xyz/?app_id=T4PSEC&hid=9a19de2de347e5fa3864eee56e1bc6a3&ver=6.2.1.14&os=WIN060101

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Origin: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 07:50:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25453
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 03 Sep 2022 07:50:56 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/elements/html/ Frame 6ECF 8 KB
3 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DN3ZA5P4iDWWfy34KP3lRhcb0SvC_Lb0SfHkyfBebAvrbOSDZ2zHvjz_1cTic6g--pP6LZcdDzvpaAHQjOVemkH5WfeocZACEI6DlSfwLblc-QfTNEt34B3Jj7IwHGu9bML-V3oKo4LjGQkNR0vlKeY1fKrx2mv36AmCVZBopNdUA6bpU&cry=1&dbm_d=AKAmf-BpyruNboNrALc59QD8yDW-e3fZ09EOVY_D-MmOG_ER70ogH4ztnmqsEgzAPwDkqSQnYUmcqJaKsySAO8s_yMkLc99A1vJdpdLzxgy47EvgTVh0P4IGZfwnLlQMmWG-ADDqaoxdS-vslDIco1NtSaC01oObioOiJ7SqogKpqDYZ0yDSfoNaYVGRhCN_2_3hAqG1QKJ4nooSXUq34ODCoC7Koa8xOdJRlkq1HVETcN9hnjtAqclFH6AQoXYShf0iRXiaEzaiKKA1UNoKEH5YbDFe9rSiFgjsXoxlP6Q_hCOU4a-DsqhfVrXR5ZDhV9KWi3Yz7cm1Ho7XOXFB1Nay6NbggC1Q3ojLrNJPPVVqnm-Qkn6m1xjegBMwlR9mbGVDSoqEFpWC460CV2-rMafP3-WVjibCRZwA2Qy8ceOnL8K3fUb7xQ2FoZYVFTUe7QTzCZ2Cbsn8ogFjI6_U_DxBswqvL5QBaPo5UkJolukL-L1LXHrFQ0kdSUiyGfEizPLzgPVZhwXFaVtHEZbiTx4cs3k0UyWl7chVlNTeH9HJDyH5bqJ_LBWeVY2IbGF2b7La9xHf2xwFE7YbSYECgyuAuhtyQakpnGLc3aNHx0DSxTJaOrljSRr_RY-XMvdqi26Gr8gNhRAxjf8ZRUV2D18AOgb9f2JvyQphxJC9anazroqhiq4dWB3klFWEcRDx7PiSBGe9fbRDuxsYJlcFEkUhNwJ-WiqNTIdpan9ILTlIV7IUA_yMZZc5SAgbc42G_UjosWe-yaRloUe78UuDgOVOyii8mjt5NkGUTn1hxZbgeH7YVjiA9h0319dvb9eIuDpZzHgL7Ab0T16I7yiwtq4IRz8FdrmfEw_hp1oTfdfG7jKWcnPxHQYSsBXpVxo7oP4ClZ9atalfFyhEFrNGvNzUel6cGLkl8rWpA3Mwei4YJg5R8nb0XLv-HtiIoVTAvVg-LiE7VLuHfzqBo9Qd3XSpDnzFaSUgm5tuEu5YpZo06WdtrKbufv6LbmjVDDoOHkUfrCdYsDqNnuEQD6MJnKsV2BW_2qt-06J-7yfxAvQbpB5Is-3RcEicPuPolSGsdsBP72dUiVTDM7Ak6jGmn2yo91RVfSLYTq-PtK-WgABC8x0bJweGQimXSrSCCNJs8lyCPMWF2jmkbbcggTjDfUMfWv7qo2nqZv2vKvTOGx07VN-0yBwY6JAN1zyeDumq6LdPFY-Jt268Yu_IG9dRyrOtOaQA_H3sYKHCknuHXQz41zaABI_l5H0H4tJqwn0u7XrO9Kh8lzdHgFsopvE7OHruI19RUnYp91q3glZdP9wgVcgk2NE6s_ePkiEZlhXkpmLDwvT9w3YlRpfcxZTOaoCpXd3QQs73c9ww3gpDOdW07t_eUhc3lpx0_Kv6P_BecKvJ53f5cuEn-WA-1-1PwVCP04CN9cPzjlB7XZLsdvB9mlgsfRhX5ODeflngyOxPXXFvKXv7sZWCzdJt49oJXRyKn6duGXY64VCdirgNqtpekl0P6dpBiPFQkdZCieK4BLNFAA3Vvs3u8tH7Nkm9f7tIale4tYe9QVmiy1Lu2RoopiBOBktcychncOHQI7wJdfnyxzWiPuP7lkbb99PRi-z5f1Cblt-rFHKTgT3bLz1p5iFbLSpk4aLPV9kwLg8AJ5STzhUAfw8GXF6Q8obTKgdlbVwEXqmBfsEzGgqt5GYR_6sXHo8-1dToYHFVWVZJHePV6-S_9L5e_PpQ2UxvfF-OwGQ4nN7FXqLRvqMFTnT4qUsU4Y5FS0WZSiQuvCFq9MmykXALCnNxm3x_18vEqc7irTAykjbpfve-eEj6IXumDgbiGPoHpLTU7w5eZX1oJA1hNnTHW_dWz_OfB5UtHWeCol_Ax3O3My1TzUyvvFNMYGQ_Ly49AbSXOb06Y5UajGKlOa40QexnYlT_IE1HaVcHbDLcSY3UfbxKjvRuM7Xou8X33RHFxbKB-wuCEhQAI1FeDV8ru3-DZsqCFNCsOKy4ga4Mr-N0mb9yv7LHRx_lqyB4I-pzGgrfI1Yr37wT9nHOwhhSyekjdgjk0GbVIOZWM9vVRhB8qmQ5YIM-wViLxzQookKRaILdgaDlbqx23dOLvips097c9JFdMkvu30yWij3gx-aNzpQpHunPcAKM_K03r7-6xtQ9A9GZLKwi3v1bQe1uYsQ74d8LwyBiOxeYYSckloGgveqBFEAosju-qhpBdQzrqOJ3kpo8SU9kAntKAlXF-RLEQdWzNw0ZNjlTUnVzArqs0U1KMs9o3KLB1xVFAmeRIUArSUq_2Rq0g1UGS2F_f1UxSUCpkeOK6DaFKr1vjUj1TDasscWbYF08SLvY6qiyppVKpBYaZS00OJM4e4HRnQyEhnNa_oPPDgqTwsC2yJ53Oq0GWbfrOH_z2fSbc-uU3qilewTxi8Z50q1YRQ0R1vuLpx7wuyvbHtqnWWT34dVILuxac9e07Y_I0kYwX2Ldnhu6SSzPL_p6VZLcQ64rTzDm4d4zu9BhFC13gOsgET6kvNZ02L1YY3sYKKN8flZk4KJjbD3bZChLLFrtSN6eRsvO7Lkn6_leismwQcIskN4luG4aMau6agtxMdO1loGyys1Lu0Cs7fgLqwev39SAlVu28opLZu_iaEzHYvaCFZflC8JdSZj-5KHY3VuN7w9TnrHDkbo3fbkuT3tZlIGwwz6YGuAvmsygVz9ZjISK3qGnHIT0SxBcCWCN1t6CX4TAvvBvbHNeQFXcx1seIidbWUP-elemB4QCD73Xs_a7rImC9ii64cD3CkOrHYGPVdBnTdyG-AT85ukh73U0dsNuQZyatvwjAgq61xKFWIJgDrR483C9kTgDY9m7yzHy_QFtAbkw9oBztylyhWNm6MJgHik6nP8aNHVx4qjMByyFHyMnxYPLnjVIkQ1n5Fu7995RCLs7DWNyF3McQ0Id3uJOkquLfgvZYmjySjIhOvdtkmdkQD0vWrUg0adcY8FUNPDTS2x7umRek90TV9SU7y16VG6cc8QDuU-sU-ScqAu1k3shmX5dupwhvo2baeeL-6EwI4m2T_aYIEHWPJkewM0iek_8hLRr5kP_J3GKblojenJPI9ZUOyv2hIcqYH_kjhY6EX8b5Wtqi7tIh1kCtyX9vAV_6b9XTL6otEEQEzmCZ6OKr4dkEQ885bFqhVR74XELqyN98OU7E8_fR6HVnNXhLrZCes4KkBgkAl7p-G55JdUQDRhg1HiONBvUszBOLRBOpwjzNMJotyc3I4iIp5X_6XZ1xyXIbQnN01XcP9hQnPRmRd-lPI-DFKK_JXOtBSWnqLhmDP4YAu4NHL1Vzim77T-4bvulqb4cLespHJ0mLoOpzuJa9qFYRP8mrM1sMnmcBZUmC3x3iVnX0L5vkiS4aGe-D8eG3TLfWxgE_LKIgJp7L9K8Mqeuxf8Qn6cmZ9M367v8AwU96I82GFSvI6TN6yH1UXO2HaESRz50eqp79mMSTcqCZ5fXMxbE0rKTNustYFv5_QxmaZKLqGQns0PTPV1HBqwDgzaxnVIwQdTWXVKJ1zMhHKi4FCeh0eI2C0NVKUMWiwFtIqDNizyRj8JfPyAHNo6hWa9jE2VwcvnFrWTYpOVhLdxYVCT6pTMOEgyrPSpwM6OE4YE-6UoVOFN60ilQGk5rQrDJ4MOB7W7qa726TtNzzNYNbNJQ68XZ3pcPpyPxeVVf75EQKfPqNIW4KyEtUmY2CAqnwaDkSnq2Crkc5bHN3eTrRQFFqMnpiXpymOSfr3-RgfhVQtcUho61x_hl8u7c6e_iCH_VVnvMQG6im_WkKYZME3_eRwl53xrPKl9FeVr0819MgHAOumh5R6siw8HnqCTZ-7CgY_sAylDPbLzqd4SEseVLwOZ6dojiZX1zgCPIsCmcltJZAzJJq2_i9lrzYRzCoIlkDVCh-h-KYXkpj_BaahL-Z8A3eZJ2-lj-DXwXGvcTpwewpdM8XrEVaKDztPogKo3gxE8a6q3SXpdh9mRQH73prOwOSWSvmLY&cid=CAASJeRofkwqjEhZH8NcPu1phx-kRqPrk6vbQG4ewIdoDmRFHrDELoE&dv3_ver=m202207220101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=0&iif=1&cor=12153759712928514000&idt=110&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:51:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 226
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Sep 2022 14:51:23 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/ Frame 6ECF 30 KB
12 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35700fd4dc1a4008ab66bc0e57c19689f6daca9368bfd2a6beea1b86dc0159d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:52:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 177
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11778
x-xss-protection: 0
server: cafe
etag: 15541287485089275602
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Sep 2022 14:52:12 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 528F 41 KB
15 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 16:49:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79549
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Sep 2023 16:49:20 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2038 1 KB
749 B 13ms
13ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 5994
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 13:15:15 GMT
etag: 48472445140208031
expires: Sat, 03 Sep 2022 13:15:15 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 528F 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 17eb7b6a04f35c423c996276c0da7fdd4580293344972a179a05395406ad9f54

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6ECF 41 KB
15 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 16:49:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79549
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Sep 2023 16:49:20 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C5E7 1 KB
749 B 13ms
12ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 5994
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 13:15:15 GMT
etag: 48472445140208031
expires: Sat, 03 Sep 2022 13:15:15 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 6ECF 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 117d5895d240b150e8b8a2cf4cfd998b15254ea844e8e612a6c19a4edc705a05

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame F11D 22 KB
8 KB 13ms
13ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 79549
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 01 Sep 2022 16:49:20 GMT
expires: Fri, 01 Sep 2023 16:49:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 2038
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEOOuxwSrZSd9_D_wHuNcCm8&google_cver=1&google_push=AehlK4A1J9wySfvwQImMVHeZqIKmGmhy6UQ2kR89RAeu-YqflacO3L_GP7eVwY5STEfDJKdTqMr17O0kaT7voAM1MwAc967_vz0k
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODgxOTkzMDcwNTE4MDUyMDc2OA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEOOuxwSrZSd9_D_wHuNcCm8&google_cver=1

43 B
398 B

15ms
14ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEOOuxwSrZSd9_D_wHuNcCm8&google_cver=1
Requested by: Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEOOuxwSrZSd9_D_wHuNcCm8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2038
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEHNxb1UNi2WDDxREFo9zRCI&google_cver=1&google_push=AehlK4CR04ZJBa542lmdeQFxTek36_SQ92Eb6VJdQ3RUMmhiGMRKEO5xDcCjRlgCpzwaVDI-xeP3-WOljxH...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AehlK4CR04ZJBa542lmdeQFxTek36_SQ92Eb6VJdQ3RUMmhiGMRKEO5xDcCjRlgCpzwaVDI-xeP3-WOljxHdviLJ_T3f_A_fcU5eng&google_hm=E_SQXRsRS-yqrp-yvs...

170 B
188 B

27ms
25ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AehlK4CR04ZJBa542lmdeQFxTek36_SQ92Eb6VJdQ3RUMmhiGMRKEO5xDcCjRlgCpzwaVDI-xeP3-WOljxHdviLJ_T3f_A_fcU5eng&google_hm=E_SQXRsRS-yqrp-yvszxlI4

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AehlK4CR04ZJBa542lmdeQFxTek36_SQ92Eb6VJdQ3RUMmhiGMRKEO5xDcCjRlgCpzwaVDI-xeP3-WOljxHdviLJ_T3f_A_fcU5eng&google_hm=E_SQXRsRS-yqrp-yvszxlI4
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2038
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEFJcCfR_ZrWgqC9bhoJ3klQ&google_cver=1&google_push=AehlK4BJqdPH2Zhdk49ST3EvMMOxLMzJnAWDLABiTOeEYzp4SbiQnfNYfmf9d9qsRyMo9HoB-rwEeMOpi9bVbqu82itove...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEFJcCfR_ZrWgqC9bhoJ3klQ&google_cver=1&google_push=AehlK4BJqdPH2Zhdk49ST3EvMMOxLMzJnAWDLABiTOeEYzp4SbiQnfNYfmf9d9qsRyMo9HoB-rwEeMOpi9bVbqu8...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BmIQHnQET5qiio4UVfOlNQ&google_push=AehlK4BJqdPH2Zhdk49ST3EvMMOxLMzJnAWDLABiTOeEYzp4SbiQnfNYfmf9d9qsRyMo9HoB-rwEeMOpi9bVbqu...

170 B
188 B

31ms
31ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BmIQHnQET5qiio4UVfOlNQ&google_push=AehlK4BJqdPH2Zhdk49ST3EvMMOxLMzJnAWDLABiTOeEYzp4SbiQnfNYfmf9d9qsRyMo9HoB-rwEeMOpi9bVbqu82itovedq73kjJw

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BmIQHnQET5qiio4UVfOlNQ&google_push=AehlK4BJqdPH2Zhdk49ST3EvMMOxLMzJnAWDLABiTOeEYzp4SbiQnfNYfmf9d9qsRyMo9HoB-rwEeMOpi9bVbqu82itovedq73kjJw
date: Fri, 02 Sep 2022 14:55:10 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2038
Redirect Chain

https://im.bluevoox.com/pixel?s1=2&s2=203601&s3=m52eksbsgbowze8o&cm=1&rd=1&google_gid=CAESEJY_MDtoCvP8-2RZyz2TJgc&google_cver=1&google_push=AehlK4A8EqKcef1_f1HnacAg3jFdBKFjtPTwVVxw5RHywk4MFX-d515ih...
https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AehlK4A8EqKcef1_f1HnacAg3jFdBKFjtPTwVVxw5RHywk4MFX-d515ih4nAfhoZDpofiCsqzZCFjRrtw1giOS9F0bxyV5O2tEI3-Nw&google_hm=QlMuZjUxMy1kYjU...

170 B
188 B

29ms
28ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AehlK4A8EqKcef1_f1HnacAg3jFdBKFjtPTwVVxw5RHywk4MFX-d515ih4nAfhoZDpofiCsqzZCFjRrtw1giOS9F0bxyV5O2tEI3-Nw&google_hm=QlMuZjUxMy1kYjU3LTRjMDUtOGRmMw==

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AehlK4A8EqKcef1_f1HnacAg3jFdBKFjtPTwVVxw5RHywk4MFX-d515ih4nAfhoZDpofiCsqzZCFjRrtw1giOS9F0bxyV5O2tEI3-Nw&google_hm=QlMuZjUxMy1kYjU3LTRjMDUtOGRmMw==
Date: Fri, 02 Sep 2022 14:55:10 GMT
Server: openresty
Connection: close
Content-Length: 142
Content-Type: text/html

GET
H/1.1 200
OK sync
rtb2-useast.e-volution.ai/ Frame 2038 42 B
233 B 332ms
89ms Image
image/gif 174.137.133.49
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEB__mecZTqc4IK-SYp3tXKo&google_cver=1&google_push=AehlK4DTEhRGRU6AvjnWe82kP4I0Ulwy-sQPFkRS4Xqt_v1McnKqBZKadF56HawUnnx8FSUrrTNSbAv0TNNqks7B895D-RRIa9QdrMc
Requested by: Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.49 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 02 Sep 2022 14:55:10 GMT
Server: nginx
Age: 0
Content-Type: image/gif
Cache-Control: no-store
Connection: keep-alive
Content-Length: 42

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2038
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEM_YsBducX34QktSDQH5KkQ&google_cver=1&google_push=AehlK4BsX4Pqw4nNPX0I_nIuP1tJgcgvdVCW50E8u_mTqO6ti6s-G_M8nkRUBQaexYvWKRt1pW...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEM_YsBducX34QktSDQH5KkQ&google_cver=1&google_push=AehlK4BsX4Pqw4nNPX0I_nIuP1tJgcgvdVCW50E8u_mTqO6ti6s-G_M8nkRUBQaexYvWKRt1pW...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS13NzE1NEVkRTJ1RjE1UVVjVnQxMmJ1X0QzeXFGMFJ0d35B&google_push=AehlK4BsX4Pqw4nNPX0I_nIuP1tJgcgvdVCW50E8u_mTqO6ti6s-G_M8n...

170 B
188 B

25ms
25ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS13NzE1NEVkRTJ1RjE1UVVjVnQxMmJ1X0QzeXFGMFJ0d35B&google_push=AehlK4BsX4Pqw4nNPX0I_nIuP1tJgcgvdVCW50E8u_mTqO6ti6s-G_M8nkRUBQaexYvWKRt1pWyqOY-KRFo1KKNNyOUz0jW-MGF0Vfw

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS13NzE1NEVkRTJ1RjE1UVVjVnQxMmJ1X0QzeXFGMFJ0d35B&google_push=AehlK4BsX4Pqw4nNPX0I_nIuP1tJgcgvdVCW50E8u_mTqO6ti6s-G_M8nkRUBQaexYvWKRt1pWyqOY-KRFo1KKNNyOUz0jW-MGF0Vfw
date: Fri, 02 Sep 2022 14:55:09 GMT
server: ATS/9.1.10.25
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2038
Redirect Chain

https://ads.avads.net/sync/ggl?google_gid=CAESEDftQxbNVKp9zqQAYLXON5M&google_cver=1&google_push=AehlK4DgJLAltvFuOdgNkp6qdlsmCa286XhwoO1zrp93FJpiDV8zUL-nQZHOuor3k9UZP7A1KFewOzxsljqtglKVE-vokB6zovdCUus
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=YjY4NDFjMjAtZGU5YS00OTg4LThkZTEtYWUwYTE1NzJjMzkw&google_push=AehlK4DgJLAltvFuOdgNkp6qdlsmCa286XhwoO1zrp93FJpiDV8zUL-nQZHOuor3k9UZP7A...

170 B
188 B

25ms
25ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=YjY4NDFjMjAtZGU5YS00OTg4LThkZTEtYWUwYTE1NzJjMzkw&google_push=AehlK4DgJLAltvFuOdgNkp6qdlsmCa286XhwoO1zrp93FJpiDV8zUL-nQZHOuor3k9UZP7A1KFewOzxsljqtglKVE-vokB6zovdCUus

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=YjY4NDFjMjAtZGU5YS00OTg4LThkZTEtYWUwYTE1NzJjMzkw&google_push=AehlK4DgJLAltvFuOdgNkp6qdlsmCa286XhwoO1zrp93FJpiDV8zUL-nQZHOuor3k9UZP7A1KFewOzxsljqtglKVE-vokB6zovdCUus
date: Fri, 02 Sep 2022 14:55:09 GMT
x-envoy-upstream-service-time: 1
server: istio-envoy
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2038 0
12 B 22ms
21ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LYisgNoR9Kvl1hlCKmtkN4qNWVi995UddPgPvCA7T8e9Rdnxq_NE8UGanTwGGt_eU0uS_kI8ErYQ

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6ECF 0
64 B 110ms
61ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuacgn0qH-y-m6QwudmS483yxNC9_mTIiXO9I-orMrIMX1W44kH-NhejYMuqCuHUM9E0howthoOYlqoOymafTfE9rLb_gvH88vH13HV2m9l-jq8JoNUICLytekZICmfCehXkQbjFVXLWSrbYuxoaoDJZQ-F2yLd6nB73TIlC-mQMGijvSzxLhjLRa5NqIVYcICptOVMP5-6Hisgz_FGStJapihAPX_-Lqoit2xqZdmx4csEIupJETIekmWyoPBXDiGgJO-iKzl92wLJyXqeZrzGw2PGH0SxkAXg99iD6fAcwZT7GScuU_VMpdSvEmOSssG-0MjuRb1V2Bf9LkOcedgCERYQunuqW95HiflXYb3l3pveQVMCPiGYPADteTXRforJ867raj0F_i_S75-zASq-F7oprklt6cJE2774JzqPzRbSJQ63AA5Yfm4muyRdoQicNmPJcdN-FvvwTHGNV8F583Wer1CjTWfi9epcuEnQQl--uzmH5Q63-TteY8hQIY69wVU2kOGCi1uq2A9ATKqdw5Fx_xBL7gGCjJZZzPfdRFaXUcZ_eXM0q38D5QUI03si1nISii8PVaYiF3k7eN0enUcm3mCLaHn2pBkzfKq9Npc_MS7ZzSz_Qu3U3Nl1CtxF4PtqT23wAiynPMSbSG-dLg6WXLwRiQN7luhnDJ3EKU1taIuUW6IaQ2CtNoZ3kVvy7Xb11OMK2rwTfqjSJxl1AbOnwdyR6U4jGHQQPeGRWrNJY1kOSXjezDtQfGwrhF71JNQdMaFTzykvjX1UOjWhwyZ8j7rf8d8xH9i0-bnJJgzrgGRKUMaFLPL5_KMpohUpdwj_4SmajwQNUOd_mYx6peGElnbtQYGr9UyMJVIdyogMpOkdYf5TcH5_tMFIob6zrHlIZDgsMwDqYpVhDOyniyKiz6IWJfOLuVla4QwZ6OX8urWNilA6DkOXeJdE2gs9E4aRl0ft67emQAMSwqf9nlAAoh6K88XQrYSrmol6WgZdkzSd-qrKEQiRtIA3AblDen-RMVZQtkde_odW5AKEcLbbMu87YE4lXGXptWQ8M0-JpHC-AHYIVqy-on-lF1otHl_IcGGxKK0HZDP_KCSBpztk3s53uL3h5p58rL_ttNLsxGZ4rRLdIWrWOAfs81dsCm8esGypIhr4Qo6eq7ynF02ygZ61Lcrqk0UNy3c5KnAC4YPmO7V-grRA67rYYc09rxVsFFBwrrRtZhIg1Gtq4MaodZkYqtLnbHi026sCL-hIcNyBKVhZXdgZ9h7rkoTwhxyGMuiEmy9EZq366sqAKWFzmZFWZn2x9rJrpy6ZZZfc5th1-334Gxde3n9jTztnxoGyab7FHi8h&sai=AMfl-YTgoJVilID5zX9WItK3EKYiXFCCw6L3m3Q8O0TJpsnTYs92bMoFJHKttUvg_3xziDCcNaxV3qSaJrnIE5VGgDyMLa1tINwt2E550dZNnPaZRm0KizfIgM0StrGa-O_UxNOwHRbHAh8Zu--ekigeVrA9xSXsgUoYyBf16T7RHiQFcbSHA52lDDirNsD6qpjx6UUKlbbODbHKV1NOSZja_TmzNYuUjSpqUX9xGf6XNfzeSf833w&sig=Cg0ArKJSzGvPjCUf1ldvEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=82&cbvp=1&cisv=r20220831.65255&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: updatepopcorntime.xyz
URL: http://updatepopcorntime.xyz/?app_id=T4PSEC&hid=9a19de2de347e5fa3864eee56e1bc6a3&ver=6.2.1.14&os=WIN060101

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Fri, 02 Sep 2022 14:55:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 9194016762785993401
s0.2mdn.net/simgad/ Frame 6ECF 38 KB
38 KB 14ms
14ms Image
image/jpeg 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/9194016762785993401

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbf2f91a5f0100c83cab661975b7f9331a9cd0a01144d2eb4c715923361aa920

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Tue, 30 Aug 2022 09:24:43 GMT
x-content-type-options: nosniff
age: 279026
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38463
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 13:54:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 30 Aug 2023 09:24:43 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/11093819551445137482/ Frame 0520 123 KB
34 KB 23ms
22ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11093819551445137482/index.html?e=69&leftOffset=0&topOffset=0&c=EP2Y3k2HKq&t=1&renderingType=2&ev=01_247

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c47c49741c81268829524e0ed5a972814d7de76c5fc30ee9d6f393b3760dc918

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 14:55:09 GMT
expires: Sat, 02 Sep 2023 14:55:09 GMT
last-modified: Thu, 01 Sep 2022 09:01:37 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 528F 0
622 B 96ms
60ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsurghVYBHjtl_beeVKhUDVtxFzrSet0HbWvSbUnddF1PYwdacKKvM6dlOgjZIWoyYQCacf5w8YOqW45Bff423p3X7SvS_SvNPtM-wSrwW7uRhLTSL1uorBMj2eSsQemNBqVM9m8wUrAgJ9fW4Ld9zkmDKbWB_5oyOTbAmhuvNRCMepWOXmcP6ookfbc2nDZZ3XKYMCQb_ZJhBOVOiWb3DeLv1BjQwN1BXH28AyNhqjttyQISEw4eMyju79v6yg9E0FfpVN0Kjl1uO35xVL6-V26u9v4R5lnDKGkCX-8j--OjGdQ-JAerfyoCDLpnl8Chesrtn10vee1NxETAWCA4me0c7PAO04fXcVulCqUyUrgcNQZaAorWLVmdkGeaRAXvGTqPukeaP_HqAwha1_am5u-6EMhD4W-VkfsuuNyfNVz3f9gn8e-WQ1x7bscyFYlz19BIrI1AH_RkJcUucM2Ej2AGTuFdKZ70vapa88GXJQM_TgX8t5gMTGQu3Ignh5OV-NuF97RBiEy-YIe4IA8xd5AF5Hyof0-ApBfxJ-ux0Z76MG_KwbfUEga57FEjk-N60Nz4l5MfOh2eO2WI9UmYbNZcR7VK_DfZanEXjFThVOf05FJdtXEXkx-Wy11dal6Pv8IlzM-6-1yfwdKDhYVyTsMV2qa7bb-9fglaiAdBGgKiJ5gvKa9lvgTDeTcrxgdxnuiRdKLMiWnxwF4zwwW04c_n0Wp7yKH6OYRDA_mhxdNTJEkYwxAfgn5jUd8sSOuHYlmYv13jcYIF0TrimTPpsjMmNfZnSm4QbznmCUSTACJh1xb6sqFvzJlF9fapdEM1BLuVF0hFKsoFOEm_4yL_DSLqIVROAu4iQcDzqu5SsopsEuLs-np3HbUWJ-Lx7accsNczrofiv068k5nh7gNKINew4_4-pGFv0Yzd89YpdJPy2A65tK45XFAzlzB2cxznCxA3l26uaBXRL0EpeAkRNfvi7uHAeGX74sj331UNeY-VsLakjskxDy79ULyDmvfxpuTdsedXw-TgzhDHqijG6rCYPjwl6Xw4f6NF86ulqgvcdx8Q5e5L9tULu7YrMSryfX1IPOH_WBqRq3hVHoqGtQZfdROXH_yawWYqW2htNVqbaJH4L8k1FqR0_bUP4MEbVAKcUivcxXmCehFzoZdco-o9dbC8G-HkEoh9YT7PaaxqPHxHsVf1MAqvSwh9RypGl0JL7wWkl-jjx98cBCfBEDKGE51ifsHPGerCo9TkZWaR8pN2bXKY1LXt29gDSgX--0Fz6ddOWj6160483kYpjHhTZHVeWgN3nWSL1rYm2YGzQUlyc-0AEKJ&sai=AMfl-YSjbB12hW-sERWnN8FS6oDhruWWTYozWmghXZYKtkzaZfhenykbTTf1HijsKqptoHjlEDsVTdVKcY8Cih7_vyvLb6hYZbrtw3LSvL9RzXbw45hbrU98aBjGPT4kwpN2k-O5PHhoBXl7AdzjgcyeqlsHQ7O7RJsJUm5IZyGCvipTuvSAjT2_ghU9tTTxb4pvng3UrvNHYubVd2futHwqdA2Z&sig=Cg0ArKJSzOPTudzmvJL9EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=114&cbvp=1&cstd=109&cisv=r20220831.38451&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: updatepopcorntime.xyz
URL: http://updatepopcorntime.xyz/?app_id=T4PSEC&hid=9a19de2de347e5fa3864eee56e1bc6a3&ver=6.2.1.14&os=WIN060101

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Fri, 02 Sep 2022 14:55:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

px.gif
d.adtriba.com/ Frame 528F
Redirect Chain

https://d.adtriba.com/collect?atb_ptid=f65079e0&atb_dcaid=202209_es_pakistan_dv_pros_345313522&atb_dpuid=di_dv&gdpr=&gdpr_consent=
https://d.adtriba.com/px.gif

42 B
227 B

9ms
9ms

Image
image/gif

18.194.67.230
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adtriba.com/px.gif
Requested by: Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 18.194.67.230 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-67-230.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Fri, 02 Sep 2022 14:55:09 GMT
Cache-Control: public, max-age=86400
Server: nginx/1.16.1
Connection: keep-alive
Content-Length: 42
Content-Type: image/gif

Redirect headers

Date: Fri, 02 Sep 2022 14:55:09 GMT
Last-Modified: Fri, 02 Sep 2022 14:55:09 GMT
Server: nginx/1.16.1
P3P: CP="This is not a P3P policy! See https://www.adtriba.com/privacy-policy.html for more info."
Location: /px.gif
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 01:00:00 GMT

GET
H3 200 html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 0A64 170 KB
59 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Requested by

Host: updatepopcorntime.xyz
URL: http://updatepopcorntime.xyz/?app_id=T4PSEC&hid=9a19de2de347e5fa3864eee56e1bc6a3&ver=6.2.1.14&os=WIN060101

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Origin: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 16:51:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79417
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60311
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Sep 2022 16:51:32 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/elements/html/ Frame 0A64 8 KB
3 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CG1MWQtaMihVJDzpzi6FrFXWVkQ33vBOAykdL0zFS49Wbe_OOZWaMajn_R7WEMIQE8liXbBS_vaT5Lx_gHFaIIvv1Qd_kleUAxxbQqdOS6puFoOhad-TaaLnGsVz83UH_25Q-FX2BzMU6iFAWMPwMZF-ylVg&dbm_d=AKAmf-CIcvAJpEZQ9rrupCpy_PLEthYlkjAd3OXRaAzztE1k6p71Nc5-VuO-OE7VqqdTcfGII1MPwh4MnIJPxRLEmtNRqv2UypodZHwSihT9ak3m_b2zP-tC7gyaMbj4dg-FbAus6hhpkfNvBmxpRRhzYqgAIbHKFOmdz5CLi94vPKu-mOZKQ-kuDg6Mp2r8g58hFWNIUEuRRnmCBVGQD59PubCsQTTaN1V3AZmju3eBPWSPg856gYBbyJCoE4cQkFU0SfY_R2Q-NiUFXf4yoklm3wl6Nlqk1_Vl4RlP1XMxQdDNlfowqvRI6u0xQNtV2lDLr0Q1Ay7kxl1dYlO8wVb1gNg7_8PmBbgyYlUqRomJcX332Zkhn7LrELI8GOERLwspntIzx-I_S7ZD8WwEfVTxppI7F_j1cpJrkBa8jclH6oaQx_sjdA-ThfM6gqfMMx-g7yKR9Vt52VC2CMxvQiV03N7SzGVjof0JEg1iCbbXG3aZ9evG0rmAgEiq5mfDE9jFLGydUSzYtaZ49CP332Nd7-GHtTsEb5gqoXXvxUWu_6G9BEzAH-TL9F_WHJ3oL4lgH7otC-MIUuYz82rALIgCkJFA_qM8vte4o966zzCfMrgf5LxEVUjrc5JqVwJtos5-L7H4PdMbG0EvfomYiC_wpVT6RBmJ8-kmBFzxsNodoNo1mARqv8tNsDssq8naddkNGZHlCLOz48ZiNrcCgRX-0XM_Na34paMx6crWTL0eUAgMVGXyAC97il_k3JX7n2zRljOad8hEZA7y4F4pl9Quc2GwgWqSmv4DKPvRNRVOH_u3ePDG_Fb8fMXuprVZSJurAECV6KnEneOYDttKqgJzxkLmKBXTAEstIdgCp5cHJXmegNIE4QUnBnzilyFaxGEEiWG7HpHYAzh-CWOiEQle3Xe1ytdd0tjfmx-Y7FDyWdC3QNnRYtFGKnPJjjhy3Y7lwLFRLKAoJVMQiIU8xkYx3nmfGkAMq2o72-gMYNh3Rq4FXYz_opqhPPQ6Cj3n7VwSbq_uEqpmWzL011uOFT-RvS9y3qtmIzt1wrIsaHItIVONsIEg7rCtXijzpoXtclaYIqbZuNbcOjFMb6mUyqMgZmQ9DtqvZWFDTlHqGC9BhQojV-_JuutIyHaWCxyWrG6BXJLs5L12WQ6HamAnMe5D0Qva3Hd0qG3AkmU8tpnVFWlE9sPGT-GRRPH4uaJgQ7KrUlfcTrzAQOArXom2ptzN1mMo69SIsSBE1fh_ZV9G11IgQsxF3PN1lXkrnEn-P1QBhJmzSUAsmUOjDx2Pfv6BdPmdu7Vl-9PJsoLQxbGm_3TFKR4d1YhrtCM3TNKHAGjxHVf8b73670nc2B1ctdtJ4zjeEMyvOYmWy2lHS0660QVDM825agFgotzgh59P8dapsdiL74ci2UcG2EH87dAkg4-qT6NXQG3WmdhpULp2M3KCLLiITIRxOv_zFBgbxzXw9Qm8C--_7c1YXw00hU79W1Xm4FYrxgxE6R7jwWFMYppyXN9w0FUd9sF52gisCdsr72pnFwwhLnNixiljpLA416W20rW_WStiG_h-D4pDKc-0NthK-rlIRksGNXJkwSKjSqig0e4z-eB6tiZP-wucWXKKYzpxzcvmzc8TXzAHZ69o7vYZpCA2bqa4gIkUC0GL6kR0swEEwxp8iAytcMgAvQWkBFXhrp9nWp1zwML2QzKuoMPwJXgMvloxprA3Fe6fWHPcfBibjPRrliQ71yB7T8dJ1AiSdwDOUYXCt0n00EgI6Zxj_ghJ5e1I05UPaAZK8u_6zrbzfaR8uR-KuAblny0mPWelbrCoG8sg2OeWkt3ghLXbo9OKpWiWX8KRsoUJiBY_Uiy2wTxgeCPfWHFpfe-F3R1FcZdr5GyXqPvlVElN4e7xeXA92OnwDeuG2tFZ4u3uzSa7NUfWFiNMg4v81ws3yw5xIwDlWfhdTPBV52OqaFKEPASQCYrhfb97fRvhdD9Hy7cgI2hJrwhYYNXPDsS5lwW8tRykj7bsm2kMg97qhhl0sRwNg3LEGwoenLn5-x0lFVENFoJybbn7HLvim--p9USidxKuewjAWSKB8yfNOj-QoF1Mrn8aN_lrLz9IIm_m29DSrGyRAdkTF8l3gI9jCgRL-iimER7DagfdEebzJzvx-CBipOemAzIKioevL43ilfFIkfcW-4jv0qapfGOhN82_MfArS5OYRnMYDUf89P_3LpxWPQLJCxofJCNwXmu3R_FurXYOthVg3BoF28wKv21ynTWUwwzMUDyfv4giqNtgu6kvj0nI5gXKn6JYTw5LJbNP6fJzTpnYVOTTyrBnMt5-eYR6CTDILYTqhbf6nDVWTqX9ohj94aHsZLSkoxwqdzOBZ3amAkXUzt5ZEZJBuB-SJWS_yh_B1ReNyiu9REga7nXKgkvQaNoYWkgYk5evpvZH2nJT-u-si8K4Zr5KdBrtu3RcZ2zp9Rq-pD9z2EmvEuVB7aJowpdGE-BWQdc6R6wR9SSblCfR976wkHUolbYBf1cqOgDj9QelyLe57mJq_7KU2yT1WKU0Ja6t495G5zkvfRlFgrEJbh8f30S4wegqnmcbTxcl1CuYR9_ZXIgVx8SbVv9PJc4nwpM5li7ZlHQIfnIwYjjLb7vSOLhcv_FyOIlNY83M4Emgklmodm60B5DHOLdFBD0WQT0lTR7pg_LQxXOXDWPjSoWb38P-3gLLI_Mr3rQ82-buy-7QmT94orWN_7B_4Ez3J5znolYrXQTBsgt9DGTpGM7bBEaxOs4U4rMErTA0Kz-OCUjjRFiRv4eOAuYTnBgmGhu-6AETlwsMrgx8NWEmHPdxqyixMnyDyPSekM5NjfFVUandR6Nn0xqRX3gHC_kNXEXGbXY1Cxm6Jni8JSuTk_BnaupMnd8Qa_GFpbEXxv6A2Sg7BQk-bS3ieK9-WFLX0e2ZymTWfBOh1S3EXGKkqwAS3ngMRqrb6uljy6qRlGu1Q60FfYvWpkRWWZgdGlo0QRUq68Ffxv8i9LjJ6ui0KSWOewyn5m-neGtoR7QB5ncLjS1uEx45jHHifpivK6eo7vkoQlG6S2tvY-YQc39dsjVy-Wk9lwRdoTzzFzJNm1QHjeyAykoxHFhtkps8XxhNONDz2fX6N-9WgFZJd5pSsZQOGJZcY9y89QSOIrJ5274ieCnOg-Rt147UEV-wbF1FPMinZm6wv_b3alcNVZ6bqZoxGlounVJo5CRVFECwaehtHGjZJbV8ZA83DZXRgQMN6GeC7KKeCkP5Kzy1xSVudFpdt1xnfBR9pU32o-O_izKGlAM20njPEX0WrZ33R3IaeNBtwiLQ8axGSO3gUouMZgifrH_6odePgxMkkz_9pQ1PuLck3i-ygzN7Na-6EpBMNu61jYAZoJVuBt3xSbBv9YTPn9iHCJNhU1NDWq8a-Tp58fkimECurjRhfbjFS_DJkoBDiP6dIzMv3tOhjckNLUzvV6XrkSIZhQ&cid=CAASJeRomq1U62USEHUkejksi4fbgE2PUfZSM6dKeDvgAKHNQyfpYbQ&dv3_ver=m202207220101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=0&iif=1&cor=1103312503237364000&idt=150&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:51:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 226
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Sep 2022 14:51:23 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/ Frame 0A64 30 KB
12 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35700fd4dc1a4008ab66bc0e57c19689f6daca9368bfd2a6beea1b86dc0159d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:52:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 177
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11778
x-xss-protection: 0
server: cafe
etag: 15541287485089275602
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Sep 2022 14:52:12 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame CA79 22 KB
8 KB 13ms
13ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 79549
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 01 Sep 2022 16:49:20 GMT
expires: Fri, 01 Sep 2023 16:49:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 51ms
51ms Image
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220831&jk=3383624281325534&bg=!hoWlhcHNAAZTikH4c4o7ACkAdvg8WkUJd3odIF48C2zcSZ7w5vjVp24fwzbwwR39DGjIAhHrZTwgygIAAABiUgAAAANoAQeZAqOfLxf6KbcND2PNRCy-ttwbDzitaAagM-rjMsQb-9AE3tX6fWMbEl0BRijHvdxGjMXm37qOkE49gwI-cbkZIiClFf7FGAqaW68_oPCZURsbC1xmeNehWrsjQd_ZcbEGvNMQDse8sd5zjOPoowinwFDULMbKhV3-DFeQJEHBj_TWg4k9xGbynPPvKsG6z3L_h1gE-CaKESveYzwuRsIVu8RKcdcrGKltZE5z1vva2h74oZo6Oup5KsYxM1nO88oz4yPXBgCIOVVaBmnF0O6Ah2wvMsurBDvAHbA9mNzIJYJsgAIhf1Pl-P0dAIpCqAhHmKwyZyYND-bIjGOELtXhTWvXKRzQhergsGWGrwtSvlG_Tks7A6JUTUYWVot0zx4VmJpks3OoQoSdF0bq-5LwVuThCUrKTAQgJOAqevXnNeiugYRKhjR6bt4HqsttgphQx2pK8ZdMujTBPzIkD6FavHOIC0EQaOkG3J_jG4JwCp1678N0KCHWwArxfrag_mpbkZ23SfoUfiVe0FGF2YyM4OFoZ-6YxzlVPFHILdAqqn7syRBiBaB_C57dx1hlu2y6p4rFhulHu-fyVtH3Vv5ib-B1xyGuE36UChIbkjpnIsHYJcHkY805sI8Y8gnsGq-Ad3HECD-bWDd5sumxzoatitSr9cUAcd2eSRJOSkzIKE2yDpSd97KRvJJOj_bafw_F_1Mx8uj-lh33DOUlp2ST9NVthRTBwZg-GjAOFdE1Ohbt_Sx-YY7nO82aik5DKy_LZea4xeUhY1a21YILiIggNOx0dkd00L2FXQ8ClVPBQ-Ln51dT3iXu2UlIfzMHnhfMFfvPdK4qIDWX2kz6sAsmFpJH6ZNPWMap6BZufwlj7jKs3vZk8XQibQ_ggkRBdhiaRCuJD5Q
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C5E7
Redirect Chain

https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESEEYPefmOCHumTXrkAxuFwcw&google_cver=1&google_push=AehlK4B-3qUkastKTBdGN4_TnJCrab80D1bx3ym5P0b0zNLCvnru6Z4mXovZjRaGaSgQ6zTNSQqpYyhTz8...
https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESEEYPefmOCHumTXrkAxuFwcw&google_cver=1&google_push=AehlK4B-3qUkastKTBdGN4_TnJCrab80D1bx3ym5P0b0zNLCvnru6Z4mXovZjRaGaSgQ6zTNSQqpYyhTz8...
https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=AehlK4B-3qUkastKTBdGN4_TnJCrab80D1bx3ym5P0b0zNLCvnru6Z4mXovZjRaGaSgQ6zTNSQqpYyhTz80QDrtUiS4ZLCz5wFvn&google_hm=

170 B
188 B

25ms
25ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=AehlK4B-3qUkastKTBdGN4_TnJCrab80D1bx3ym5P0b0zNLCvnru6Z4mXovZjRaGaSgQ6zTNSQqpYyhTz80QDrtUiS4ZLCz5wFvn&google_hm=

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 02 Sep 2022 14:55:10 GMT
server: nginx
access-control-allow-origin: *
transfer-encoding: chunked
access-control-allow-methods: POST, GET, OPTIONS
p3p: CP="NOI DEV OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=AehlK4B-3qUkastKTBdGN4_TnJCrab80D1bx3ym5P0b0zNLCvnru6Z4mXovZjRaGaSgQ6zTNSQqpYyhTz80QDrtUiS4ZLCz5wFvn&google_hm=
cache-control: no-cache
content-type: text/html; charset=UTF-8
access-control-allow-headers: Origin
keep-alive: timeout=10

GET
H3 200 dot.gif
s0.2mdn.net/ Frame C5E7 43 B
65 B 25ms
23ms Image
image/gif 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEBFvkzmqaZTBmmZYfoppMLI&google_cver=1&google_push=AehlK4DsF3qKkXbFyc6AQiaZ3c7KPxhYk86huXAxhA9HhnpaCMcdRp25T211ml4arJy6Jprxds01opzrM9Y145QtgqT2XgRt6ESg

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 03 Sep 2022 14:55:09 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame C5E7 43 B
352 B 55ms
20ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEHMfqMwiALRLgRxAiBloqoU&google_cver=1&google_push=AehlK4CWACvTxJBsd4JDE4YQn2VrffsaHwkDtiI1ODw6KgKLkIY1BT1M6ZaLt_kW_HLWMxe5-44jxjUTcAd2xARmiT-4aSeM_HMn
Requested by: Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:09 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: kbstq2nv76go8j8qslj3vnd5h54bbrp3

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C5E7
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEMrk7pH2vLJ6NdmMAo-A08U&google_cver=1&google_push=AehlK4D0-QU4tYILRWmGtGRnBhQiqSrBtSHHTt5duPzvE3vB-XgWmalHuSSqXfiVNVepngyxTLKB39M4vFygx2Y...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=AGWf0MOtTWNE3p28lAPrarKi0Y4&google_push=AehlK4D0-QU4tYILRWmGtGRnBhQiqSrBtSHHTt5duPzvE3vB-XgWmalHuSSqXfiVNVepngyxTLKB39M4vFygx2...

170 B
188 B

28ms
28ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=AGWf0MOtTWNE3p28lAPrarKi0Y4&google_push=AehlK4D0-QU4tYILRWmGtGRnBhQiqSrBtSHHTt5duPzvE3vB-XgWmalHuSSqXfiVNVepngyxTLKB39M4vFygx2YOP0mF3NBo0bY

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=AGWf0MOtTWNE3p28lAPrarKi0Y4&google_push=AehlK4D0-QU4tYILRWmGtGRnBhQiqSrBtSHHTt5duPzvE3vB-XgWmalHuSSqXfiVNVepngyxTLKB39M4vFygx2YOP0mF3NBo0bY
Date: Fri, 02 Sep 2022 14:55:10 GMT
Connection: keep-alive
Content-Length: 241
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C5E7
Redirect Chain

https://ads.yieldmo.com/exptsync?google_gid=CAESEOdjqIPYWIdT-eefFP77TSs&google_cver=1&google_push=AehlK4D0P41YogvCVIhK7OUMLx42RICyUxlv7Ibpt2p2bFjytincM68oOIZBh6SC8L1iTduG8gMr9rAe-0VsiASiVmQ6D92BGDj7
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AehlK4D0P41YogvCVIhK7OUMLx42RICyUxlv7Ibpt2p2bFjytincM68oOIZBh6SC8L1iTduG8gMr9rAe-0VsiASiVmQ6D92BGDj7&google_hm=ZzY1YTIwZWNlYjE2YmQz...

170 B
188 B

30ms
29ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AehlK4D0P41YogvCVIhK7OUMLx42RICyUxlv7Ibpt2p2bFjytincM68oOIZBh6SC8L1iTduG8gMr9rAe-0VsiASiVmQ6D92BGDj7&google_hm=ZzY1YTIwZWNlYjE2YmQzMmEyNjc=

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AehlK4D0P41YogvCVIhK7OUMLx42RICyUxlv7Ibpt2p2bFjytincM68oOIZBh6SC8L1iTduG8gMr9rAe-0VsiASiVmQ6D92BGDj7&google_hm=ZzY1YTIwZWNlYjE2YmQzMmEyNjc=
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H/1.1 200
OK sync
rtb2-useast.e-volution.ai/ Frame C5E7 42 B
233 B 272ms
88ms Image
image/gif 174.137.133.49
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEB__mecZTqc4IK-SYp3tXKo&google_cver=1&google_push=AehlK4AN6yctOgA9Tiis6iV41Hv4eqUuIeS4N5qf-WozQFwufnHMGo3HdEQRQ7KUYPN6fmnbOiAQstBvG-Z-qOS9HGdKcLfFVb48sA
Requested by: Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.49 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 02 Sep 2022 14:55:10 GMT
Server: nginx
Age: 0
Content-Type: image/gif
Cache-Control: no-store
Connection: keep-alive
Content-Length: 42

GET
H/1.1

200
OK

/
b1sync.zemanta.com/usersync/googleadx/ Frame C5E7
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEBYlyr-QjIrwT0ufxC3JzGg&google_cver=1&google_push=AehlK4AkDausQwXmJrMHVQHBcCta0Bhwk5XLO-G_ilohxK4Jhaa-k4tDfBIBarw83Zg8QiCgMePhRXuXp66Ei...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEBYlyr-QjIrwT0ufxC3JzGg&google_push=AehlK4AkDausQwXmJrMHVQHBcCta0Bhwk5XLO-G_ilohxK4Jhaa-k4tDfBIBarw83Zg8QiCgMePhRXuXp66Ei...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AehlK4AkDausQwXmJrMHVQHBcCta0Bhwk5XLO-G_ilohxK4Jhaa-k4tDfBIBarw83Zg8QiCgMePhRXuXp66EiF9LI9YWuU6hU1sK&google_hm=NmNSRWlnVXNPUl82SGlO...
https://b1sync.zemanta.com/usersync/googleadx/?google_error=5

26 B
127 B

87ms
86ms

Image
image/gif

70.42.32.63
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b1sync.zemanta.com/usersync/googleadx/?google_error=5
Protocol: HTTP/1.1
Server: 70.42.32.63 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Fri, 02 Sep 2022 14:55:10 GMT
Content-Length: 26
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://b1sync.zemanta.com/usersync/googleadx/?google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 258
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C5E7 0
12 B 22ms
22ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KHkMgWnYNyy2TZmqpbC-xkixmjA_aqZOv-UFotj-nZmgQvsjE9teS9KAVJbJvVXIpP8XOeTAg

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 0520 118 KB
40 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11093819551445137482/index.html?e=69&leftOffset=0&topOffset=0&c=EP2Y3k2HKq&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11093819551445137482/index.html?e=69&leftOffset=0&topOffset=0&c=EP2Y3k2HKq&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 07:51:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25449
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 03 Sep 2022 07:51:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/13151972954896785613/ Frame 635D 126 KB
34 KB 23ms
22ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13151972954896785613/index.html?e=69&leftOffset=0&topOffset=0&c=k3SG57xylD&t=1&renderingType=2&ev=01_247

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35e04b4855605c908b85662df66fa3f5fce2fe1fa2d284873c1349b101bd7bec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 14:55:09 GMT
expires: Sat, 02 Sep 2023 14:55:09 GMT
last-modified: Wed, 22 Jun 2022 11:30:07 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0A64 0
64 B 73ms
71ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssO4C0W036GjgwO4i7t72zwl1YaNaZMdErPTHAUa0VbmfraleI5f_ZspsyuoJUyZ-e3ADPE9dFj89wIHrvwKbEd57qT8-8v2z3eBI311FWF5AZvIbk6sPnOr1uRkOKJ--8mRswbdR2nrjDyrpOtH4_WMOQjBfO2HnvzeFwTYmxPMfkQfQE-DgvhsAzSH7Ub92mqkroE_c-TFFLvWAnkDRwnFW1vNR5q9A-wuGuiN3ZgvJL33cmqmAg8K8-L0XEyGREVpnslu_SS5ZffZQbCT3HPOYLCnwdAJda7hdAd0JW6D2AF8IMc_VciZid8DiWpsCE4ooa-M2HOBA4ZryXJXi1vULPFOaCED0Cxwv_k1g78YSA_OKpTTbKt7l2dG24Vu3vfWrSQV5RQmFCZgM9cfErVHkxU8kbx8l2E370jKLE8fdZayD692b38Ugco4KQl891grUbxM0erzxoLsPn1Urlr3DdTmRFaD9H7F6HeCyQ8KAvAjTlTFgLkR_AzFTLUNbEVK8NqLhhbqyaxhxWFh33zLaMcILT2Iwl95LQRGUtdK7chhkj-YVC1RJKltkKEIJzSWrpm2Aki_HmG2TGwTjKG9jjA7WVeJBGz8zI1l3rCXTHn_3OyzF0iBNNqbtr7_fK0gz8thR2p5SvqNf6mHUTzP-zoh-6qbsJRaNodP0c_WGzU4vdJsV0bjnO95WbAC6YTJJVdFPKdDEKgrMVi2e_1L3kyqHiKtqzb-k-oppDhuzZQ3bgzmqZZxsob2Q9RXJ3Pv_JBzBYJeSfa8uW5piOotAxTOSg4RiUeIsHG6H8nICaF1Zgwu6DlhTxVZQRrtfv1BZ_w9LfabphwMLUYuuiFVDgsyXndk5I7hh_LyfnAnN7K6WLETzbz-c4yXDWY0YikUVZnd4xHZDIF-jHS9fcgi-XWv04lPFdmw3Zw40j5SExl4j2zkvXtnvwkA_5plvK7HVH7HXSxNAX-Xsj42IuAnK_pbfkaYQaX_ByEnF_Fln42KQtoD5jCsWOs-5Y5AP_jxR-v9fO2kB305lsw882NkYSzZVuAMiruSb2IB_nx2mnWoHzyyxr4HXJJ7ty8EOD8kctnwW2_Ph-S7XtOtaYQiwAqkyDOAxH2s44GQSfitOFu7GvtPMMID_pZJlGyPBiTLao6IPETUqYtleLpU6jHwYWwfPN32G66WSPxaTkGt5jDaXx8Yl_9lCmW-v1UiHKt6Ttihr-rmdrdX49M-rNEpSslTwyz2z05UmYpTvok2NiyHMTfBtpuWpNF31wpVQneLd5dXBOlXUIkMNHz48crKZbVYAXcQ9lEOWcH9eDLofu6gBt39lM&sai=AMfl-YTOBsiMfmPkEBa-T_i19Rs7hV4V21UMwswLQwpyNmywOpkwH7TgFE_bNhonAyNCrjQBGmWhvHzdcRj-S22c4zbhB25eI4y4inkIP8PtNNvHA0One4JELMkr7Qpl8PMXvt0pXHEGAug-mh3Slm0LNzozM9OP09UhdrW-jlvLFRoL9pMnCdbvFIVqlJudkLRm9N_JApmKM-lf8-ckhYIYUXMO&sig=Cg0ArKJSzNJcse1egRdREAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=50&cbvp=1&cstd=47&cisv=r20220831.47946&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: updatepopcorntime.xyz
URL: http://updatepopcorntime.xyz/?app_id=T4PSEC&hid=9a19de2de347e5fa3864eee56e1bc6a3&ver=6.2.1.14&os=WIN060101

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Fri, 02 Sep 2022 14:55:10 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

px.gif
d.adtriba.com/ Frame 0A64
Redirect Chain

https://d.adtriba.com/collect?atb_ptid=f65079e0&atb_dcaid=202206_es_hunger_dv_pros_339769045&atb_dpuid=di_dv&gdpr=&gdpr_consent=
https://d.adtriba.com/px.gif

42 B
227 B

15ms
15ms

Image
image/gif

18.194.67.230
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adtriba.com/px.gif
Requested by: Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 18.194.67.230 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-67-230.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Fri, 02 Sep 2022 14:55:10 GMT
Cache-Control: public, max-age=86400
Server: nginx/1.16.1
Connection: keep-alive
Content-Length: 42
Content-Type: image/gif

Redirect headers

Date: Fri, 02 Sep 2022 14:55:09 GMT
Last-Modified: Fri, 02 Sep 2022 14:55:09 GMT
Server: nginx/1.16.1
P3P: CP="This is not a P3P policy! See https://www.adtriba.com/privacy-policy.html for more info."
Location: /px.gif
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 01:00:00 GMT

GET
H3 200 JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js Show response
pagead2.googlesyndication.com/bg/ Frame F11D 36 KB
16 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

248d0f732763fd82701728aff2902d3e6b079e73f1ea00c1c4bb749f45e9226f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 12:54:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7233
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15957
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Sep 2023 12:54:36 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0A64 41 KB
15 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 16:49:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79549
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Sep 2023 16:49:20 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B1AD 1 KB
749 B 13ms
13ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 5994
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 02 Sep 2022 13:15:15 GMT
etag: 48472445140208031
expires: Sat, 03 Sep 2022 13:15:15 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 0A64 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 96be6ce400b17f2e6ebb81b9220500ae6c2574d10784eccdd16a29ecee62ba27

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6ECF 0
26 B 108ms
56ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuacgn0qH-y-m6QwudmS483yxNC9_mTIiXO9I-orMrIMX1W44kH-NhejYMuqCuHUM9E0howthoOYlqoOymafTfE9rLb_gvH88vH13HV2m9l-jq8JoNUICLytekZICmfCehXkQbjFVXLWSrbYuxoaoDJZQ-F2yLd6nB73TIlC-mQMGijvSzxLhjLRa5NqIVYcICptOVMP5-6Hisgz_FGStJapihAPX_-Lqoit2xqZdmx4csEIupJETIekmWyoPBXDiGgJO-iKzl92wLJyXqeZrzGw2PGH0SxkAXg99iD6fAcwZT7GScuU_VMpdSvEmOSssG-0MjuRb1V2Bf9LkOcedgCERYQunuqW95HiflXYb3l3pveQVMCPiGYPADteTXRforJ867raj0F_i_S75-zASq-F7oprklt6cJE2774JzqPzRbSJQ63AA5Yfm4muyRdoQicNmPJcdN-FvvwTHGNV8F583Wer1CjTWfi9epcuEnQQl--uzmH5Q63-TteY8hQIY69wVU2kOGCi1uq2A9ATKqdw5Fx_xBL7gGCjJZZzPfdRFaXUcZ_eXM0q38D5QUI03si1nISii8PVaYiF3k7eN0enUcm3mCLaHn2pBkzfKq9Npc_MS7ZzSz_Qu3U3Nl1CtxF4PtqT23wAiynPMSbSG-dLg6WXLwRiQN7luhnDJ3EKU1taIuUW6IaQ2CtNoZ3kVvy7Xb11OMK2rwTfqjSJxl1AbOnwdyR6U4jGHQQPeGRWrNJY1kOSXjezDtQfGwrhF71JNQdMaFTzykvjX1UOjWhwyZ8j7rf8d8xH9i0-bnJJgzrgGRKUMaFLPL5_KMpohUpdwj_4SmajwQNUOd_mYx6peGElnbtQYGr9UyMJVIdyogMpOkdYf5TcH5_tMFIob6zrHlIZDgsMwDqYpVhDOyniyKiz6IWJfOLuVla4QwZ6OX8urWNilA6DkOXeJdE2gs9E4aRl0ft67emQAMSwqf9nlAAoh6K88XQrYSrmol6WgZdkzSd-qrKEQiRtIA3AblDen-RMVZQtkde_odW5AKEcLbbMu87YE4lXGXptWQ8M0-JpHC-AHYIVqy-on-lF1otHl_IcGGxKK0HZDP_KCSBpztk3s53uL3h5p58rL_ttNLsxGZ4rRLdIWrWOAfs81dsCm8esGypIhr4Qo6eq7ynF02ygZ61Lcrqk0UNy3c5KnAC4YPmO7V-grRA67rYYc09rxVsFFBwrrRtZhIg1Gtq4MaodZkYqtLnbHi026sCL-hIcNyBKVhZXdgZ9h7rkoTwhxyGMuiEmy9EZq366sqAKWFzmZFWZn2x9rJrpy6ZZZfc5th1-334Gxde3n9jTztnxoGyab7FHi8h&sai=AMfl-YTgoJVilID5zX9WItK3EKYiXFCCw6L3m3Q8O0TJpsnTYs92bMoFJHKttUvg_3xziDCcNaxV3qSaJrnIE5VGgDyMLa1tINwt2E550dZNnPaZRm0KizfIgM0StrGa-O_UxNOwHRbHAh8Zu--ekigeVrA9xSXsgUoYyBf16T7RHiQFcbSHA52lDDirNsD6qpjx6UUKlbbODbHKV1NOSZja_TmzNYuUjSpqUX9xGf6XNfzeSf833w&sig=Cg0ArKJSzGvPjCUf1ldvEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=214&vt=11&dtpt=132&dett=3&cstd=214&cisv=r20220831.65255&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: updatepopcorntime.xyz
URL: http://updatepopcorntime.xyz/?app_id=T4PSEC&hid=9a19de2de347e5fa3864eee56e1bc6a3&ver=6.2.1.14&os=WIN060101

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 02 Sep 2022 14:55:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/5447893353571635470/ Frame B696 110 KB
21 KB 17ms
15ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5447893353571635470/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a920a99fc3c85fe53181b8edd97dc247771c0596fa527391052ec71785b1b317

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 279021
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 21147
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 30 Aug 2022 09:24:49 GMT
expires: Wed, 30 Aug 2023 09:24:49 GMT
last-modified: Mon, 15 Aug 2022 13:54:06 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame D01B 2 KB
1 KB 68ms
20ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YxIZTQACZ0UIEd2aAA5b1kdIq9x64_KIo5wwCQ&u=%7C%2B3FqC%2B1HDc8DvrsZITjhbK0%2BNrxnhYx%2BH3vy5CzCI6g%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNB-Ap14Pg0HmFAf1GHAR2jvULOd3YfT8Kie5-AMuoqyTirKgE-lWZeqPULGzE4HXtHRo7W7jK_gZhTec_TEVV4ypFxgJszksIGU56urFev0yvQOlXHqKNXSZspRrSsacgfFN9BWlV86M6Tyi1PG1gW5_U_tLxh2N6RCfzKmQyxgHpbdfC4ww86SsD0rKnEj9kiOp99x-SiuIupZCeL839KBOf-Yy4fS43Nm1xv2rkD5gpKhYbufS1n_THc0zoUToOlrZJkE57aCQ0TNarFbXHKj5O-ehLxwm7Ndhwmp8o2aURcTqRdtFe5Yky8pYYxyu2DzwMoDjA_yzuIU59UrvjJ21aj8QolvIFHLO_v31EcYNvD3L46ZxnzGWD5wzScNLC4S9kogI3zYS67oK-yUtAl_P5irdtlwayeLWvCjC2bf6X0FW-RtB4r8rjtoHxEwj-EorPTW1kGQSKKg6w9uetdVhhEUlAWFCNeg8UAwm_8UoVunycZ63-ZUy0bSeZg5IuB-xzeDl6BMfbBVtfGijZvTRAyLpconbGDwWhz_iDErJqsRxI9wfnBN-osCgjYb4xaFnyX9jaIjYRIMswcts_d2cbgX0TUNdQKzG6FQ65GVI&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCNwi0TRkSY8XOCZq7x_AP1re52AHJntKxXNWdkfdwwI23ARABIABglcKmgrAHggEXY2EtcHViLTEwNjI5NzI4NjE1NTMzMDOgAdW20uoDyAEJqQJY9IrfrcWwPuACAKgDAaoEqAJP0AYSg_pBhyRwFRaqIyBiWMzKWEv2jKeIgFjY2yFJczDRo6hxYEVZOM8jdpQaX3Tzux-yqJT97crsohtmkKJQTIJ3NVMSnDu6rXnAkVEkMlBr2XnNCZsVAaqtWn3AXzaWyS3Xn72x9CcxkA6nQTrMajIHRhP9BgOLbtvv6Y9bSUvC4ccbaKmDgGlavvgwPmupKZmG_wZgeIGk6vNGb7-OLWpQ_5PzbSOAn2MKHwvQ4RDubnfosdzA4BE4469LiH16r7d1XUlka6PE73GfhJps2_YETuHh8bvR3mH9K-QUg2V9CZ20_Q27eymxkyCdECsalP4bIlcUPGH4it9MF8heYi9mQr_7Opdx0W-f3dT47q2-Vwb--v8zST4FW6TLSZ00EW57ULufh-AEAYAGx83PmN-e7an5AaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_31dcQlmOeT36N-_R4CU5n9EiRDNA%26client%3Dca-pub-1062972861553303%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:10 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 28 Aug 2023 14:55:10 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame D01B 2 KB
1 KB 67ms
19ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:10 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 28 Aug 2023 14:55:10 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame D01B 308 B
637 B 52ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:10 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Mon, 28 Aug 2023 14:55:10 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame D01B 293 B
621 B 53ms
18ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:10 GMT
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Mon, 28 Aug 2023 14:55:10 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/delivery/ Frame D01B 43 B
348 B 325ms
20ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=rItBeaakDsbZ4BraU9MWJoTlYqBqCe6l_YLFRmhEG6ZJCH5GvamE7HkMIBjCScTMB6GZw3pO07lZKYPaGgHOabmKsq3pCH4Jr2RtEGtfaqzHBdDbKtjU3KYlV3gAyInAg5Umn5BYZ9Qe3BiGlczDi7wl_zdjIZ7oG5DQlrFKqLBA1KdAuF_nnG_Ivvd-TXJn6vASVHTKLJunyvxTimdeyCPaCmngo8yNtYj3YQNRXtHlNC8x0byhV60obF38-v7eOjszmY9znhne2lvORk4fCWQ7gHv0b4gO30XpMisGCPR_apac9acdT5ZZB98TUTpoQQwKYA1xAWK52_oY69Xla5wSnasL-M_LmywWM2rmt81AEgbyyj9LjT3KCbVat9lRbQit7NJDbkXSipEOCoPlS_JDhV7SF-DttZgCp_Ot7nMZWMcQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3603930
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 m
secure-gl.imrworldwide.com/cgi-bin/ Frame D01B 0
689 B 199ms
112ms Image
text/plain 2600:9000:223c:6000:1e:a43d:b640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-gl.imrworldwide.com/cgi-bin/m?ca=nlsn184820&cr=crtve&ce=criteo&pc=criteo_plc0001&ci=nlsnci162&am=3&at=view&rt=banner&st=image&r=1662130509
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YxIZTQACZ0UIEd2aAA5b1kdIq9x64_KIo5wwCQ&u=%7C%2B3FqC%2B1HDc8DvrsZITjhbK0%2BNrxnhYx%2BH3vy5CzCI6g%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNB-Ap14Pg0HmFAf1GHAR2jvULOd3YfT8Kie5-AMuoqyTirKgE-lWZeqPULGzE4HXtHRo7W7jK_gZhTec_TEVV4ypFxgJszksIGU56urFev0yvQOlXHqKNXSZspRrSsacgfFN9BWlV86M6Tyi1PG1gW5_U_tLxh2N6RCfzKmQyxgHpbdfC4ww86SsD0rKnEj9kiOp99x-SiuIupZCeL839KBOf-Yy4fS43Nm1xv2rkD5gpKhYbufS1n_THc0zoUToOlrZJkE57aCQ0TNarFbXHKj5O-ehLxwm7Ndhwmp8o2aURcTqRdtFe5Yky8pYYxyu2DzwMoDjA_yzuIU59UrvjJ21aj8QolvIFHLO_v31EcYNvD3L46ZxnzGWD5wzScNLC4S9kogI3zYS67oK-yUtAl_P5irdtlwayeLWvCjC2bf6X0FW-RtB4r8rjtoHxEwj-EorPTW1kGQSKKg6w9uetdVhhEUlAWFCNeg8UAwm_8UoVunycZ63-ZUy0bSeZg5IuB-xzeDl6BMfbBVtfGijZvTRAyLpconbGDwWhz_iDErJqsRxI9wfnBN-osCgjYb4xaFnyX9jaIjYRIMswcts_d2cbgX0TUNdQKzG6FQ65GVI&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCNwi0TRkSY8XOCZq7x_AP1re52AHJntKxXNWdkfdwwI23ARABIABglcKmgrAHggEXY2EtcHViLTEwNjI5NzI4NjE1NTMzMDOgAdW20uoDyAEJqQJY9IrfrcWwPuACAKgDAaoEqAJP0AYSg_pBhyRwFRaqIyBiWMzKWEv2jKeIgFjY2yFJczDRo6hxYEVZOM8jdpQaX3Tzux-yqJT97crsohtmkKJQTIJ3NVMSnDu6rXnAkVEkMlBr2XnNCZsVAaqtWn3AXzaWyS3Xn72x9CcxkA6nQTrMajIHRhP9BgOLbtvv6Y9bSUvC4ccbaKmDgGlavvgwPmupKZmG_wZgeIGk6vNGb7-OLWpQ_5PzbSOAn2MKHwvQ4RDubnfosdzA4BE4469LiH16r7d1XUlka6PE73GfhJps2_YETuHh8bvR3mH9K-QUg2V9CZ20_Q27eymxkyCdECsalP4bIlcUPGH4it9MF8heYi9mQr_7Opdx0W-f3dT47q2-Vwb--v8zST4FW6TLSZ00EW57ULufh-AEAYAGx83PmN-e7an5AaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_31dcQlmOeT36N-_R4CU5n9EiRDNA%26client%3Dca-pub-1062972861553303%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:6000:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
via: 1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-P2
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
x-cache: Miss from cloudfront
accept-ch: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
content-length: 0
x-amz-cf-id: ogv_LsyFnZasg5h2E8AaNm-vqZ4K_rI2wKIVUPrLP4WufHLpwNZEPA==
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 635D 118 KB
40 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13151972954896785613/index.html?e=69&leftOffset=0&topOffset=0&c=k3SG57xylD&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13151972954896785613/index.html?e=69&leftOffset=0&topOffset=0&c=k3SG57xylD&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 07:51:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25450
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 03 Sep 2022 07:51:00 GMT

GET
H3 200 JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js Show response
pagead2.googlesyndication.com/bg/ Frame CA79 36 KB
16 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

248d0f732763fd82701728aff2902d3e6b079e73f1ea00c1c4bb749f45e9226f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 12:54:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7234
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15957
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Sep 2023 12:54:36 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C924 22 KB
8 KB 14ms
14ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 79550
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 01 Sep 2022 16:49:20 GMT
expires: Fri, 01 Sep 2023 16:49:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 528F 0
26 B 55ms
54ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsurghVYBHjtl_beeVKhUDVtxFzrSet0HbWvSbUnddF1PYwdacKKvM6dlOgjZIWoyYQCacf5w8YOqW45Bff423p3X7SvS_SvNPtM-wSrwW7uRhLTSL1uorBMj2eSsQemNBqVM9m8wUrAgJ9fW4Ld9zkmDKbWB_5oyOTbAmhuvNRCMepWOXmcP6ookfbc2nDZZ3XKYMCQb_ZJhBOVOiWb3DeLv1BjQwN1BXH28AyNhqjttyQISEw4eMyju79v6yg9E0FfpVN0Kjl1uO35xVL6-V26u9v4R5lnDKGkCX-8j--OjGdQ-JAerfyoCDLpnl8Chesrtn10vee1NxETAWCA4me0c7PAO04fXcVulCqUyUrgcNQZaAorWLVmdkGeaRAXvGTqPukeaP_HqAwha1_am5u-6EMhD4W-VkfsuuNyfNVz3f9gn8e-WQ1x7bscyFYlz19BIrI1AH_RkJcUucM2Ej2AGTuFdKZ70vapa88GXJQM_TgX8t5gMTGQu3Ignh5OV-NuF97RBiEy-YIe4IA8xd5AF5Hyof0-ApBfxJ-ux0Z76MG_KwbfUEga57FEjk-N60Nz4l5MfOh2eO2WI9UmYbNZcR7VK_DfZanEXjFThVOf05FJdtXEXkx-Wy11dal6Pv8IlzM-6-1yfwdKDhYVyTsMV2qa7bb-9fglaiAdBGgKiJ5gvKa9lvgTDeTcrxgdxnuiRdKLMiWnxwF4zwwW04c_n0Wp7yKH6OYRDA_mhxdNTJEkYwxAfgn5jUd8sSOuHYlmYv13jcYIF0TrimTPpsjMmNfZnSm4QbznmCUSTACJh1xb6sqFvzJlF9fapdEM1BLuVF0hFKsoFOEm_4yL_DSLqIVROAu4iQcDzqu5SsopsEuLs-np3HbUWJ-Lx7accsNczrofiv068k5nh7gNKINew4_4-pGFv0Yzd89YpdJPy2A65tK45XFAzlzB2cxznCxA3l26uaBXRL0EpeAkRNfvi7uHAeGX74sj331UNeY-VsLakjskxDy79ULyDmvfxpuTdsedXw-TgzhDHqijG6rCYPjwl6Xw4f6NF86ulqgvcdx8Q5e5L9tULu7YrMSryfX1IPOH_WBqRq3hVHoqGtQZfdROXH_yawWYqW2htNVqbaJH4L8k1FqR0_bUP4MEbVAKcUivcxXmCehFzoZdco-o9dbC8G-HkEoh9YT7PaaxqPHxHsVf1MAqvSwh9RypGl0JL7wWkl-jjx98cBCfBEDKGE51ifsHPGerCo9TkZWaR8pN2bXKY1LXt29gDSgX--0Fz6ddOWj6160483kYpjHhTZHVeWgN3nWSL1rYm2YGzQUlyc-0AEKJ&sai=AMfl-YSjbB12hW-sERWnN8FS6oDhruWWTYozWmghXZYKtkzaZfhenykbTTf1HijsKqptoHjlEDsVTdVKcY8Cih7_vyvLb6hYZbrtw3LSvL9RzXbw45hbrU98aBjGPT4kwpN2k-O5PHhoBXl7AdzjgcyeqlsHQ7O7RJsJUm5IZyGCvipTuvSAjT2_ghU9tTTxb4pvng3UrvNHYubVd2futHwqdA2Z&sig=Cg0ArKJSzOPTudzmvJL9EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=306&vt=11&dtpt=192&dett=3&cstd=109&cisv=r20220831.38451&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: updatepopcorntime.xyz
URL: http://updatepopcorntime.xyz/?app_id=T4PSEC&hid=9a19de2de347e5fa3864eee56e1bc6a3&ver=6.2.1.14&os=WIN060101

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 02 Sep 2022 14:55:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 DcmEnabler_01_247.js Show response
s0.2mdn.net/879366/ Frame B696 29 KB
10 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5447893353571635470/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5447893353571635470/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 05:27:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34082
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 03 Sep 2022 05:27:08 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame B1AD 0
104 B 114ms
24ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEG8UmJexAzG0sYeeda9B9N4&google_cver=1&google_push=AehlK4DU0dprD2vPqhBWFHjzOM7miz-SuJ4i_jGKIFgqAxh3fxIhrAiPFpozsbHduJXyqAsP_bXbTCp44MLHzCvE9DLIz74iykoL
Requested by: Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame B1AD 0
173 B 62ms
20ms Image
text/plain 34.96.105.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEK0PncJDT3MgGoF-8NXr-AI&google_cver=1&google_push=AehlK4CQr3Q-hQKc16bVR_i-8SMhRWFnzU_9kTnrroBTnTGbNzOGaflFXE_AHR2LyDvXhmAHhayYJwJRvQ66EK9avk-1NpkcchVy
Requested by: Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:10 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B1AD
Redirect Chain

https://s.uuidksinc.net/match/47/?remote_uid=CAESEGI0cP7AA9RSebV5aJOHV8A&c_param1=AehlK4BM9b8V6L_vBLgGf769swTnqjSpuR2ExK9aq15iKKpRv_UnABL4HNRTu_gwBPDmo_FXlsg9IqtdN7kcF0-luWn6R2CKDboc&gdpr=%%GDPR%%&...
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AehlK4BM9b8V6L_vBLgGf769swTnqjSpuR2ExK9aq15iKKpRv_UnABL4HNRTu_gwBPDmo_FXlsg9IqtdN7kcF0-luWn6R2CKDboc

170 B
188 B

27ms
27ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AehlK4BM9b8V6L_vBLgGf769swTnqjSpuR2ExK9aq15iKKpRv_UnABL4HNRTu_gwBPDmo_FXlsg9IqtdN7kcF0-luWn6R2CKDboc

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AehlK4BM9b8V6L_vBLgGf769swTnqjSpuR2ExK9aq15iKKpRv_UnABL4HNRTu_gwBPDmo_FXlsg9IqtdN7kcF0-luWn6R2CKDboc
date: Fri, 02 Sep 2022 14:55:10 GMT
server: nginx/1.19.0
content-length: 0

GET
H2 200 UCookieSetPug
image6.pubmatic.com/AdServer/ Frame B1AD 0
166 B 124ms
17ms Image
text/html 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESENbgq8Jp69K5EPC5HLBOBKg&google_cver=1&google_push=AehlK4DKebzh15j58UGsIHLiCTcxwzUUMtNc7iUPLrbn3SCeu0ZqCp8H3T2F-ypZxMUBrVw3iZCQLzqJ_CHwnyD3JeE_Oc7l890
Requested by: Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B1AD
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEM_YsBducX34QktSDQH5KkQ&google_cver=1&google_push=AehlK4A2v-OYrAvi6RML-pJblysrC-CTqXFoPxiflH1lx7-nOuTAMV2Y4y1l3zY1s2IWpKtiBG...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS13NzE1NEVkRTJ1RjE1UVVjVnQxMmJ1X0QzeXFGMFJ0d35B&google_push=AehlK4A2v-OYrAvi6RML-pJblysrC-CTqXFoPxiflH1lx7-nOuTAMV2Y4...

170 B
188 B

27ms
27ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS13NzE1NEVkRTJ1RjE1UVVjVnQxMmJ1X0QzeXFGMFJ0d35B&google_push=AehlK4A2v-OYrAvi6RML-pJblysrC-CTqXFoPxiflH1lx7-nOuTAMV2Y4y1l3zY1s2IWpKtiBGpqZ1nxmgJvFFSfV9u1XmheL_YH

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS13NzE1NEVkRTJ1RjE1UVVjVnQxMmJ1X0QzeXFGMFJ0d35B&google_push=AehlK4A2v-OYrAvi6RML-pJblysrC-CTqXFoPxiflH1lx7-nOuTAMV2Y4y1l3zY1s2IWpKtiBGpqZ1nxmgJvFFSfV9u1XmheL_YH
date: Fri, 02 Sep 2022 14:55:10 GMT
server: ATS/9.1.10.25
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame B1AD
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESELCnoo0Wg4YMWa9-Nk09tzI&google_cver=1&google_push=AehlK4BPeu8YOqUwlYtc-NWFlITRBg5UaFZW7B4ikOFfrfbNkPjLGRQ0dKIFfQoJmh7dT0VI8QWt3ZwQfoY...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AehlK4BPeu8YOqUwlYtc-NWFlITRBg5UaFZW7B4ikOFfrfbNkPjLGRQ0dKIFfQoJmh7dT0VI8QWt3ZwQfoYoFovVVTEFSxbcwQ4Acg
https://onetag-sys.com/match/?int_id=19&google_error=5

0
151 B

17ms
17ms

Image
text/plain

51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Protocol

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip251.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

spacer.gif
an.yandex.ru/resource/ Frame B1AD
Redirect Chain

https://an.yandex.ru/mapuid/google/CAESEAkNsYJUrVRxWkyZzxQufRI?ext-param=AehlK4D7rEU_hE8u_JXHy7FkuWrxRzc4Mh32j0aTLRPn5wTak8nCGixWmb16w5OHRz5DXi-RaPbqPR03npxjn7KC1gs5zsxJue0hPA&partner-tag=yandex_ag...
https://cm.g.doubleclick.net/pixel?google_nid=yandex_ag&google_hm=CAESEAkNsYJUrVRxWkyZzxQufRI&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
https://an.yandex.ru/resource/spacer.gif

43 B
102 B

61ms
61ms

Image
image/gif

2a02:6b8::90
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/resource/spacer.gif

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 02 Sep 2022 14:55:10 GMT
content-encoding: gzip
last-modified: Wed, 18 Apr 2001 10:28:03 GMT
strict-transport-security: max-age=31536000
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif
x-xss-protection: 1; mode=block
expires: Fri, 18 Aug 2023 14:55:10 GMT

Redirect headers

pragma: no-cache
date: Fri, 02 Sep 2022 14:55:10 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://an.yandex.ru/resource/spacer.gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 237
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame B1AD 0
12 B 26ms
26ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IY2jKWocj1CMMukYAPzt92J7g33m7aayUjukXwSzdX3lY7aRKbndVR-d93V8gEK6Wkek7HEO4u

Requested by

Host: d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com
URL: https://d3edda4ed4c0cb3e05e2d7cc928d5c6b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:10 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame D01B 12 KB
6 KB 16ms
15ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:10 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 28 Aug 2023 14:55:10 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame D01B 11 KB
11 KB 76ms
23ms Image
image/png 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=496&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F2861%2F190124%2F8d6bc06124f044d4973e0db21c495799_logo.png&v=3&w=356&s=YMwIwnYfvEdOCB7pG7_o_SEP

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

cdeac9e009d394737c133d4f4692a8fe3ee3c88df825af37b647e2610b9082e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=30276614
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 11301
expires: Sat, 19 Aug 2023 01:05:24 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame D01B 1 KB
1 KB 66ms
13ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FB%2FlogoBKA_Bundeskriminalamt_4558DE.gif%3Feb%3D1&v=3&w=400&s=GVnKI3ywx2pDN-sz0JRgKSSP&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e4b58a351151e4da3ebfac8c923fc7c19c7bbbd6696d716a2f3465bf869f1138

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:10 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=136695
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1266
expires: Sun, 04 Sep 2022 04:53:25 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame D01B 2 KB
3 KB 76ms
24ms Image
image/png 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F5%2FlogoRheinmetall-Immobiliengesellschaft-mbH-105281DE-2106231724.gif%3Feb%3D1&v=3&w=400&s=ctRHsoIlYpNZ67X2xyd_Mzu6&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

cc5e65f3bf4a6f565b2e549b9b401450a1e7d283ffe50dd4a906b5375808b851

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:10 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=1476889
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2446
expires: Mon, 19 Sep 2022 17:09:59 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame D01B 2 KB
2 KB 76ms
24ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F6%2FlogoBosch-Gruppe-2804DE-1909091413.gif%3Feb%3D1&v=3&w=400&s=mpSaavc37cTAcDERDSmhZdBJ&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

490319aff00a55cfc00d9e24f71f39fc0801858055c62c07bec8fabf2f6e24ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1501496
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1584
expires: Tue, 20 Sep 2022 00:00:06 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame D01B 1 KB
2 KB 77ms
25ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FD%2FlogoDienstleistungs-Center-Halle-GmbH-DLC-Halle-153157DE.gif%3Feb%3D1&v=3&w=400&s=Y5UrGVI-PKzb_L9pX4wn0Fm8&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

5f5654d3095dcc7a871f7d4c1355b2c9eea3eb0d8f72f87e65b0cf51961aefd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1396318
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1382
expires: Sun, 18 Sep 2022 18:47:08 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame D01B 3 KB
4 KB 77ms
25ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FB%2FlogoPharmazeutische-Fabrik-Dr-Reckeweg-Co-GmbH-69025DE-2012291254.gif%3Feb%3D1&v=3&w=400&s=r_rhRLPod16alAKogH9EL9EW&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

d8b46f2f63a12cd05a2fed6792596d9c90daa9db99d22ff52f7a1fe64ce9b16f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1210120
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 3386
expires: Fri, 16 Sep 2022 15:03:51 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame D01B 2 KB
2 KB 16ms
15ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F6%2FlogoJungheinrich-Service-Parts-AG-Co-KG-246765DE-2006151644.gif%3Feb%3D1&v=3&w=400&s=O3umIXeg07KA_0uZOkxlsMnY&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

8bf2cc2fd1572a1427a5326f965743c200542b4270fc22ac7e5fbc69c8d3ed29

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=47
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1694
expires: Fri, 02 Sep 2022 14:55:58 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame D01B 3 KB
3 KB 17ms
15ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F4%2FlogoVerbund-freier-Trainer-und-Coaches-UG-haftungsbeschraenkt-307324DE-2206131139.gif%3Feb%3D1&v=3&w=400&s=kQPVVx6qqWTaJPEz3j54x2he&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

bf6ef9f2ec28cdef4f1e3b49e7c0b2a6f05c027fed9f2d685dc7815a2a76c355

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:10 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1378660
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2732
expires: Sun, 18 Sep 2022 13:52:50 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame D01B 1 KB
2 KB 20ms
19ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FA%2FlogoAXA-Logistic-Services-GmbH-120810DE.gif%3Feb%3D1&v=3&w=400&s=PwHrVAReCmBagLx8cjq_S5Ui&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

cdff7ea2f26f008c8ffb939f1cce521c1162deeb0ed943928194511f24355e95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1787201
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1348
expires: Fri, 23 Sep 2022 07:21:51 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame D01B 824 B
1 KB 18ms
17ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FF%2Flogoforsa-GmbH-106079DE.gif%3Feb%3D1&v=3&w=400&s=SWE6M4UNbOZ85LqWAXorsR09&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

99db7c45413b65d885b0ed8ee9b5adcb77066510eeb758cf53c6fdd1f07c0eda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=848754
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 824
expires: Mon, 12 Sep 2022 10:41:04 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame D01B 2 KB
3 KB 19ms
18ms Image
image/png 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F3%2FlogoPierburg-GmbH-70849DE-2106231713.gif%3Feb%3D1&v=3&w=400&s=aIaA7G5ILvu_kGg6uLAqEV7l&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

cc5e65f3bf4a6f565b2e549b9b401450a1e7d283ffe50dd4a906b5375808b851

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:09 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=1493
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2446
expires: Fri, 02 Sep 2022 15:20:04 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame D01B 2 KB
3 KB 20ms
19ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FX%2Flogoxaverius-Unternehmensberatung-Personalberatung-GmbH-68619DE.gif%3Feb%3D1&v=3&w=400&s=hFY5jwmqjWMX5pNb4hJ5hx1M&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

3f7039c5a54ec1ccd2d07f943f14957d92ecf6c54650b4b611a3e5d7343d4aa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:10 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1825
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2400
expires: Fri, 02 Sep 2022 15:25:36 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame D01B 0
128 B 266ms
16ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=L5b0wfv38TYFZfKo76_TPrMDPSTKxmSUFj3ZBXjf5xGrkxr1HMax5641J20WMYfQ6bSwGnfd7QV1456g-ksEFE8Wg1S4vEoUdrC3HQ_PxxTt-uITqSGj3ICQNuf42SfgWplTnC0qA_zYnf7ERWg2y2MOpz2fjqXV3-qqOXJkAwqnRjkyydhPOu5BxTfka9bKGyuDbkko575pQoTUbkNZNLb8q-ekJBDlWLHEq83HXglUIPK3ubVvrVt4o8HaKYLky77XEg&sds=2&rev=82604.2&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 02 Sep 2022 14:55:09 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame D01B 2 KB
1 KB 73ms
73ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:10 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 28 Aug 2023 14:55:10 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame D01B 2 KB
1 KB 25ms
25ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Fri, 02 Sep 2022 14:55:10 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 28 Aug 2023 14:55:10 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 0520 7 KB
5 KB 56ms
56ms XHR
application/json 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dca6f45852a7c58ebcd4a81208ebed5bdf6c0712a16f12c19e585344eff79dc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 02 Sep 2022 14:55:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5571
x-xss-protection: 0

GET
H3 200 UNICEF_Logo.svg
s0.2mdn.net/sadbundle/11093819551445137482/ Frame 0520 10 KB
4 KB 15ms
14ms Image
image/svg+xml 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11093819551445137482/UNICEF_Logo.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a44efd70e02315730f2e179199ac42471f018a00052133981e37ee695ed52e17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11093819551445137482/index.html?e=69&leftOffset=0&topOffset=0&c=EP2Y3k2HKq&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 12:03:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 96702
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4076
x-xss-protection: 0
last-modified: Thu, 01 Sep 2022 09:01:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 01 Sep 2023 12:03:28 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0A64 0
26 B 52ms
51ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssO4C0W036GjgwO4i7t72zwl1YaNaZMdErPTHAUa0VbmfraleI5f_ZspsyuoJUyZ-e3ADPE9dFj89wIHrvwKbEd57qT8-8v2z3eBI311FWF5AZvIbk6sPnOr1uRkOKJ--8mRswbdR2nrjDyrpOtH4_WMOQjBfO2HnvzeFwTYmxPMfkQfQE-DgvhsAzSH7Ub92mqkroE_c-TFFLvWAnkDRwnFW1vNR5q9A-wuGuiN3ZgvJL33cmqmAg8K8-L0XEyGREVpnslu_SS5ZffZQbCT3HPOYLCnwdAJda7hdAd0JW6D2AF8IMc_VciZid8DiWpsCE4ooa-M2HOBA4ZryXJXi1vULPFOaCED0Cxwv_k1g78YSA_OKpTTbKt7l2dG24Vu3vfWrSQV5RQmFCZgM9cfErVHkxU8kbx8l2E370jKLE8fdZayD692b38Ugco4KQl891grUbxM0erzxoLsPn1Urlr3DdTmRFaD9H7F6HeCyQ8KAvAjTlTFgLkR_AzFTLUNbEVK8NqLhhbqyaxhxWFh33zLaMcILT2Iwl95LQRGUtdK7chhkj-YVC1RJKltkKEIJzSWrpm2Aki_HmG2TGwTjKG9jjA7WVeJBGz8zI1l3rCXTHn_3OyzF0iBNNqbtr7_fK0gz8thR2p5SvqNf6mHUTzP-zoh-6qbsJRaNodP0c_WGzU4vdJsV0bjnO95WbAC6YTJJVdFPKdDEKgrMVi2e_1L3kyqHiKtqzb-k-oppDhuzZQ3bgzmqZZxsob2Q9RXJ3Pv_JBzBYJeSfa8uW5piOotAxTOSg4RiUeIsHG6H8nICaF1Zgwu6DlhTxVZQRrtfv1BZ_w9LfabphwMLUYuuiFVDgsyXndk5I7hh_LyfnAnN7K6WLETzbz-c4yXDWY0YikUVZnd4xHZDIF-jHS9fcgi-XWv04lPFdmw3Zw40j5SExl4j2zkvXtnvwkA_5plvK7HVH7HXSxNAX-Xsj42IuAnK_pbfkaYQaX_ByEnF_Fln42KQtoD5jCsWOs-5Y5AP_jxR-v9fO2kB305lsw882NkYSzZVuAMiruSb2IB_nx2mnWoHzyyxr4HXJJ7ty8EOD8kctnwW2_Ph-S7XtOtaYQiwAqkyDOAxH2s44GQSfitOFu7GvtPMMID_pZJlGyPBiTLao6IPETUqYtleLpU6jHwYWwfPN32G66WSPxaTkGt5jDaXx8Yl_9lCmW-v1UiHKt6Ttihr-rmdrdX49M-rNEpSslTwyz2z05UmYpTvok2NiyHMTfBtpuWpNF31wpVQneLd5dXBOlXUIkMNHz48crKZbVYAXcQ9lEOWcH9eDLofu6gBt39lM&sai=AMfl-YTOBsiMfmPkEBa-T_i19Rs7hV4V21UMwswLQwpyNmywOpkwH7TgFE_bNhonAyNCrjQBGmWhvHzdcRj-S22c4zbhB25eI4y4inkIP8PtNNvHA0One4JELMkr7Qpl8PMXvt0pXHEGAug-mh3Slm0LNzozM9OP09UhdrW-jlvLFRoL9pMnCdbvFIVqlJudkLRm9N_JApmKM-lf8-ckhYIYUXMO&sig=Cg0ArKJSzNJcse1egRdREAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=321&vt=11&dtpt=271&dett=3&cstd=47&cisv=r20220831.47946&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: updatepopcorntime.xyz
URL: http://updatepopcorntime.xyz/?app_id=T4PSEC&hid=9a19de2de347e5fa3864eee56e1bc6a3&ver=6.2.1.14&os=WIN060101

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS