www.reisekostenabrechnung.com Open in urlscan Pro
2606:4700:3036::6815:3444 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://cdn-2.reisekostenabrechnung.com/
Effective URL:
https://www.reisekostenabrechnung.com/
Submission: On March 17 via automatic, source certstream-suspicious (March 17th 2021, 9:33:53 pm UTC)

Summary HTTP 350 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 39 IPs in 5 countries across 29 domains to perform 350 HTTP transactions. The main IP is 2606:4700:3036::6815:3444, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.reisekostenabrechnung.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 6th 2020. Valid for: a year.

This is the only time www.reisekostenabrechnung.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 70	2606:4700:303... 2606:4700:3036::6815:3444	13335 (CLOUDFLAR...) (CLOUDFLARENET)
29	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
3	2606:4700:e4:... 2606:4700:e4::ac40:a708	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	13.226.158.204 13.226.158.204	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
1	2600:9000:218... 2600:9000:2182:1600:2:cb38:840:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:801::2001	15169 (GOOGLE) (GOOGLE)
24	2a00:1450:400... 2a00:1450:4001:809::2001	15169 (GOOGLE) (GOOGLE)
29	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:82a::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
5	3.126.196.163 3.126.196.163	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
18	2a02:26f0:10c... 2a02:26f0:10c:49e::4469	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
15 39	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
9 15	104.108.145.8 104.108.145.8	16625 (AKAMAI-AS) (AKAMAI-AS)
6 9	37.252.172.45 37.252.172.45	29990 (ASN-APPNEX) (ASN-APPNEX)
2	2a02:26f0:10c... 2a02:26f0:10c:488::4469	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	213.254.244.14 213.254.244.14	3257 (GTT-BACKB...) (GTT-BACKBONE GTT)
27	2a00:1450:400... 2a00:1450:4001:813::2006	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f02... 2a03:2880:f02d:5:face:b00c:0:8c	32934 (FACEBOOK) (FACEBOOK)
1	143.204.202.16 143.204.202.16	16509 (AMAZON-02) (AMAZON-02)
4	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
4	205.185.216.10 205.185.216.10	20446 (HIGHWINDS3) (HIGHWINDS3)
19	213.254.244.15 213.254.244.15	36062 (DOUBLE-VE...) (DOUBLE-VERIFY)
4 4	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (TURN) (TURN)
4	46.228.164.11 46.228.164.11	56396 (TURN) (TURN)
3 4	2620:116:800d... 2620:116:800d:21:f916:5049:f87f:108e	16509 (AMAZON-02) (AMAZON-02)
5 5	18.159.187.109 18.159.187.109	16509 (AMAZON-02) (AMAZON-02)
4 4	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
5 5	37.157.4.40 37.157.4.40	198622 (ADFORM) (ADFORM)
1	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	23.59.71.163 23.59.71.163	16625 (AKAMAI-AS) (AKAMAI-AS)
5	34.251.104.84 34.251.104.84	16509 (AMAZON-02) (AMAZON-02)
8 9	142.250.74.198 142.250.74.198	15169 (GOOGLE) (GOOGLE)
3 4	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1 2	104.109.66.25 104.109.66.25	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
350	39

70 2606:4700:3036::6815:3444 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cdn-2.reisekostenabrechnung.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.reisekostenabrechnung.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:e4::ac40:a708 (United States)

ASN13335 (CLOUDFLARENET, US)

go.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
g.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.226.158.204 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-158-204.dus51.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2182:1600:2:cb38:840:93a1 (United States)

ASN16509 (AMAZON-02, US)

go.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.126.196.163 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com

g.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a02:26f0:10c:49e::4469 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)

cdn.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 142.250.186.34 (United States) 15 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 104.108.145.8 (Berlin, Germany) 9 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-145-8.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 37.252.172.45 (Frankfurt am Main, Germany) 6 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:10c:488::4469 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)

cdn3.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 213.254.244.14 (United States)

ASN3257 (GTT-BACKBONE GTT, US)

rtb0.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tps20517.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 2a00:1450:4001:813::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f02d:5:face:b00c:0:8c (United States)

ASN32934 (FACEBOOK, US)

ad.atdmt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.202.16 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-16.fra53.r.cloudfront.net

impression.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 205.185.216.10 (United States)

ASN20446 (HIGHWINDS3, US)

servedby.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 213.254.244.15 (United States)

ASN36062 (DOUBLE-VERIFY, US)

tps20519.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tps.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tps20237.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tps20224.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tps20238.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2001:678:cb4:bbbb::11 (United Kingdom) 4 redirects

ASN56396 (TURN, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 46.228.164.11 (United Kingdom)

ASN56396 (TURN, GB)

r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:116:800d:21:f916:5049:f87f:108e (United States) 3 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 18.159.187.109 (Frankfurt am Main, Germany) 5 redirects

ASN16509 (AMAZON-02, US)

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.186.193.173 (Kansas City, United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com

gcm.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 37.157.4.40 (Denmark) 5 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 23.59.71.163 (Munich, Germany)

ASN16625 (AKAMAI-AS, US)

cdn.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
secure.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.251.104.84 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-104-84.eu-west-1.compute.amazonaws.com

d9.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.250.74.198 (United States) 8 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.244.159.8 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.109.66.25 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a104-109-66-25.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
81	doubleclick.net 23 redirects securepubads.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net googleads4.g.doubleclick.net ad.doubleclick.net	264 KB
70	reisekostenabrechnung.com 1 redirects cdn-2.reisekostenabrechnung.com www.reisekostenabrechnung.com	603 KB
58	googlesyndication.com be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	321 KB
44	doubleverify.com cdn.doubleverify.com cdn3.doubleverify.com rtb0.doubleverify.com tps20517.doubleverify.com tps20519.doubleverify.com tps.doubleverify.com tps20237.doubleverify.com tps20224.doubleverify.com tps20238.doubleverify.com	437 KB
27	2mdn.net s0.2mdn.net	418 KB
25	flashtalking.com servedby.flashtalking.com cdn.flashtalking.com d9.flashtalking.com secure.flashtalking.com	251 KB
15	casalemedia.com 9 redirects dsum-sec.casalemedia.com	13 KB
14	google.com adservice.google.com www.google.com	2 KB
9	adnxs.com 6 redirects ib.adnxs.com	9 KB
8	turn.com 4 redirects ad.turn.com r.turn.com	3 KB
7	google.fr adservice.google.fr	2 KB
6	ezoic.net go.ezoic.net g.ezoic.net	2 KB
5	adform.net 5 redirects c1.adform.net	2 KB
5	w55c.net 5 redirects pm.w55c.net	5 KB
5	googletagservices.com www.googletagservices.com	170 KB
5	ampproject.org cdn.ampproject.org	99 KB
4	openx.net 3 redirects us-u.openx.net	1 KB
4	ctnsnet.com 4 redirects gcm.ctnsnet.com	1 KB
4	quantserve.com 3 redirects cms.quantserve.com	1 KB
3	amazon-adsystem.com c.amazon-adsystem.com	35 KB
3	ezodn.com go.ezodn.com ezodn.com g.ezodn.com	158 KB
2	teads.tv 1 redirects sync.teads.tv	407 B
2	gstatic.com fonts.gstatic.com	31 KB
2	google-analytics.com www.google-analytics.com	19 KB
1	cloudflare.com cdnjs.cloudflare.com	28 KB
1	impression.link impression.link	549 B
1	atdmt.com ad.atdmt.com
1	googleapis.com fonts.googleapis.com	765 B
1	googletagmanager.com www.googletagmanager.com	38 KB
350	29

	Domain	Requested by
69	www.reisekostenabrechnung.com	www.reisekostenabrechnung.com
39	cm.g.doubleclick.net	15 redirects googleads.g.doubleclick.net be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
29	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com www.reisekostenabrechnung.com be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com ad.doubleclick.net
27	s0.2mdn.net	www.reisekostenabrechnung.com s0.2mdn.net
24	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com www.reisekostenabrechnung.com be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com googleads.g.doubleclick.net
21	securepubads.g.doubleclick.net	www.reisekostenabrechnung.com securepubads.g.doubleclick.net
18	cdn.doubleverify.com	www.reisekostenabrechnung.com be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com cdn.doubleverify.com cdn.flashtalking.com
15	dsum-sec.casalemedia.com	9 redirects googleads.g.doubleclick.net
14	cdn.flashtalking.com	servedby.flashtalking.com cdn.flashtalking.com be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
11	adservice.google.com	securepubads.g.doubleclick.net
9	ad.doubleclick.net	8 redirects be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
9	ib.adnxs.com	6 redirects googleads.g.doubleclick.net
8	googleads.g.doubleclick.net	www.reisekostenabrechnung.com be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
7	adservice.google.fr	securepubads.g.doubleclick.net
6	tps20224.doubleverify.com	cdn.doubleverify.com
5	d9.flashtalking.com	cdn.flashtalking.com d9.flashtalking.com be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
5	c1.adform.net	5 redirects
5	pm.w55c.net	5 redirects
5	www.googletagservices.com	securepubads.g.doubleclick.net www.reisekostenabrechnung.com be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
5	g.ezoic.net	www.reisekostenabrechnung.com
5	cdn.ampproject.org	securepubads.g.doubleclick.net
5	be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
4	us-u.openx.net	3 redirects googleads.g.doubleclick.net
4	tps.doubleverify.com	cdn.doubleverify.com
4	gcm.ctnsnet.com	4 redirects
4	cms.quantserve.com	3 redirects be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
4	r.turn.com	be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
4	ad.turn.com	4 redirects
4	servedby.flashtalking.com	be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
4	googleads4.g.doubleclick.net	www.reisekostenabrechnung.com
3	tps20238.doubleverify.com	cdn.doubleverify.com
3	tps20237.doubleverify.com	cdn.doubleverify.com
3	tps20519.doubleverify.com	be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
3	tps20517.doubleverify.com	be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
3	www.google.com	www.reisekostenabrechnung.com be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
3	c.amazon-adsystem.com	www.reisekostenabrechnung.com c.amazon-adsystem.com
2	sync.teads.tv	1 redirects googleads.g.doubleclick.net
2	secure.flashtalking.com	be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com cdn.flashtalking.com
2	rtb0.doubleverify.com	cdn.doubleverify.com
2	cdn3.doubleverify.com	cdn.doubleverify.com
2	fonts.gstatic.com	fonts.googleapis.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	cdnjs.cloudflare.com	s0.2mdn.net
1	impression.link	s0.2mdn.net
1	ad.atdmt.com	s0.2mdn.net
1	fonts.googleapis.com	securepubads.g.doubleclick.net
1	g.ezodn.com	ezodn.com
1	ezodn.com	www.reisekostenabrechnung.com
1	go.ezoic.net	www.reisekostenabrechnung.com
1	www.googletagmanager.com	www.reisekostenabrechnung.com
1	go.ezodn.com	www.reisekostenabrechnung.com
1	cdn-2.reisekostenabrechnung.com	1 redirects
350	52

This site contains links to these domains. Also see Links.

Domain
www.verpflegungsmehraufwand.de
www.ezoic.com
www.mein-deal.com
www.optimieren.com
www.bodenrichtwert.de
www.vorwahl-online.de
www.erwerbsminderungsrente.de
www.grundstueckspreise.net
g.ezoic.net

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-06` - `2021-08-06`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2020-08-04` - `2021-08-02`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.ezoic.net Amazon	`2021-02-15` - `2022-03-16`	a year	crt.sh
*.google.fr GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
misc-sni.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
www.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
ezoic.net R3	`2021-01-23` - `2021-04-23`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.doubleverify.com DigiCert SHA2 Secure Server CA	`2021-01-10` - `2022-01-17`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.doubleclick.net GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.atlassolutions.com DigiCert SHA2 High Assurance Server CA	`2021-01-29` - `2021-04-28`	3 months	crt.sh
impression.link Amazon	`2020-06-12` - `2021-07-12`	a year	crt.sh
servedby.flashtalking.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-04` - `2022-02-22`	a year	crt.sh
*.turn.com DigiCert SHA2 Secure Server CA	`2020-03-18` - `2021-04-19`	a year	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
cdn.flashtalking.com DigiCert SHA2 Secure Server CA	`2020-04-24` - `2021-07-24`	a year	crt.sh
tag.device9.com Go Daddy Secure Certificate Authority - G2	`2020-08-06` - `2021-09-17`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
teads.tv R3	`2021-02-18` - `2021-05-19`	3 months	crt.sh

This page contains 36 frames:

Primary Page: https://www.reisekostenabrechnung.com/
Frame ID: E61AE0299B69A6AA2C112C8563585B04
Requests: 124 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Frame ID: 01A68A693626AFA6C991C30E41183B0C
Requests: 2 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012101070013000/amp4ads-v0.mjs
Frame ID: 74C069F311E59EECB13DC0921531F3DB
Requests: 15 HTTP requests in this frame

Frame: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 4D58EF7F069B4B33808EAFB0D8ECDCDE
Requests: 1 HTTP requests in this frame

Frame: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 3FECF6316F462C5C6EC2074EF0B264F6
Requests: 28 HTTP requests in this frame

Frame: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 1B532BE69152AE5D6EFED5739CEE0DE5
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjQrumbATAB&v=APEucNXEVdjzJv4Z1_mRNmg171JGgXiVhxZY6SP1TFwKhoCrw-XTmb7C3X5rHlyoH9b5nNmkUGj8Jb08E1PUoO7ONuptC9gVW_vQLd9nl9b6g8s4a8u-lXKwCyBZ3LDqnl9vDY_QYa6RvEh3HkFn7lh69pQk4bu93rJ7-2zDUjTiAu-Ud-uZVBEeByEVizpJJ_8Y7WCx2hnWlA723x3o9-OFLgeF8JxcnEj8pCPn2zULSc64Vp5Qlsc
Frame ID: 9C4AD0AEB2E1469CC694A992848F65E4
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BXZzVbShdvDpS_5HzgnEseC8YcO8DKgzGZghKx47tPHRUJq-YSaTFXzkp3bNq1J0rVY-Dg5gda7P1HcEuFty2xqGZFhByGIYz3C7_RjNjNe8qVTTKq2ivwkvf3DgbsbyalNzC3YqC-ORbR_sjyXOUSrRKDnA&cry=1&dbm_d=AKAmf-CGL-tPYQZYmqtmeO3yqocDnqVa11KzUEafQRmMZJlRvjYPno2Z9I_OoNZVkwZSHYck0mzAQwX0tKUpRZnR4AgBXqUhIUIe6Gxh1dBxl9mKMZIay4DNlSmQoT0zWZEwr5tBqHfBFagCKEWIa9BAJCnkOKUJVkUHq2sPoXk24OOWtWArKlIOg93ne4C8UsJ_Odn0socXjyrUOZ6YKdW6-c1J1TZ84DIupXvVYSaQUJwPUdpyGyc9a2MG9Y-XVB4raqdGc6KRybS5ABkZ-m_j1Ehrjzw0i_xI6Z8GKL0afHP1utOyY8BxIdkS5VupKvN4fwk_DLH_fM39aChXjRoS2wsWEKvm0D4gRsvzvvb-3IC4TDftX_bjG9pugHZxvVactVFm9S8mHhCVdXBZ868EsOJq6Mgg-KtOYmSSey3GWTs8344lJMhlgv_C8NVPzJHZ-8qs6Nm3PoVudoIFiJzBBw-1XxnmOmHMisbZzlA538GrHOGtt5RkBH7_zOo4JnsNS7YfyHV8-enqM8jYrNfHk__kCt01CwkuuOl4AWxhgWuatSMR3gsfucWwSHOC6J0JEYouRPj1zaQ-dEiPf-W33gShKHQoVxcsobNkCs2ItMyE6TySolCvXxzwz7ijb-709CHQNC5whyHWHAmZxwIamJAsuX8vfaxcWlqEeRzYvzc9BzXJuH1wTCwYDoCTHZD7JmJ0MtIezfXgglFPZw2Muiuqb9t5BBH5W2jxqUXAEa3CnLy64HBz8WU8g5L19gEaiPcZ5zfkq7t4V48__mkpkdgZJlHV7vBX41FUGJMZIJZlExJM_DuqogyIqVN3UwBQ1jXvrb--ZPpvPRc49poEoqgmn9hgsl6r542CwkM-KdAkRLxX26Xi85GNUOCsK3SA3QVt-UU_iRMWhDK5ArPUuvRlBLv-jr5zehzYg0dYpNqYYb3gcJFVIozHIM9tC8AkrLPDOMXsCLhWYqrXpUxtDM4iTEMCr3vIC6MAdL1lm60GYeNFrxVw6t9rs0y0v3IxrpgTbz-DJ4xE6S2cB7nBpsJwNCGg3kkOQPeZ8BR3wxe8pK95EMoQ2lKQRk2FVkq1hXG0nP3JwxE1IAyEHHid1x0aDfgsy1roUCi69wh7c4eDhnByKIlVpTyDo3-jqk3tBhT58TtPTgIq0E6QAOu_BzThiJIuTVdem6kb8bLCspt14ovZgFSfUUfURbKkKI4uxo_baKUkzhKMku13MXL0i9kn2QXCpkZrDIdKsbwRoQJaFNM-RjXg17QIeS59atLq7CP9ubX5_0bOrDSrT14IgRrnmZhnZukqHxFwXdjPp1Z6JfQ0_01GJPUiMQREo7qPmg0HVR8WjFDKhG6TBxAaZ0OVmXC6htFuG8zQLgz0EtxTiRRLk-Cnt0n_eNCyXPT0_KytwP76DT-IBM1029wMC-GoAifVPnDqdC4P4zuM5ed-eDSGOf0JhNVEfMn21HhLMFwDOnbzgdlOMs-vcgretA9DQCO5pGOSOsDNclMYj2z6YCcgOlbrhqU7q0fGGpyrYakUcor1O2BoD5yJuew0-Wa24lvGW6w5-sKE2glxpuslJASOPJQtXbWisK0HLWoEsPvC-gi2GSm2BYHpxVES1eC6Wc0GR9aNaVyFuKwCeBJuQTaF1zmSTyg_kCX7AHVZI7DPgO5_S88v8mZIXRMeT7CQX3FwFWHtK908aTNEoaaYJK3_ROZ2S2P--jRxXVisESmCk2mInwYsIF-fqCLppwKl9XQ_vniaOXxi4KcAllQoBQ6SWpnu8VV_XIS_nlU9OeJbUQJrYLdwoDk8DpccZC_5J7jMTJ6XkcQX4KsGipWhr0LIBQvGg1Lol9aVx7lTaDYJiXZkoe1Zm5M1aP16tJ2ougUTgyI1ffpiE_fPF1sDBU8UDJNEjPOlY5NKI2ZQKjKRmpouLc76kNixvARDEiGWrWh3v7-SmieO7BPrO7-KhHeb5-zq6y93BSDCA8-W7AiX_FaU2Z7ob_MTkOi7ydfueOBySClJ6NNBSof3HTq2i0OqN9NLl6UPUVo4Ch_VRCcZT71nB9RH0j9-JvNrcPxK7_njtY0lGiB6SkD_gPH5AgrAh8hw2Uz_E5cgwhBEXQ0d0QNcbAzmXWI7-a1-LI-fW9HEuKF-RUAO0Tzbf8AuU24dujNPD65TuHY4aNzg4ou2oLRQfi9QNXLGNQrtqI6zgJDGWGpEGsXnjjR2FV4J7rUEx9UfjXuWEKcIeTJUCniZf2HSmAO7dQpI99wvF7PMl340tdWylGiAXHBkDHtoC13IEHNNCoQKXb6JD2YeQsX5iu7rauzkq2HWA8BqHRWtih1HgiMly-NojL-a2mO0i3nEJQmbuhxoc2qW9Umc21h487XlT0BSEK0hVMfivfLjTVZjOSLjuodWquXg7ArAji29G4nvrrZjRWb96ys_BVs4NsxR64YIBg7wMi29DvCHo5brrHFsvrMSWVM6hLZ3Rr3Lx3Wl3IXl28mWI6zYqhLulGzQuqyonf2vpxfDwoIQ2LeR-2vTWZain_x4Z35F1_l7xvx1jJHCeEwDg7D2yjwVq3AjMA55iyj-k9gElSS1bVpdqJOl2r3OGeglW5eUxabnrngIAD795El6g0fO9ZbX08KE8wLSYqBjA40iwRcd8wcnA7GDNzBoJWEqTR_xgUWfnxl2Of0BhVQeReEBesQyI4sOJVtc2R7RlKbtWM2RN-4zKgz6O07i8Wu_hjEFh0tnURdhoU47eMrJEgjINqTNF6tS_GAZCbbtPjGJOH1bbPJiWr5N8FgxPRNT9dDD2Uzf4DXZyMhlrmD0NUQ_XyE-G8e2Y5QQNURY4ZtnCaotUHx86lu7c-ohzpyEexyoXrGehxW4bkCMPMj4ksrmEGJy8Kipn8SrMc_qLryZ3doPCGHDcck3yNZfQFQ_z_lXcnW6DP9Qcwma1c9I8wd9FUIdGdAEkMoKDfoI3pphUhbZ482jyL6rwN5uipEZ_Wfjy_9fzUCHS6c7Z-jxs59Fmr76psbvlz7RPrUg3iLO0aVALSDZijJvQnmE3CZgNg5K35g7xU_GhBggDwKeFK3B2W6pqWHlTCjlSmwU-jbmeoZdM84uFHyGzh3nbWtsRcm0d-AWtM0o6efjo_xWafALz09jg_Uy5AD7LDDcTMadCc3i1g-SsuCUCHdqHhz_5jE7gaL1NMhU2PlY7ZxNbJuTIb74ekVFpiSBXZS8FJYJELHjVqnTOdpha1_bXQcAP1caJxcyYmMPiraW7IMOfd-z33ZExETEuUPIyYXOBwNPZ6REattbhPD_rrxOHrvdArjkUI9xH6-ho9jhHyxV7f2mQUzaPq4O7QsI5_U8_-oYaR84ZRBlrw&cid=CAASEuRoHcGIhjZjXONbzAywBA06UQ&rfl=2%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240
Frame ID: 2B5CA8D65AD3CAEDEAE8A714C49C44D0
Requests: 27 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjQudGZATAB&v=APEucNXvBd6uvEjRC2PlZBt91Bgp6b1SN1BferOMnjqpCcYiaF_keILvN0Pe-0QEJENaVhXGY3xF5C-1tPogueURAFMvnhvGnsL0fnldSU4zBnxo7eLEdBDygEVViSXI9gk_OUGTo0avI1hRN0IoNmfU3nt6TZb8yt6_6aB_0SpvE9b61u2EEl_KzdKR0E3YZ0pb1cAQlb27Mr_MxAY_PNcELOCIpTpEWnhCqgdNczIUwSyVGRtraFk
Frame ID: DD9EB9A505E9BDAA2FCD2935A596A549
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM-nKBD9yigYrdL3bjAB&v=APEucNU7xCrF81jCmgfMo1L4Mh3FKPWjQTG42X0dmktpKTfNPclwy4TdHEYIU_o5-hZ2va1g2dBoK44-DRyVX999Zb1of2LOx0QdcjzlTlRf11UBIkoTg1POuneWNPqYdsViyi6jAMC0EsOvXnPn1jJ1o9j_JtLnjJPX8KLOp8oTe6AxgkW1Whb1-JvKtFBkpV9beSYFiHxMTQqtdE2Fsi6aphvsjQEOKR1q6204fmxixYJocaE0f9U
Frame ID: 5E839E384BB0AC6845302C55460BA3C9
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 4C060818CB16BB8A3C3F5BD88B163139
Requests: 3 HTTP requests in this frame

Frame: https://cdn3.doubleverify.com/bst2tv3.html
Frame ID: 4D4DC9EAFC3EA8FEAD9AC592EF35E58B
Requests: 1 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-match6.js
Frame ID: A1417850EC6090687FF55EDE7B2EDE2E
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 39A564F642594D0C5B09F0C35B3B89D0
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: F1B7E92F448207CCFD48A2A3B02665FC
Requests: 7 HTTP requests in this frame

Frame: https://cdn3.doubleverify.com/bst2tv3.html
Frame ID: C08D38EA2379F654F1831A947A199EA0
Requests: 1 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-match6.js
Frame ID: CA5A2A28C29DEDEE7380B5D8FD0EA84F
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 41CC8E3BDE130D2896620267D62F8275
Requests: 3 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements1146.js
Frame ID: 77B472536F37C6206698A24B593D6CBA
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: E7F7B9C62E5C0A2C3B111069244248AE
Requests: 7 HTTP requests in this frame

Frame: https://s0.2mdn.net/9080429/1589458486121/index.html
Frame ID: B3B3985A0183470A270B8940005A36E1
Requests: 11 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements1146.js
Frame ID: B66CCE376D8B8EECF3DFE1CE15984E24
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: B12A72F9D77F8C92DDDA6367701934B2
Requests: 7 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/t2tv7.html
Frame ID: 1D9362E23382F3BA2979FA575ED1AA0B
Requests: 1 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/t2tv7.html
Frame ID: B4CD40C7258EA2C576E12E93E2E9C80F
Requests: 1 HTTP requests in this frame

Frame: https://cdn.flashtalking.com/116327/3341835/index.html
Frame ID: EC5C5AD44F331B036CCE5EFE063AFE45
Requests: 11 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements1146.js
Frame ID: 575CE09CDA6D4A56947115AE4B903A13
Requests: 5 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements1146.js
Frame ID: F660ACB3E5B8527C98F19823DF6147BE
Requests: 5 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/t2tv7.html
Frame ID: 72CFA5E663E633F1F4E64D5121AEA269
Requests: 1 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/t2tv7.html
Frame ID: BF81860997695930CC944104305E5B5E
Requests: 1 HTTP requests in this frame

Frame: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 6248AE5C5F5A7BDDE835347456284EE0
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhjKicqeATAB&v=APEucNW-VYboarAD95RDHGRb_dlNk9n_IM2mYfF7_j6UWpCeOwIRO3FZmyeAaMTUEodIbaYw_HHsSDd3fcWqkL1q9gvp7KrhonG5CNjRnqFzdbTgn_1inP4Kj6N180G6kusf01rKZUs-WZUnoRnivKRi_KsdFKY223ypxPCMXyFBjchh8L6Hju6NO76LiwW-qcHIVRJfoX5cWts_jzo9qyOPAWhksvLQMMCuRu7OYEBg-9cempBCPxI
Frame ID: 669E7613CD76D0620B397F597CDEF72A
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 01F31FB2628D48AB018DDC021B23084A
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 962D58FFA318C22CE5606FC53668EA29
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: EA27670CA8CA0FE833986DF1A25983FD
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
Frame ID: 28A1ADF5F5070E3A2A528D15FA976F4A
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://cdn-2.reisekostenabrechnung.com/ HTTP 301
https://www.reisekostenabrechnung.com/ Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

350
Requests

100 %
HTTPS

52 %
IPv6

29
Domains

52
Subdomains

39
IPs

5
Countries

2884 kB
Transfer

7679 kB
Size

19
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://www.verpflegungsmehraufwand.de/
Title: verpflegungsmehraufwand.de

Search URL Search Domain Scan URL

URL: https://www.ezoic.com/what-is-ezoic/

Search URL Search Domain Scan URL

URL: https://www.mein-deal.com/mckinley-trekkingrucksack-make/
Title: McKinley Trekkingrucksack Make 75 + 10 für 68,94€ (statt 85€)

Search URL Search Domain Scan URL

URL: https://www.mein-deal.com/koffer-direkt-halloween/
Title: Koffer Direkt mit 20% extra Rabatt im Sale + 5% bei Vorkasse

Search URL Search Domain Scan URL

URL: https://www.mein-deal.com/gewandhaus-dresden-travelcircus/
Title: Dresden: 2 ÜN im 5* Luxushotel Gewandhaus (Holidaycheck 100%) inkl. Frühstück und Dinner ab 130€ p.P.

Search URL Search Domain Scan URL

URL: https://www.mein-deal.com/taunus-therme-uebernachtung-im-4-sterne-hotel-mit-fruehstueck-ab-59e-p-p/
Title: Taunus Therme + ÜN in Hotel nach Wahl inkl. Frühstück & mehr ab 54€ p.P.

Search URL Search Domain Scan URL

URL: https://www.mein-deal.com/
Title: Die Schnäppchen werden Ihnen präsentiert in Partnerschaft mit mein-deal.com

Search URL Search Domain Scan URL

URL: http://www.optimieren.com/
Title: optimieren.com

Search URL Search Domain Scan URL

URL: https://www.bodenrichtwert.de/
Title: www.bodenrichtwert.de

Search URL Search Domain Scan URL

URL: https://www.vorwahl-online.de/
Title: www.vorwahl-online.de

Search URL Search Domain Scan URL

URL: https://www.erwerbsminderungsrente.de/
Title: www.erwerbsminderungsrente.de

Search URL Search Domain Scan URL

URL: https://www.grundstueckspreise.net/
Title: www.grundstueckspreise.net

Search URL Search Domain Scan URL

URL: http://www.optimieren.com/datenschutz.php?domain=reisekostenabrechnung.com&s=true
Title: Datenschutz

Search URL Search Domain Scan URL

URL: http://www.optimieren.com/impressum.php?domain=reisekostenabrechnung.com&s=true
Title: Impressum

Search URL Search Domain Scan URL

URL: https://g.ezoic.net/privacy/www.reisekostenabrechnung.com
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cdn-2.reisekostenabrechnung.com/ HTTP 301
https://www.reisekostenabrechnung.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 146

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1&C=1

Request Chain 147

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YFJ1tpglDO4yMV6sKhW0OAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1

Request Chain 148

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEHKtBlqDTVpv9xTLnguCd-4&google_cver=1

Request Chain 149

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3ODIxNDk4MzE0OTI1ODMxNw%3D%3D

Request Chain 154

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1&C=1

Request Chain 155

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YFJ1tpglDO4yMV6sKhW0PwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1

Request Chain 156

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEHKtBlqDTVpv9xTLnguCd-4&google_cver=1

Request Chain 157

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3ODIxNDk4MzE0OTI1ODMxNw%3D%3D

Request Chain 158

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1&C=1

Request Chain 159

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YFJ1tpglDO4yMV6sKhW0PwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1

Request Chain 160

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEHKtBlqDTVpv9xTLnguCd-4&google_cver=1

Request Chain 161

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3ODIxNDk4MzE0OTI1ODMxNw%3D%3D

Request Chain 197

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1&google_push=AQvitUIIFPv-zFMaAe6ykAsb8B0h5nzv5AuBs3aDq4Oz-14_R1qa9C88Ib98RpsRat2HKB52Eci7MRbExc5HRP-GbHiyFlOWjzYt HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzQ5Njk5OTg3MjY4MzA1OTMyNw== HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1

Request Chain 199

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUJNxa8Hxql5SiRHepzsFKFBzz_2h98QhDm8Q__1_Yr-114-SjrVQj76qzm4F9-MKHbfbMrf7CwDdRkHvUhxvv3DkTPvcA8L HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUJNxa8Hxql5SiRHepzsFKFBzz_2h98QhDm8Q__1_Yr-114-SjrVQj76qzm4F9-MKHbfbMrf7CwDdRkHvUhxvv3DkTPvcA8L HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUJNxa8Hxql5SiRHepzsFKFBzz_2h98QhDm8Q__1_Yr-114-SjrVQj76qzm4F9-MKHbfbMrf7CwDdRkHvUhxvv3DkTPvcA8L

Request Chain 200

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEDeuKqu6wPNHWf8gYwfMw80&google_cver=1&google_push=AQvitUJK2Q7QhkxnVpM9KPZFqL2M6sgDGJol-gKglnAaZUS0AoJGm1PLoKnnaDlMrEq1c7CUCuKcP_2FexX3Wz_CohhvTUDqp-4 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUJK2Q7QhkxnVpM9KPZFqL2M6sgDGJol-gKglnAaZUS0AoJGm1PLoKnnaDlMrEq1c7CUCuKcP_2FexX3Wz_CohhvTUDqp-4&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw

Request Chain 201

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGyTJw_NwO-27VhLNDQC5kI&google_cver=1&google_push=AQvitUKp85wJYAK-aRPwM3ilSLhSpXD_LYmI08nT2Y67__lIDFvT3QVL8u3iMRne6ObbQvEAxwS6UVdnZDfKwS3CQgGGc3pDyh-X HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEGyTJw_NwO-27VhLNDQC5kI&google_cver=1&google_push=AQvitUKp85wJYAK-aRPwM3ilSLhSpXD_LYmI08nT2Y67__lIDFvT3QVL8u3iMRne6ObbQvEAxwS6UVdnZDfKwS3CQgGGc3pDyh-X HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDc4MTM5NTg4NzM0Njg3ODc5NA&google_push=AQvitUKp85wJYAK-aRPwM3ilSLhSpXD_LYmI08nT2Y67__lIDFvT3QVL8u3iMRne6ObbQvEAxwS6UVdnZDfKwS3CQgGGc3pDyh-X

Request Chain 208

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1&google_push=AQvitUK5524PQ0MUFL70YS48lIZ61jmvAq5FEZUEtExtYWd_xp72aSwxiLxFSJEI_a93MNtRqFR6QLxIutpQNyCA-T8cMttCbg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzQ5Njk5OTg3MjY4MzA1OTMyNw== HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1

Request Chain 209

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGrbieRq_6tOzV0mUDDvWHk&google_cver=1&google_push=AQvitUJdRDlejVcHb01NcQfUDpO9pbcC-n7tBRz11kNuO6smuAOdsVSRrhIaX0tZKoB-OJXMcbfVZt6AhBDtr6UdkMAa0gCVweo HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AQvitUJdRDlejVcHb01NcQfUDpO9pbcC-n7tBRz11kNuO6smuAOdsVSRrhIaX0tZKoB-OJXMcbfVZt6AhBDtr6UdkMAa0gCVweo&google_hm=D6K3-ipeowN5PqE5rDQ-gA

Request Chain 210

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUKDZCwFNme81nLqqaP9j_RzHY4CnDIEkhVHw8sQCZpSXjn69AFtMhCjFYJu90_-gos0FklOS-iNL3SN0lV1cTz_LLrIlt4 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUKDZCwFNme81nLqqaP9j_RzHY4CnDIEkhVHw8sQCZpSXjn69AFtMhCjFYJu90_-gos0FklOS-iNL3SN0lV1cTz_LLrIlt4

Request Chain 211

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEDeuKqu6wPNHWf8gYwfMw80&google_cver=1&google_push=AQvitULEZYDZ5ZcJRPk9uEH3XE11qnrxymQqV1WS1D2Sia2qA0fW5g2kp8xsE8POWzq8qBe7KqVtHv2-deFTI5ezA86ZmMJsmyY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitULEZYDZ5ZcJRPk9uEH3XE11qnrxymQqV1WS1D2Sia2qA0fW5g2kp8xsE8POWzq8qBe7KqVtHv2-deFTI5ezA86ZmMJsmyY&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw

Request Chain 212

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGyTJw_NwO-27VhLNDQC5kI&google_cver=1&google_push=AQvitUKTw-zyGbYPwydCAVGihJQ4paDRvsFaTsFCFLnl8o0wONEYPqze02a4TNyG6J4kZ9jCJLo5w5P6OtcDqYNDdH1BooO9VA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMzI5MTkyODMwMjc2MzcxOA&google_push=AQvitUKTw-zyGbYPwydCAVGihJQ4paDRvsFaTsFCFLnl8o0wONEYPqze02a4TNyG6J4kZ9jCJLo5w5P6OtcDqYNDdH1BooO9VA

Request Chain 223

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1&google_push=AQvitUIy6rA4HdQQhvixf3cbuHbbH22yl1EdtSX0YFxcVVezwM9kalghDzjvuLQktRfp_A6YEp5emBerZV5BhbhMv-q2-jAA4P4 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzQ5Njk5OTg3MjY4MzA1OTMyNw== HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1

Request Chain 224

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGrbieRq_6tOzV0mUDDvWHk&google_cver=1&google_push=AQvitUJ5jyBQBvLOkcsJNHeBWGdbUlmHUJqWLBNc4FlFJxV079wj9IQnkZjN49dNHDUq4YMK9aCyDc1hKSD7S_4mkaeh_FxOhVg HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AQvitUJ5jyBQBvLOkcsJNHeBWGdbUlmHUJqWLBNc4FlFJxV079wj9IQnkZjN49dNHDUq4YMK9aCyDc1hKSD7S_4mkaeh_FxOhVg&google_hm=D6K3-ipeowN5PqE5rDQ-gA

Request Chain 225

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUKmFrL6HHUz4RPlACfLp1IpeKW-G71m6iPXuxEMO1B4JhKLxmdsdGAUkZrLXsEU0ym7k7R2_ivxwsNDf6uL8uZGEjAbaiJJ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUKmFrL6HHUz4RPlACfLp1IpeKW-G71m6iPXuxEMO1B4JhKLxmdsdGAUkZrLXsEU0ym7k7R2_ivxwsNDf6uL8uZGEjAbaiJJ

Request Chain 226

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEDeuKqu6wPNHWf8gYwfMw80&google_cver=1&google_push=AQvitUKIkaUrnCj78dgFEStYaL2WBWTO2YynKMEvUR2WDdW3hrZdWgH1DUgMBVLEgFsic7uMuziA0ZOkKGH4XGEtGl94MVb_eJM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUKIkaUrnCj78dgFEStYaL2WBWTO2YynKMEvUR2WDdW3hrZdWgH1DUgMBVLEgFsic7uMuziA0ZOkKGH4XGEtGl94MVb_eJM&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw

Request Chain 227

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGyTJw_NwO-27VhLNDQC5kI&google_cver=1&google_push=AQvitUIu-tKfJsWCH6wlmY271LzIYNyX1px6HbdmDSy3drjwkVFz_TLhDD2t5AtZ7U_7iZ7fZkFBbmqOP2jvV8U-WleYdHzFNrbD HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDc4MTM5NTg4NzM0Njg3ODc5NA&google_push=AQvitUIu-tKfJsWCH6wlmY271LzIYNyX1px6HbdmDSy3drjwkVFz_TLhDD2t5AtZ7U_7iZ7fZkFBbmqOP2jvV8U-WleYdHzFNrbD

Request Chain 291

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBtUYYUjEF6qEWMDERCK1bw&google_cver=1 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEBtUYYUjEF6qEWMDERCK1bw&google_cver=1

Request Chain 292

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTc1Yjc5NmEtYjdiNS0yYWJjLWM1OTgtZDgyNGYxODM4OTFj

Request Chain 293

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_sc&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEAOwzymzzIb88OkdPwAGLIU&google_cver=1

Request Chain 294

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YzhjNjVhZWMtMGM2YS00MDNiLWI0NjEtOTBkN2Y0MzlmODg4

Request Chain 310

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1&google_push=AQvitUKcFE8GiIdPElLGhf3PnFJ2qMrO4aG6zv98mKlxYKLnO2bOYNhnVQl54jDTMsaaIzq6ycxYHrehK6lOyPvPMNuYgNecpt8P HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzQ5Njk5OTg3MjY4MzA1OTMyNw== HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1

Request Chain 311

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGrbieRq_6tOzV0mUDDvWHk&google_cver=1&google_push=AQvitULh3pO3e2c7GWJKsHXQ9bemM4Pj9odwvbUE3n28e_yFsVPtLQLOFfm1H5hbQPItGtddwgu8D_pJjtlATZS3XvFLjaCiOlU HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AQvitULh3pO3e2c7GWJKsHXQ9bemM4Pj9odwvbUE3n28e_yFsVPtLQLOFfm1H5hbQPItGtddwgu8D_pJjtlATZS3XvFLjaCiOlU&google_hm=D6K3-ipeowN5PqE5rDQ-gA

Request Chain 312

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitULN1ERVspYVQyldMZZgGmtF0Jn1G8LZrHNTCwLpxYVzMVC5TkRfbVWPcqXZb_1yo5ap-KvtpWZ5qVBYIyP5o0s5DP_gApzR HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitULN1ERVspYVQyldMZZgGmtF0Jn1G8LZrHNTCwLpxYVzMVC5TkRfbVWPcqXZb_1yo5ap-KvtpWZ5qVBYIyP5o0s5DP_gApzR

Request Chain 313

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEDeuKqu6wPNHWf8gYwfMw80&google_cver=1&google_push=AQvitUIBElLN4tTcykedrwVPQ52AV-i5aC6uGhT9_u8a8NU6QblvPfcfFLSGSuwXyi8ISmA4kYocQoOjnPX4nkY9LEi5BblJgfyB HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUIBElLN4tTcykedrwVPQ52AV-i5aC6uGhT9_u8a8NU6QblvPfcfFLSGSuwXyi8ISmA4kYocQoOjnPX4nkY9LEi5BblJgfyB&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw

Request Chain 314

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGyTJw_NwO-27VhLNDQC5kI&google_cver=1&google_push=AQvitUJQNONfHzZQYLGgZ0OnDq8V66h155Zv4HEpbAHWNWZ75rvHvGU2W5SgIzZ1N2GcKfxZc_KT6ZlA9fzkVzxjrn69kGrDQeSq HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDc4MTM5NTg4NzM0Njg3ODc5NA&google_push=AQvitUJQNONfHzZQYLGgZ0OnDq8V66h155Zv4HEpbAHWNWZ75rvHvGU2W5SgIzZ1N2GcKfxZc_KT6ZlA9fzkVzxjrn69kGrDQeSq

Request Chain 341

https://ad.doubleclick.net/activity;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;ord=1%7Chttps://ad.doubleclick.net/activity;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;ord=1?cbust=1616016824946227 HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CM_BueajuO8CFVD57Qodw6QLZg;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;ord=1%7Chttps://ad.doubleclick.net/activity;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;ord=1?cbust=1616016824946227 HTTP 302
https://adservice.google.com/ddm/fls/z/dc_pre=CM_BueajuO8CFVD57Qodw6QLZg;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;ord=1%7Chttps://ad.doubleclick.net/activity;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;ord=1?cbust=1616016824946227

Request Chain 342

https://ad.doubleclick.net/ddm/activity/src=1295336;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_50_59%5D;u9=%5BBUCKET_60_69%5D;u10=%5BBUCKET_70_79%5D;u11=%5BBUCKET_80_89%5D;u12=%5BBUCKET_90_99%5D;u13=%5BBUCKET_100%5D;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;u17=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1%7Chttps://ad.doubleclick.net/ddm/activity/src=1295336;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_50_59%5D;u9=%5BBUCKET_60_69%5D;u10=%5BBUCKET_70_79%5D;u11=%5BBUCKET_80_89%5D;u12=%5BBUCKET_90_99%5D;u13=%5BBUCKET_100%5D;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;u17=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1?cbust=1616016824947945 HTTP 302
https://ad.doubleclick.net/ddm/activity/src=1295336;dc_pre=CODtueajuO8CFdVUGAod1U4E-w;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_50_59%5D;u9=%5BBUCKET_60_69%5D;u10=%5BBUCKET_70_79%5D;u11=%5BBUCKET_80_89%5D;u12=%5BBUCKET_90_99%5D;u13=%5BBUCKET_100%5D;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;u17=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1%7Chttps://ad.doubleclick.net/ddm/activity/src=1295336;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_50_59%5D;u9=%5BBUCKET_60_69%5D;u10=%5BBUCKET_70_79%5D;u11=%5BBUCKET_80_89%5D;u12=%5BBUCKET_90_99%5D;u13=%5BBUCKET_100%5D;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;u17=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1?cbust=1616016824947945 HTTP 302
https://adservice.google.com/ddm/fls/z/src=1295336;dc_pre=CODtueajuO8CFdVUGAod1U4E-w;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_50_59%5D;u9=%5BBUCKET_60_69%5D;u10=%5BBUCKET_70_79%5D;u11=%5BBUCKET_80_89%5D;u12=%5BBUCKET_90_99%5D;u13=%5BBUCKET_100%5D;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;u17=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1%7Chttps://ad.doubleclick.net/ddm/activity/src=1295336;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_50_59%5D;u9=%5BBUCKET_60_69%5D;u10=%5BBUCKET_70_79%5D;u11=%5BBUCKET_80_89%5D;u12=%5BBUCKET_90_99%5D;u13=%5BBUCKET_100%5D;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;u17=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1?cbust=1616016824947945

Request Chain 343

https://ad.doubleclick.net/activity;src=1295336;type=cs;cat=Viewa0;u14=115845;u15=18330;u16=%5BDVP_ADID%5D;ord=1?&cbust=1616016825032833 HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CL_av-ajuO8CFaeB7QodgfsPgw;src=1295336;type=cs;cat=Viewa0;u14=115845;u15=18330;u16=%5BDVP_ADID%5D;ord=1?&cbust=1616016825032833 HTTP 302
https://adservice.google.com/ddm/fls/z/dc_pre=CL_av-ajuO8CFaeB7QodgfsPgw;src=1295336;type=cs;cat=Viewa0;u14=115845;u15=18330;u16=%5BDVP_ADID%5D;ord=1?&cbust=1616016825032833

Request Chain 344

https://ad.doubleclick.net/ddm/activity/src=1295336;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_50_59%5D;u9=%5BBUCKET_60_69%5D;u10=%5BBUCKET_70_79%5D;u11=%5BBUCKET_80_89%5D;u12=%5BBUCKET_90_99%5D;u13=%5BBUCKET_100%5D;u14=115845;u15=18330;u16=%5BDVP_ADID%5D;u17=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1?%20&cbust=1616016825032392 HTTP 302
https://ad.doubleclick.net/ddm/activity/src=1295336;dc_pre=CMurvOajuO8CFVBDGAodM38ORA;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_50_59%5D;u9=%5BBUCKET_60_69%5D;u10=%5BBUCKET_70_79%5D;u11=%5BBUCKET_80_89%5D;u12=%5BBUCKET_90_99%5D;u13=%5BBUCKET_100%5D;u14=115845;u15=18330;u16=%5BDVP_ADID%5D;u17=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1?%20&cbust=1616016825032392 HTTP 302
https://adservice.google.com/ddm/fls/z/src=1295336;dc_pre=CMurvOajuO8CFVBDGAodM38ORA;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_50_59%5D;u9=%5BBUCKET_60_69%5D;u10=%5BBUCKET_70_79%5D;u11=%5BBUCKET_80_89%5D;u12=%5BBUCKET_90_99%5D;u13=%5BBUCKET_100%5D;u14=115845;u15=18330;u16=%5BDVP_ADID%5D;u17=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1?%20&cbust=1616016825032392

350 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.reisekostenabrechnung.com/
Redirect Chain

https://cdn-2.reisekostenabrechnung.com/
https://www.reisekostenabrechnung.com/

206 KB
50 KB

1055ms
1032ms

Document
text/html

2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.2.23
Resource Hash: d91678cb3cf4723b24515cabb0550878eed5dbd4f6ab8a022f6bceaa146bfb0a

Request headers

:method: GET
:authority: www.reisekostenabrechnung.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=d2f3cac2017ed715c0c1034c9a6e52ce91616016815
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-type: text/html; charset=UTF-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
display: pub_site_sol
expires: Tue, 16 Mar 2021 21:33:36 GMT
hummingbird-cache: Served
pagespeed: off
response: 200
set-cookie: ezoadgid_129856=-1; Path=/; Domain=reisekostenabrechnung.com; Expires=Wed, 17 Mar 2021 22:03:35 UTC ezoref_129856=; Path=/; Domain=reisekostenabrechnung.com; Expires=Wed, 17 Mar 2021 23:33:35 UTC ezoab_129856=mod38; Path=/; Domain=reisekostenabrechnung.com; Expires=Wed, 17 Mar 2021 23:33:35 UTC active_template::129856=pub_site.1616016815; Path=/; Domain=reisekostenabrechnung.com; Expires=Fri, 19 Mar 2021 21:33:35 UTC ezopvc_129856=1; Path=/; Domain=reisekostenabrechnung.com; Expires=Wed, 17 Mar 2021 22:03:36 UTC ezepvv=658; Path=/; Domain=reisekostenabrechnung.com; Expires=Thu, 18 Mar 2021 21:33:36 UTC ezovid_129856=982925079; Path=/; Domain=reisekostenabrechnung.com; Expires=Wed, 17 Mar 2021 22:03:36 UTC lp_129856=https://www.reisekostenabrechnung.com/; Path=/; Domain=reisekostenabrechnung.com; Expires=Wed, 17 Mar 2021 22:03:36 UTC ezovuuidtime_129856=1616016816; Path=/; Domain=reisekostenabrechnung.com; Expires=Fri, 19 Mar 2021 21:33:36 UTC ezovuuid_129856=f53b81e6-a373-4d85-6edf-8a6d3f365f59; Path=/; Domain=reisekostenabrechnung.com; Expires=Wed, 17 Mar 2021 22:03:36 UTC ezCMPCCS=false; Path=/; Domain=reisekostenabrechnung.com; Expires=Thu, 17 Mar 2022 21:33:36 GMT
vary: Accept-Encoding Accept-Encoding,Cookie
x-middleton-display: pub_site_sol
x-middleton-response: 200
x-powered-by: PHP/7.2.23
x-sol: pub_site
cf-cache-status: DYNAMIC
cf-request-id: 08e3b4cd8b0000dfbf36a76000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=wo%2FbxnJ6gguCkm2uD9C2p2nMkneFmGCdUp%2BbZ80ZihWAqbUHDi0KHE3YK1BvHkuhoLgT36Qc%2Fb%2FTQBxKw%2B0kxGzY4uBLbNwv%2BTkko%2BiLtk3U19JV7EVXmNG6PARdNGRgBb%2FXq5199nY8%2Fg%3D%3D"}]}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 63195728de36dfbf-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date: Wed, 17 Mar 2021 21:33:35 GMT
content-type: text/plain; charset=utf-8
content-length: 0
set-cookie: __cfduid=d2f3cac2017ed715c0c1034c9a6e52ce91616016815; expires=Fri, 16-Apr-21 21:33:35 GMT; path=/; domain=.reisekostenabrechnung.com; HttpOnly; SameSite=Lax
cache-control: max-age=300, private
location: https://www.reisekostenabrechnung.com/
vary: Accept-Encoding Accept-Encoding
x-middleton-display: redirect
cf-cache-status: DYNAMIC
cf-request-id: 08e3b4cbd900001f151e2f6000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NVkpscBTkHh8pmF%2BSsijl8LevzwqYT%2F2GlkVgatyOUc%2FbduZ5lSqvrVN936qRq6U5yyfOOqn5IHdnCEAzBbcf5iLCLIU8xMrubdOwGqNYmSnB1qjtv%2BW4fl0a9GctExxfN2ETIZngOhOTzCD"}],"max_age":604800,"group":"cf-nel"}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6319572628831f15-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 59 KB
20 KB 87ms
31ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

sffe /

Resource Hash

eba385c1782056501cdda10d5706441ab694be71c08db0a758160c6a16373171

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "815 / 949 of 1000 / last-modified: 1616009968"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19955
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:36 GMT

GET
H2 200 dall.js Show response
go.ezodn.com/hb/ 216 KB
64 KB 40ms
22ms Script
application/javascript 2606:4700:e4::ac40:a708
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/hb/dall.js?b=criteo,rhythmone,sovrn,spotx&cb=192-2-11
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a708 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c27672b63687b1eb6b73920b3b556f4774199f030787ce9c7507c5bb8b0cec89

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
server: cloudflare
age: 454893
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Gy9gkqXogTeXt%2Fv2tXn8DRpf05X9Ap3Br813ofduEcclUldPqAw0WRCOQDp68wj08tR56OFAdIFSL926WbIIj3hsMYCJtTGTWmxO5vyKHn1J6VF24FEIQ3I%3D"}]}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 6319572f7b924a9e-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1ab00004a9ef20a7000000001

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 119 KB
31 KB 118ms
55ms Script
application/javascript 13.226.158.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.158.204 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-158-204.dus51.r.cloudfront.net
Software: Server /
Resource Hash: 86cef609c85d2c2ce6a507af54e77a9c150e2fa408043e1454082614c4b0ce2b

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:29:36 GMT
content-encoding: gzip
server: Server
age: 239
etag: d2bbe61d6c9cfd2f9d26c66417c4fb1e
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 4ba9d3779ca8afc198240a34dffb07c4.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-version-id: qpGbqo5n5ftYm2ZsSSwwmAxZeGfbwfiX
x-amz-cf-id: gdle9tg16CXdVf6AvziWFsE0Ft4T_g-Ke6Sb_n66a9vmSvIhoaqmTw==

GET
H2 200 ab9510f7ebc0b73c4303dcda114236c2.css
www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/ 70 KB
13 KB 17ms
16ms Stylesheet
text/css 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/ab9510f7ebc0b73c4303dcda114236c2.css
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d4541768d977bafc2a0a4215e5dbeeee0b39965aeb2fc8b2a3ac6e7b42a25c26

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
cf-cache-status: HIT
x-sol: orig
age: 391630
cf-polished: origSize=71741
x-ezoic-cdn: Hit ds;dd;2c879efce04e78a2b1b333cbdfd13672;2-129856-0;091e4c97-d0e4-495f-4f16-e2d2f7db49dd
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d19e0000dfbfaa39b000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"1183d-5b3fb68c2f4e6-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=R61vOMR2UesqIPA63%2BA3u0P83Pa4SMrwZKju8yLpC%2B4EY5OnCSabQL63%2F48ZIplazcnC9Hz1CVr6qyqiJMQ%2BRmXhEP%2BiVSLSonx1ssaw7AYbTn6JINnkKEV0gu9uv9Mx%2BA1yXPi68cYQPA%3D%3D"}]}
content-type: text/css
cache-control: max-age=691200
cf-ray: 6319572f5f22dfbf-FRA
display: staticcontent_sol, orig_site_sol
cf-bgj: minify

GET
H2 200 0336a730e58c21a73c87a71d152c6ec3.js Show response
www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/ 95 KB
33 KB 19ms
19ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/0336a730e58c21a73c87a71d152c6ec3.js
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 34ef40de06f89a7924f26fdbafd35352f7fa67a8c5eb8840fdb6eeafb818240e

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 391630
cf-polished: origSize=97571
x-ezoic-cdn: Hit ds;dd;17e0b55b61615e031c31240552f70d48;2-129856-0;65d47d72-5591-4644-73d7-d2bc848adc4e
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d19b0000dfbf7f901000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"17d23-5b3fb68f68819-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NT0Q7VsIBAQ%2FN%2B4wzzE0wJRb%2BpuiaY3aT9aqnw5aRn5ZpkbMAgC30Cm27V%2Beiw8U%2BDUL%2FJttSkqUuHcmj694sYJS7avHCkQUTtWrewmcU2rG4yGZ1JfdjERX0by4aQ4NcHRsdggfTDhPrQ%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=691200
cf-ray: 6319572f5f24dfbf-FRA
display: staticcontent_sol, staticcontent_sol
cf-bgj: minify

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 97 KB
38 KB 27ms
19ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-2827868-10

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b8b87c1a60107eec4cf6709a8a97371d34bf36e645f9421963f79def462191fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39083
x-xss-protection: 0
last-modified: Wed, 17 Mar 2021 21:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 17 Mar 2021 21:33:36 GMT

GET
H2 200 boise.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 983 B
754 B 18ms
10ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/boise.js?gcb=192-2&cb=1
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41eb9054d5d5527274926b32631be8eb22dd6254f15a4d9d14cfe2688ea4f538

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3517428
cf-ray: 6319572faf9ddfbf-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c40000dfbf36ab5000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3rsng4vnMejfPERZbVJw2HK0qr8PzrjY1dEYZnlTChuIJzxNutftETTyty04aTxD5FJyMhJF70ChqZZB3TV6zh2i7TBQduWC0hjvbzPe2aVdnEmRHVn6m%2FFpnORfkJBI%2FLVIh4FTMliJrQ%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 banger.js Show response
www.reisekostenabrechnung.com/porpoiseant/ 50 KB
11 KB 32ms
24ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/banger.js?cb=192-2&bv=13&v=46&PageSpeed=off
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85aef15e15535a3497f55f748129fd2744772229e00a72eff6d2b5aaca4f0fb1

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 664553
cf-polished: origSize=51253
cf-ray: 6319572faf9edfbf-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c50000dfbf8699a000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UnRHPW4qFLMaOG7W1aY2%2Fkk8xJhR8iSh%2FtMkvbOazY4u%2BsystWnYHgcMRRT51HwBPgmigjqNhfzr8Hfe9vdsO7beDE1NFCvZ8WnHCQ6UxO9vtKomrsNpwJE9n%2Ff5ajGtrhsA48%2BuwNPOVA%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 memphis.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 5 KB
2 KB 21ms
14ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b68431bd479f66f60cca8fef9520547c0f28390680174d8b36c5591085e8393

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 492622
cf-ray: 6319572faf9fdfbf-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c50000dfbfa78ef000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=TWZInFVRtJbrbDm5WRaTu%2FBgkTNKrpLfytT78Dyd3EEecHJhx%2BnVI%2Fd7GTvxN34xowFazIk7jMb2ecC6O3qIFAM9c1ArZ4oqfWrCJgGsslsiI%2BQsVfAvvko4WkSUAajp8oie%2FPj2fGIo0g%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 minneapolis.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 864 B
728 B 19ms
12ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/minneapolis.js?gcb=192-2&cb=3
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5578a62b81f315375d072cfe506fc13813e844f94c910bdb15ce20e1fc3ef50a

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2995437
cf-ray: 6319572fafa0dfbf-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c50000dfbf79306000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=wunFlPhB%2Bu6XsNMZssucq9j0D0NKoRhzHoY8KnvZO2Vbx%2B7%2FmOtXU9rvFkPXKjYXbESGcwvN4CMj2dwum7VKDoEOP1s%2FoB2Uez4kG1aPjioz1gROGav2X9NMKU8G%2FUt%2B42vXkQuoPKR27g%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 raleigh.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 2 KB
1 KB 20ms
13ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/raleigh.js?gcb=192-2&cb=5
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f69dfe383fe0ef66df2c8de098fda546a826801c150ec22e7e09b8020b221dae

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1793399
cf-ray: 6319572fafa1dfbf-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c50000dfbfaa39e000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=dZCzt3U8MHKx%2B4HT27AhBnJoGwaXfM4DuH6M1cNbkYcUURfspLZ15i9fn1Rivrvu8gQ%2Fozf5s8os5nkWSw%2BKNS%2Bj6yldoSvETFi9Au%2FXeegW41mJSbQ4kj4d40tZBCVXeZ%2FJQkPWd9fZ0g%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 tampa.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 773 B
886 B 20ms
13ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/tampa.js?gcb=192-2&cb=3
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c80203c7eae413cecc09a4ed0974e31a8538060cddd5bc1f1a5bfa53db672c9e

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2553934
cf-ray: 6319572fafa3dfbf-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c50000dfbf8a8cb000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=b7ljdq%2FLI4I%2Bf1jhJwVKphGciHcLVckBWbnI6MAh724NLbWJSieYa6WY06MvVn2tyCRrhmsv4AE0u3vJXHiZ2Yo%2FVGeH96k59Ranfz%2BH4qSnnunZS7ij%2FFKjwLPQLxF9esy1Qc4QeZQeKw%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 kilometerpauschale-kilometergeld-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2013/07/ 6 KB
7 KB 28ms
22ms Image
image/jpeg 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2013/07/kilometerpauschale-kilometergeld-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bab158f2b326e9f2db0ee25f682afbe01ec4835c26564e68950d4170180cd80b

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 477546
x-ezoic-cdn: Hit ds;dd;2b35c6d762e86e0808c16bc7372ef064;2-129856-0;dcb830f2-49ef-4e78-6baf-a4da912a9fa5
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c60000dfbfa6825000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"1998-5852444940df0-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HH4%2Fu%2BezXkKaqMZgaNbtnnAWYjiTWnL9qneGenNbeBrd3tCvQ0jBR15kqclRrLi5nrH%2BngWMLSeU%2FZaYU3zeadayfvxgoF2Jwm0iqLD36ptznFdkJjPIzhu0ihT%2BBDqQ08GdSTygGkhlpA%3D%3D"}]}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 6319572fafa4dfbf-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 verpflegungsmehraufwand-2020-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/11/ 3 KB
3 KB 30ms
23ms Image
image/jpeg 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/11/verpflegungsmehraufwand-2020-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e9591f064ab3cd667a6d281a2566b45b0636e9da33108e0257c53bd3f5cda455

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 391630
x-ezoic-cdn: Hit ds;dm;5732b09c774bd9042f240d91405f8962;2-129856-0;9b25c575-d94a-4084-7111-d63b440bfadd
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c60000dfbf5b002000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"be0-5989622b23da7-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=D%2FmHAfhUOSIBrztwF68JzEZ25VshQYquOpBY4XrD%2BSo7DGKaJ4beN2kjGZSUunfWDiI279kio2%2FbEribV1ySoO96z2kL5UufyW8PmFFXJKrawdTBuT8oUz%2B9OD%2BCyAsHJmssWOQhKkpK0w%3D%3D"}]}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 6319572fafa5dfbf-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 reisezeit-arbeitszeit-arbeitsrecht-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/04/ 6 KB
7 KB 29ms
23ms Image
image/jpeg 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/04/reisezeit-arbeitszeit-arbeitsrecht-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 322b1e4ed7c507891b57e9f2de050bbf9e13d3b43a32164f81bd74e1cfe41748

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 477546
x-ezoic-cdn: Hit ds;dm;f72e7e9f24402c64b7981aff2ba56d69;2-129856-0;8a8e3e50-cd77-43dc-5e76-0f275dd71933
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c60000dfbfbea84000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"1893-5861d0e8bc838-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=SEhF3WBriMyeFJDkz7vVieiElUquRWjWcQnzm4ht3RQtyKEwGrtEVo%2FKomCamCMcGMf8cgORG9MHJlp%2F7jGr1s7pm6kaK3XzFg3YgHfMru19akHxI16AsPloGXpn8Dmhq1ZWjckdrVv%2BAA%3D%3D"}]}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 6319572fafa6dfbf-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 verpflegungsmehraufwand-20181.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2017/12/ 23 KB
24 KB 38ms
32ms Image
image/jpeg 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2017/12/verpflegungsmehraufwand-20181.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d17b84f0cbd97c80fcfee28f36b7a4122035195ecbfbaba9ce6d54ba414dbad3

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 306969
x-ezoic-cdn: Miss
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c60000dfbf2eb63000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"5cb4-586c9c8cfa68c-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=0prPln%2B%2BzT0WrRDmCAwro6jQYIWEytSBlfbJVOXQqTHksf%2BLxtuYgymim4hXXJu4aYUdJ9pC8IH7SoWfCt3eD27eYGJS0K%2BKfnu8zihkCPsI3TurUYl5AI790hWNuZQmqOCT8j8LwmtAdQ%3D%3D"}]}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 6319572fafa8dfbf-FRA
display: staticcontent_sol, staticcontent_sol
expires: Mon, 14 Mar 2022 08:17:27 GMT

GET
H2 200 Verpflegungsmehraufwand-2019-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2018/12/ 7 KB
7 KB 20ms
14ms Image
image/jpeg 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2018/12/Verpflegungsmehraufwand-2019-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 68984aa0e0192c05e3385c29a8e60cc4a1c37a9273ce62503006a85e09e92246

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 473543
x-ezoic-cdn: Hit ds;mm;28f1616bfbb019102ae26ae1e8d24fff;2-129856-0;a74722ac-7932-4716-5450-4391e04413d5
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c60000dfbf6a307000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"1aa1-584e7848e52f0-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=rpfluXkIxg%2FEJ0GSqTbLq71GUWL7Dm9aYdF55P2iVl%2FNTNmDlvE3rAayYujv4XHAhRBJ9nKJlqepWiVX0oY4WpWvug69kEKOLfJO%2B0PqMH96NQvDyCJk5tJZIswU9jsPWuL3Yepd9zuP6A%3D%3D"}]}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 6319572fafabdfbf-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 verpflegungsmehraufwand-2020.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/11/ 22 KB
23 KB 26ms
20ms Image
image/jpeg 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/11/verpflegungsmehraufwand-2020.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f087bb8341880a9a60af996272030bf86504927f2f64b62da3a53389211cbfd

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 215484
x-ezoic-cdn: Hit ds;mm;d837adea95f420caddf69b3709ddad94;2-129856-0;f66950c2-eded-4163-653a-8b17015a7642
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c70000dfbfe4339000000001
response: 200
last-modified: Fri, 12 Mar 2021 17:56:24 GMT
server: cloudflare
etag: W/"5839-5989622750d83-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=u9FN19HDJqpuPwU8h5K%2Fspj%2BoSV9dMKdmsqXbSK3F%2ByCI6wV2P9zipP5JrghJffVfTOpjOftlctRdB%2B27G23l%2Fq9p69pJpamDrF6XCBWoX0K9vgmdDewwawxlMTsEgp%2FKsleWFq881lzAg%3D%3D"}]}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 6319572fafacdfbf-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 wichtige-auslandsvorwahlen.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/06/ 21 KB
22 KB 28ms
22ms Image
image/jpeg 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/06/wichtige-auslandsvorwahlen.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11ca2b97c357478751eaf975d488b2bb3fe244e18a570e122ee239f27890aec1

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 391630
x-ezoic-cdn: Hit ds;mm;ded5203141a54e589790f0d4e92ac770;2-129856-0;d8183be7-5802-46b0-7275-f52bb2290999
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c70000dfbffca08000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"5496-58c37ebadc08d-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=x0FEKkBy4wdF0tZn5PPjOnlLDxwsIyOo9aNU1RfFoUXJyX3H2KNy4%2F7FrR8lnCM4ttWgFnFcKkZk%2FKGGTc7Q38IlGXmC9qGrVoArHf9SGTLwuLWFgxpxU1E8I6UpBKLIL%2FXlSipFNB4pPw%3D%3D"}]}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 6319572fafafdfbf-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 10-tipps-gegen-flugangst.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/04/ 132 KB
132 KB 19ms
13ms Image
image/jpeg 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/04/10-tipps-gegen-flugangst.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b73436f7c44562199d88eacfdaee95d10c34e3cbf03c77756653e4b9447d142

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 391630
x-ezoic-cdn: Hit ds;dd;2b956f56879235c454ef4eaa72b23d1c;2-129856-0;4be72e78-7c22-476d-58f4-c10fe51a9fd8
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c70000dfbf3b1a8000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"20e8b-5872ddb7579b9-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=mNpvWoZvZogzTuy7VRJZERLgChIICsRwhFrwICAtppMm8pKI%2FSn4R6AieeI6Orpu8ENw6edToi9pLKYVf%2FXnoJnWu0EMffPbgvkKIJE4sDMYCxr4EKdciOu4A%2Bz62ajIyzwGCIbjUJuoLA%3D%3D"}]}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 6319572fafb0dfbf-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 gegen-jet-lag.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/04/ 47 KB
48 KB 33ms
28ms Image
image/jpeg 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/04/gegen-jet-lag.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c7246a30f947138add9e8a4f08af29a2bbe677690075ec238eb87f02ca9fc2f

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 404768
x-ezoic-cdn: Hit ds;mm;76d601e9cd1e5555d8604299211c68b5;2-129856-0;9710fdbe-cb53-43f8-48f8-e3bb1c763b83
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c70000dfbf13ae6000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"bcd9-5872d84f9cb14-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=d3zBs26RvxxDRSBzbnRtfjc7laiMjaSjFvpJBs2K8uDUsojiY8%2Bgl6MEKjmX0z4hdKoE7N%2FYV3m%2Bmx8kN20yiXkqCVOi3c1K7%2BQJvrntOFbA7PJiY6JYi0FcvUPTGF3Te8%2BZno31agYVMw%3D%3D"}]}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 6319572fafb1dfbf-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 reisezeit-arbeitszeit-arbeitsrecht-600x300.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/04/ 31 KB
32 KB 25ms
21ms Image
image/jpeg 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/04/reisezeit-arbeitszeit-arbeitsrecht-600x300.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cc470a93cb0f84356b1f95b20e67560edef307fb653294bdf7f050460b8ffabb

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 391630
x-ezoic-cdn: Hit ds;mm;85e1d153aa3302b02ce2ba1dadfa9d88;2-129856-0;7cac4395-1f4e-45e1-798b-0e4b04269e8b
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c80000dfbf6294e000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"7d93-5861d7069feba-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=JikpP1CisymhcRXx62mbwYzuAwh%2BaH6yHz2gpIwUlVtPKC13zc22Xm8DaAFHg6GTGCPQaKNPUzz1cKoYNdlpZFs0ZstKDvhyoZ2d1Dt80v%2B1O29GeAJmL%2F13U26krf10yBd21gbg7E4xZw%3D%3D"}]}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 6319572fafb3dfbf-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 parkgebuehr-steuer-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2020/02/ 5 KB
6 KB 33ms
28ms Image
image/jpeg 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2020/02/parkgebuehr-steuer-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22abd45f1c986bcef595abde9c04687cbf9e0aaba50cae7ed74adf43a60e48cd

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 480188
x-ezoic-cdn: Hit ds;mm;3efc99ee46927a30436a2c58b1a3febc;2-129856-0;18f1ca47-6b62-4b2d-721c-6fd6f78b791c
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c80000dfbf991e5000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"1529-59ed7db864bbd-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=cWm6IKuSU5NUJaKUBHPYs9FA18GAotAcKARIndbZ4uI8phK4VfYrGzMw90YhJ8ZQeXf%2BLuDfOFfOdcXiDe3%2BzZrenpHpewIIyHTvG9IEvoLvg2B5otqJR9ZOczjZnZnDp8sFKr88E5NwJA%3D%3D"}]}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 6319572fafb4dfbf-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 geschaeftsreise-usa-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2020/02/ 5 KB
5 KB 28ms
24ms Image
image/jpeg 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2020/02/geschaeftsreise-usa-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bc4a532d1cc0e0681799df7243d94d96e3949e93d6951765e738c2e455ba5738

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 391630
x-ezoic-cdn: Hit ds;mm;d4ccac5b1c48a209dc3e3160f8fd6f36;2-129856-0;d8700c10-7b0a-4ce3-6bf8-d598d2d37a42
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c80000dfbf3f36c000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"12d9-59dedd0be0dd1-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=X3HcvG8DF%2BRG5bHr8PgeA24yc18wG%2Fqk5W4VDZr%2B5rj9DuLEOy3BNK1KAoI9bVKDx3wZQHAqFQ14PAm9IQQzf7IintReqedE5SQQLWF06cKaP%2FZO2wFEznUNH2KUpKFXrFsuQIL5Nqu31Q%3D%3D"}]}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 6319572fafb5dfbf-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 schutz-geschaeftsreisen-richtige-versicherung-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/09/ 5 KB
6 KB 26ms
22ms Image
image/jpeg 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/09/schutz-geschaeftsreisen-richtige-versicherung-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 977e2a7ebfdf57c55274f6a1191eefdf637e4055e05d38386de41281209f993a

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 225891
x-ezoic-cdn: Hit ds;mm;0edcaf6e0d47e47629a91311734e6dc0;2-129856-0;662d1f01-39a3-493d-4375-c5999e39064d
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c80000dfbf6e246000000001
response: 200
last-modified: Fri, 12 Mar 2021 17:56:24 GMT
server: cloudflare
etag: W/"1521-591a3e6d9c2a6-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=yj7LJa7tZghfNyPPkaZ4Bj6w22VBCjKejlI2zPsOuw8%2F2JAt%2Fjf8O4d5EK%2BaOliDF59vl7DPxbYzFgGeuM%2BIFDVCCjPml1ni%2BKgN2LF%2FCQqHraQd91BlXjbXKQbKuQwP1OcKXohIX9aeQw%3D%3D"}]}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 6319572fafb6dfbf-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 wichtige-auslandsvorwahlen-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/06/ 6 KB
6 KB 27ms
23ms Image
image/jpeg 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/06/wichtige-auslandsvorwahlen-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b598f6b8e6244f2ba676cc0f9fa2749ac3e7b9b04ef153df6770145bd593b66

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 388274
x-ezoic-cdn: Hit ds;mm;ca03750475cf1427e69c7bd43c322f0d;2-129856-0;4150518c-e4b2-42f2-6853-b7c0f6123c0c
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1cb0000dfbf551e1000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"17a7-58c37ebc196b3-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=OzFnQ8RWTXtv4KxDgtjqgZq0t7HItNFIuwSj4kCTvWWUzXCULCGxlpANjKzM9ro4bEn3XU1ilBbaAFHqVTZcWY%2Fm5QuaCsDg%2BvepQ9hwBagpbBQ%2FQZXt6ZcAY8Z0cpP22oTOfYO3OBYMWg%3D%3D"}]}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 6319572fafb8dfbf-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 ezoic.png
go.ezoic.net/utilcave_com/img/ 1 KB
2 KB 44ms
8ms Image
image/png 2600:9000:2182:1600:2:cb38:840:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://go.ezoic.net/utilcave_com/img/ezoic.png
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2182:1600:2:cb38:840:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 14 Mar 2021 02:36:22 GMT
via: 1.1 77d8cf253666facea1bbe67902fcbbc1.cloudfront.net (CloudFront)
x-sol: middleton
age: 327434
x-cache: Hit from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
content-length: 1181
x-amz-cf-id: sLF1UibpDWCyKFS4bcqY-tj_BRo5_ZCA3vDg4wqAPtgn1V7NZbkWfQ==
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: nginx/1.16.0
etag: "49d-5ac9ecc7b5bc0-gzip-gzip"
vary: Accept-Encoding,Accept-Encoding
content-type: image/png
cache-control: max-age=604800
x-amz-cf-pop: DUS51-C1
display: staticcontent_sol, staticcontent_sol
expires: Sun, 21 Mar 2021 02:36:22 GMT

GET
H2 200 b53f34c75ed223f448abdd796c3eb906.css
www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/ 80 KB
15 KB 30ms
22ms Stylesheet
text/css 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/b53f34c75ed223f448abdd796c3eb906.css
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d269f9bebbbe631349351d50b4696ff0d94649dbb03889b769687d0290dd12bf

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
cf-cache-status: HIT
x-sol: orig
age: 220016
cf-polished: origSize=82363
x-ezoic-cdn: Hit ds;dd;3106b3e503c7b9e7fe20130c4341d5ea;2-129856-0;3aef42df-e99e-4bcd-675d-61f9d58a4fad
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c40000dfbf159a6000000001
response: 200
last-modified: Fri, 12 Mar 2021 17:56:24 GMT
server: cloudflare
etag: W/"141bb-5b3fb691337e4-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=vy3EwCLef4dvN%2BXp72g0SwsBODrQZjqPuI7jIEl7lSwgJsR%2BqECb0fmZQ5vGeHSxDx9wVwVNWuBDFmkqFWZJ%2ByxxAzNMbO9ZyktsyrpYQAerTbZiQW2JvTjcYA2SZNcJBM9s5V009jk3fA%3D%3D"}]}
content-type: text/css
cache-control: max-age=691200
cf-ray: 6319572f9f98dfbf-FRA
display: staticcontent_sol, orig_site_sol
cf-bgj: minify

GET
H2 200 33e05ca2d380d27d6dfb8c8dd0e41e01.js Show response
www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/ 64 KB
17 KB 31ms
23ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/33e05ca2d380d27d6dfb8c8dd0e41e01.js
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3ded49272000064adcec14280964aea6d2253f83ce9ae507f25e24721f3ec8ca

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 118846
cf-polished: origSize=65256
x-ezoic-cdn: Hit ds;dd;748726a908676bfc50b74932841b58d4;2-129856-0;098782b2-4b84-47b7-4158-918226b19655
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c40000dfbf493ee000000001
response: 200
last-modified: Fri, 12 Mar 2021 17:56:24 GMT
server: cloudflare
etag: W/"fee8-5b3fb7395d0de-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=h044v7p4rlIdyf8nYdMiowhNp1LuxPIvaP0uGB9N%2Fk4Q%2BVYcVUCbSUO73prkG2IaAc8QK7%2BQEx1NsOM28hshVc2eGQuLp0OwoU0tW22b0MPGZn9dlaA8GqaldVlrpsPPnvrw0OfFVCoIRg%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=691200
cf-ray: 6319572f9f9adfbf-FRA
display: staticcontent_sol, staticcontent_sol
cf-bgj: minify

GET
H2 200 augusta.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 1 KB
930 B 28ms
24ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/augusta.js?cb=9
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e965b21d6a23293b47f5deb510a49b0675f74ee2eeb6dc86c101c33ff921461c

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 167608
cf-ray: 6319572fafb9dfbf-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c90000dfbf29bbd000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=rbIktU%2F3ITLpRC4Qag6SzShEVd%2FcTne4jgWk6YlcgAvGIvplr4kh1ztMfE6zJSatcYMvulgS89rlYiPcapsLeTk%2BqlBB7Ap94lruO8G4mbugQoDSvrg8AJRcqE2Ixvxms%2BE0OWPb6izChA%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 altconsent.js Show response
ezodn.com/cmp/ 396 KB
93 KB 48ms
38ms Script
application/javascript 2606:4700:e4::ac40:a708
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ezodn.com/cmp/altconsent.js?v=8
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a708 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2b92530616ddbefbed0e825e094cd914f17ae899b42152f17028a0073f5eb62

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 02 Dec 2020 23:21:46 GMT
server: cloudflare
age: 595938
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=uYwyWvnXdX3suqo%2Btd27ADWE0Ho02IH5CRusjcKYFRNtRNNu%2FEz%2FxaBRQuoKOCuxCRy%2FVWkEtXIbIbMlltVB654h%2BWzPmBCqIkUb8slX53bNkjBGF9Q%3D"}]}
content-type: application/javascript
cache-control: public, max-age=604800
nel: {"max_age":604800,"report_to":"cf-nel"}
cf-ray: 6319572fabeb4a9e-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d1c600004a9ef4b39000000001

GET
H2 200 ezcl.webp Show response
www.reisekostenabrechnung.com/utilcave_com/inc/ 1 KB
961 B 28ms
25ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/utilcave_com/inc/ezcl.webp?cb=4
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c5ad2fd42dffdf04a0f1d757c1cccb4d840218d7ecada79d6cc9db33ca40319

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 10012
x-middleton-display: staticcontent_sol, staticcontent_sol
x-sol: middleton
cf-request-id: 08e3b4d1c90000dfbf04032000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=PPoSkGDmqJmuVxQYaTPbwOj%2FMYreYOnXxPwu6OxF6fMaqVA%2FuyZIoEd8%2FvLiU37yQYQwXqDNdcQwxG7jhYyrjWupn5WkIBmLh6C291mgRLYqpnsKJJBUt3CW3oT6UTGVxTR4BM%2Bqz%2BP1Bg%3D%3D"}]}
content-type: application/javascript
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=86400
cf-ray: 6319572fafbadfbf-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 default.png
www.reisekostenabrechnung.com/wp-content/plugins/shortcodes-ultimate/includes/images/swiper/ 1 KB
2 KB 12ms
11ms Image
image/png 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/plugins/shortcodes-ultimate/includes/images/swiper/default.png
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/b53f34c75ed223f448abdd796c3eb906.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2597098b7399a8cfcd439b9af387be361db498438b90fb788b1c07177b28b52

Request headers

Referer: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/b53f34c75ed223f448abdd796c3eb906.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 404768
x-ezoic-cdn: Hit ds;mm;5f974ef0f5b09d6e3afd800468abe601;2-129856-0;26ec0a3c-758f-44b5-6fcb-d38be6b26f1a
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1340
cf-request-id: 08e3b4d2720000dfbfb9132000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: "53c-5b3fb6766bfc4-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=YAjfgZlv2rKlETUju%2FSdIEp%2F62LFds7XjD7Wm2C08lY5ZRF%2FFWgpMNWm8DXx42usN0XdiRpNLX6zvJ9v4egfaOxuA%2BqXXII2u%2B9cEEmn5QlrGcV8kV3SS9QXrfpLplRcuNl9sKwDqZaGGw%3D%3D"}]}
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 63195730b8f7dfbf-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 forkawesome-webfont.woff2
www.reisekostenabrechnung.com/wp-content/plugins/shortcodes-ultimate/includes/fonts/fork-awesome/ 88 KB
89 KB 79ms
79ms Font
font/woff2 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/wp-content/plugins/shortcodes-ultimate/includes/fonts/fork-awesome/forkawesome-webfont.woff2?v=1.0.11
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/b53f34c75ed223f448abdd796c3eb906.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec8604d4eade6552031ca2e8d3af9b3a1393bdc11b39dcb8176c41f4e5fb678c

Request headers

Origin: https://www.reisekostenabrechnung.com
Referer: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/b53f34c75ed223f448abdd796c3eb906.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
vary: Accept-Encoding, Accept-Encoding,Origin
cf-cache-status: EXPIRED
nel: {"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d2730000dfbf983dc000000001
response: 200
last-modified: Fri, 12 Mar 2021 17:56:24 GMT
server: cloudflare
etag: W/"16134-5b3fb67664a94-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: font/woff2
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: max-age=0
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=0hL%2BYSQpekysY4eMMn%2BK75N17ABA6LymNmoOcrhYaqu88UBqKDi1yBlNCZU%2B4hzWm%2Fah8%2FdaSneQml74IfLSKjB23SIOEBrShxIsJFfmQxe8MJMg36hqqagl7pddE4dtnTY5%2B27uaVd04g%3D%3D"}]}
cf-ray: 63195730b8f9dfbf-FRA
expires: Wed, 17 Mar 2021 21:33:36 GMT

GET
H2 200 rochester.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 3 KB
1 KB 16ms
15ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/rochester.js?gcb=192-2&cb=4
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aba387bcb56de1503c6196d03295b70469425af39b649cf05b38b6949e8456c2

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 502709
cf-ray: 63195730e938dfbf-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d28f0000dfbf10a1a000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=sKLD0WYgt6rh154yrGh%2BBQyWiV2fq2%2BasriyNOjhtXSkBHLaVUHwRJ0uZW7lUIH0g6aJjjpc34iKpSMFa3%2F8FTzAo2XWLV0evs8D6NNJBwrxVyqqIkGYPOj%2BonYKXszFUPeoYjJwrMGjMQ%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 houston.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 3 KB
1 KB 17ms
16ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/houston.js?gcb=2&cb=36
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08375cebca0d36f2fa3ec9e027a974146af7161553e4319a418d4cee6b38bed7

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1711793
cf-ray: 63195731095edfbf-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d2a50000dfbf89163000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=r1JhfVjprqZ%2B2Yc2vQEVJKLyqzrI2v%2Fw%2FXBQU1eoxceuxIsd0D2%2FtoXQ4w%2BxyEuKVjjiLouvBFWw0QKnB6zvg%2Fkyz89s2If6iVl2sIdh2R5T7DEfTYGd2rZhhO%2BLHMKzXyMTFJ44DPJGpw%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
452 B 19ms
18ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJkYXRhIjpbeyJuYW1lIjoiZXh0X3VzZXJfaGFzaCIsInZhbCI6InVuZGVmaW5lZCJ9XX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4d2a60000dfbf10a1c000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4Jw0qMv4aWVh7nXU021gtW72cQsd6h%2BJT%2Bbbii1lSX3JXacKFtLzX2zbd3MdxU0S2kEYvfKomR5IZehIgIaJ7sCVao%2FvF6KE4IlvYQ%2FNoQa9IsKzTwwE8ltQUvN%2FnrHFVem0CqTr2HQxJw%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957310964dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:36 UTC

GET
H2 200 anchorfix.js Show response
www.reisekostenabrechnung.com/ezoic/ 879 B
811 B 15ms
14ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/ezoic/anchorfix.js?cb=192-2
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 15f0626dd31e3e991a1c21d6304f2e370b92b3c91650de3d7ed8a38f1159a457

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2553934
cf-ray: 631957311974dfbf-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d2af0000dfbf36ac1000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=znknnbCU6wDYiiDe%2FFPfO8WeXdD06fosNWhVXhbjJxKSwhyKL5p7Ov51%2BSlP%2Fj4Etl0vVixaoGAOOcN0HwYzg8uuwZwnz2AqkElJrz4xBSuqcaBAe1PsMgis6HoeMBgHYr6RaYMr0%2FO59w%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=31536000
x-robots-tag: noindex, noindex
expires: Wed, 16 Feb 2022 08:08:02 GMT

GET
H2 200 edmonton.webp Show response
www.reisekostenabrechnung.com/detroitchicago/ 13 KB
4 KB 18ms
17ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/edmonton.webp?a=a&cb=192-2&shcb=34
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d798d8773831f64f1228bc59f6dc361eae9b0811b1cbce20d639a8695b1d118c

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3517426
cf-polished: origSize=13962
cf-ray: 631957311976dfbf-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d2af0000dfbf9d320000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Mb15iTo0M0BvXsExcy%2BXenSH28NibwY1F4h8N1V%2FtTRdslQQV%2Fc4XoFiHAIf%2Ficc7nLgf80L4LxJ8ugA7etoBe1xM%2BCTu6yyiB79uMR1TsrwsE%2Bl8yXsFdhH8d7T%2F3T23lhllIjUYaOhSA%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=31536000
x-robots-tag: noindex

GET
H2 200 jellyfish.webp Show response
www.reisekostenabrechnung.com/porpoiseant/ 40 KB
9 KB 17ms
16ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/jellyfish.webp?a=a&cb=192-2&shcb=34
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 37d4ae593a1268d4afce8c38f61ea933982184d2d6055300c2bfdb8ca28c2846

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3517427
cf-polished: origSize=59534
cf-ray: 631957311977dfbf-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d2af0000dfbfc6958000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=19n2G0%2FEfo2dLtgF46xQnkvbInXl5JuRTPB7K4sqxiy5v59cNNfvPImUKaxmfPMUlweXdjpUXx351RScNA4YCiNchf%2BWnl3A2ybhfEXchlAalilW6UdzjqGSJP3SEgA8uK1%2BvEzuvUA3Yg%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=31536000
x-robots-tag: noindex

GET
H2 200 vitals.js Show response
www.reisekostenabrechnung.com/tardisrocinante/ 5 KB
2 KB 13ms
13ms Script
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/tardisrocinante/vitals.js?gcb=2&cb=3
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 26b4485584314aa0850427462143a6a28b66c982db28deb42766214fad7744c7

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3805391
cf-ray: 631957311978dfbf-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d2af0000dfbfb9135000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=c52OPASSpmW7B7lMgBsEWS8fKY18BecCXoNcI2q2Gn7rC4V3OgXrlxBjPXjAcmfULykTNakG61bBZbKybRnlW8cIjrO4qqQOleTKfPmRAHJf2YdVRJqSKPYzZU1GPhkERFhgRXK8NsfMzQ%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 style.css
g.ezodn.com/cmp/ 13 KB
2 KB 12ms
11ms Stylesheet
text/css 2606:4700:e4::ac40:a708
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezodn.com/cmp/style.css?domainId=129856&version=0&cv=5fa624ffffff000000
Requested by: Host: ezodn.com
URL: https://ezodn.com/cmp/altconsent.js?v=8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a708 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 657df3443b334f17bd33ac827932e2395ddc2d5a28b697c91e21fc8fabebf8e7

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
age: 127714
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Ml4kwtuT%2F6T5VgfSd3cYpeFzjBQcNK4xIf9jHAA8Egl7ad9uVPK6JSot6n2pWj4qOj6M8%2BFssvvpXq6xc%2BblCrP2umxawa3jnF2egIGaEolsqaB7PirjCw%3D%3D"}]}
content-type: text/css; charset=utf-8
cache-control: public, max-age=604800
nel: {"max_age":604800,"report_to":"cf-nel"}
cf-ray: 631957313f574a9e-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d2c000004a9e06008000000001

GET
H2 200 nmash.js
www.reisekostenabrechnung.com/porpoiseant/ 33 KB
9 KB 17ms
16ms Other
application/javascript 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/nmash.js?v=13
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e03a7aaf1268afc2377a1c4d36959d7213380c40527ac50ccca39b8c16ce610

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 664553
cf-polished: origSize=34155
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4d2cf0000dfbf29bca000000001
x-robots-tag: noindex
last-modified: Wed, 10 Mar 2021 03:20:43 GMT
server: cloudflare
etag: W/"856b-5bd2626f3c490;5bccbe55ccb00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2B8Z4NGolRiF9ZdmwGJcfwGA7pMx6voSgSHiT6hZreKTo7269ASfuO5k0MdN6%2BBDxhzC0ebHU%2FWv7mADuIczUhcIalUWH0d06asr6A0qpA%2FjDr0xTyq7Jxc9Z1uaCSNm49BvSRjzk3eoxHw%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=31536000, public
cf-ray: 6319573149acdfbf-FRA
cf-bgj: minify

GET
H3-Q050 200 pubads_impl_2021031101.js Show response
securepubads.g.doubleclick.net/gpt/ 284 KB
100 KB 70ms
39ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

sffe /

Resource Hash

801b78af2ab57cfc67d37f8137feac63f1b722b8812dea418b43759e9baddef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 11 Mar 2021 19:23:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 102217
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:36 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2827868-10

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 05 Feb 2021 21:33:27 GMT
server: Golfe2
age: 311
date: Wed, 17 Mar 2021 21:28:25 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18980
expires: Wed, 17 Mar 2021 23:28:25 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
381 B 83ms
83ms XHR
text/javascript 13.226.158.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&pid=m9HsKWWb1FcmW&cb=0&ws=1600x1200&v=7.60.00&t=2000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-medrectangle-2%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-box-2%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-box-2%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-box-2%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-box-2%22%7D%2C%7B%22sd%22%3A%225%22%2C%22s%22%3A%5B%22336x280%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-large-leaderboard-1%22%7D%2C%7B%22sd%22%3A%226%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-large-mobile-banner-1%22%7D%2C%7B%22sd%22%3A%227%22%2C%22s%22%3A%5B%22336x280%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-medrectangle-1%22%7D%5D&cfgv=0&schain=1.0%2C1!ezoic.ai%2C5342729130004cc7c4d61cf871f86247%2C1%2C%2C%2C&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.158.204 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-158-204.dus51.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
via: 1.1 4ba9d3779ca8afc198240a34dffb07c4.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: DUS51-C1
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: QiSKfv1FeGKhgk3v2ZxNk5kacduAF04abxSWuaOk4wGGFTlS4Pz5PQ==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 103ms
49ms XHR
application/javascript 13.226.158.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.158.204 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-158-204.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: Z_m26sDjicOoQtCCmuJEtOsMPnFQWWIm
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 69823
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Sat, 06 Mar 2021 01:32:40 GMT
server: AmazonS3
date: Wed, 17 Mar 2021 02:09:54 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 c51e3be89c14e3f859ea898f7e36eced.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: yiXJIgZUVutyWlJAvDq8ab9NCChX1PB97_5QYsCuDCDkm5M16H9wGA==

GET
H2 200 imp.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 43 B
414 B 32ms
31ms XHR
image/gif 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A2%2C%22ad_count_adjustment%22%3A1%2C%22ad_lazyload_version%22%3A5%2C%22ad_location_ids%22%3A%225%2C1%2C1%2C1%2C1%2C35%2C711%2C4%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A8%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A4%2C%22city%22%3A%22%22%2C%22country%22%3A%22DE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A4%2C%22domain_id%22%3A129856%2C%22domain_test_group%22%3A20200401%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22iab_category_0%22%3A%22653%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A3%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221100%2C1103%2C1103%2C1103%2C1103%2C1109%2C1123%2C1124%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%226e0aec5e-af16-4637-65bd-e06c90e9a048%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%22%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A98867%2C%22response_time_orig%22%3A194%2C%22serverid%22%3A%2235.157.242.25%3A32269%22%2C%22state%22%3A%22%22%2C%22sub_page_ad_positions%22%3A%221100%2C1103%2C1103%2C1103%2C1103%2C1109%2C1123%2C1124%22%2C%22t_epoch%22%3A1616016815%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Fwww.reisekostenabrechnung.com%2F%22%2C%22user_id%22%3A0%2C%22weather_precipitation%22%3A0%2C%22weather_summary%22%3A%22%22%2C%22weather_temperature%22%3A0%2C%22word_count%22%3A836%2C%22worst_bad_word_level%22%3A0%7D
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NUL1F601lFOZ4Va%2FLFF8r%2BKE9ukjdlqSkc6GdVQyFBRqAj%2FJTFdgx2wiD5Z9voxiPa3s6s7aCR3vu5bV%2FmzL6GTOHmNEezslVQI36BlSIsTMd0aI1hk6VsQBqxbQIZZqgGy%2FxEvYeC9bhg%3D%3D"}]}
content-type: image/gif
x-middleton-display: imp_sol
cache-control: no-cache, no-store, must-revalidate, max-age=0
accept-ranges: bytes
cf-ray: 6319573189fadfbf-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
cf-request-id: 08e3b4d2f40000dfbf551f1000000001

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
395 B 21ms
21ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDMtMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMiJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIzIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii02MCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInRfZXBvY2giOjE2MTYwMTY4MTUsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV90YWciLCJ2YWwiOiJlbi1VUyJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInRfZXBvY2giOjE2MTYwMTY4MTUsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV9wcmltYXJ5X3N1YnRhZyIsInZhbCI6ImVuIn1dfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:36 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4d3050000dfbf7e1d7000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Z9QJt6CJxRmqDaIPVjjyt3xRrFthAIllafyZcbUI3aceYezwbgQTtwGjWwNGowTDgBcITUK3viGOD%2Bftvr%2FkLqapJmlskKKFvXBrbWXaWJSPsdNreY2XFkfb8deSAO%2BXBgctxEkLSk%2FFuA%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 63195731aa23dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:36 UTC

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
75 B 13ms
13ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j88&aip=1&a=865683303&t=pageview&_s=1&dl=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&ul=en-us&de=UTF-8&dt=Reisekostenabrechnung%202020%20%E2%87%92%20Infos%2C%20Vorlagen%2C%20Tipps%20f%C3%BCr%20Arbeitnehmer&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=1301699468&gjid=1311460960&cid=973125957.1616016817&tid=UA-2827868-10&_gid=973828294.1616016817&_r=1&gtm=2ou3a0&z=691861686

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:36 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
799 B 36ms
15ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
553 B 40ms
15ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 2 KB
336 B 803ms
803ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=1423798006995096&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C420x330%7C310x340%2C300x250%7C350x320%7C420x330%7C310x340%2C300x250%7C350x320%7C420x330%7C310x340%2C300x250%7C350x320%7C420x330%7C310x340&prev_scp=a%3D%257C2%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D931e89386514f6e0ab7df9718ec5a124%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D80%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D0%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26ax_ssid%3D10082%7Ca%3D%257C3%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D931e89386514f6e0ab7df9718ec5a124%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D80%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D1%26stl%3D84%2C152%2C194%2C27%2C94%2C122%2C91%2C20%2C26%2C201%2C187%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26ax_ssid%3D10082%7Ca%3D%257C6%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D931e89386514f6e0ab7df9718ec5a124%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D80%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D2%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26ax_ssid%3D10082%7Ca%3D%257C6%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D931e89386514f6e0ab7df9718ec5a124%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D80%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D3%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26ax_ssid%3D10082&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1616016817&dt=1616016817008&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=348%2C348%2C348%2C348&adys=130%2C392%2C654%2C916&adks=2284364264%2C1838216044%2C1838216047%2C1838216046&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262%7C300x262%7C300x262%7C300x262&msz=300x262%7C300x262%7C300x262%7C300x262&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=4%2C4%2C4%2C4&ohw=904%2C904%2C904%2C904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

4d3a493f17f2d967adf97e9aa152fbc04bc17adf046197494b835d9bcc507cb2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:37 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 268
x-xss-protection: 0
google-lineitem-id: -2,-2,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 71ms
39ms Other
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 27ms
7ms Other
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 490 B
755 B 509ms
508ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=551817839611816&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C350x320%7C350x330%7C410x330&prev_scp=a%3D%257C251%257C%26iid15%3D1408929%26iit%3D9%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreisekostenabrechnung_com-medrectangle-2-1408929%26eb_br%3D6a552ada640fe30aee10cad530838cc8%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D1500%26br2%3D750%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26ax_ssid%3D10082&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1616016817&dt=1616016817014&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1103&adks=1981148090&ucis=5&ifi=5&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=512&ohw=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

75167cabfce676d0e566fc6fc94d259e06564872d233eaee3935185ab9076563

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:37 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 255
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
394 B 34ms
31ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJkYXRhIjpbeyJuYW1lIjoibmF2aWdhdGlvbl90eXBlIiwidmFsIjoiMCJ9LHsibmFtZSI6InJlZGlyZWN0X2NvdW50IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInRfZXBvY2giOjE2MTYwMTY4MTUsImRhdGEiOlt7Im5hbWUiOiJwZXJmX2lzX3RyYWNrZWQiLCJ2YWwiOiIxIn0seyJuYW1lIjoicGVyZl9uYXZfdG9fY29ubmVjdCIsInZhbCI6IjQ2MiJ9LHsibmFtZSI6InBlcmZfY29ubmVjdF90b19yZXNwX3N0YXJ0IiwidmFsIjoiMTQ5MyJ9LHsibmFtZSI6InBlcmZfcmVzcF90aW1lIiwidmFsIjoiMTYifSx7Im5hbWUiOiJwZXJmX2ludGVyYWN0aXZlIiwidmFsIjoiMjg1In0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiMzAwIn0seyJuYW1lIjoicGVyZl9jb21wbGV0ZSIsInZhbCI6IjQ5OCJ9XX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:37 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4d3990000dfbf89171000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UT1Vpv6NV5%2Bllhm4gKrubQ4wRh0%2F3pg1N9bDiwCDVx%2B9KXvVrJtNqKgWT1EhbpxOSzQSRaCe93HeWkd8pGiTcS4FKcVwYdHLWX9wy65ijObcf3%2B9O4PvaBmORkWY3jjNOn2b5dIrTMpXaA%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957328b49dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:37 UTC

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
287 B 24ms
22ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfcGFpbnQiLCJ2YWwiOiIxNTk0In1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiZGF0YSI6W3sibmFtZSI6ImZpcnN0X2NvbnRlbnRmdWxfcGFpbnQiLCJ2YWwiOiIxNTk0In1dfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:37 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4d39b0000dfbf7931d000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=o55g1QpdEHfaf1H16E3nSDkQMnQMby3zvXaZHlABarDRcgzBUra8LiWQTdjnNu2TwDfrkst4jXBtOJOMydEjMffnr%2FyG13Camgc0CsB%2FqYsfl6UrOP%2FiNOblc2O%2B6T6xJNEOUsTcKd%2FWnQ%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957328b4cdfbf-FRA
expires: Tue, 16 Mar 2021 21:33:36 UTC

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
306 B 21ms
20ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9lZmZlY3RpdmVfdHlwZSIsInZhbCI6IjRnIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiZGF0YSI6W3sibmFtZSI6ImNvbm5lY3Rpb25fZG93bmxpbmsiLCJ2YWwiOiIxMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInRfZXBvY2giOjE2MTYwMTY4MTUsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX3J0dCIsInZhbCI6IjAifV19XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:37 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4d3980000dfbffca1e000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=RDBWac9iHK1eeiy%2FdoghqkqIJ3xYwcV7mglLluZ0Db4%2FSEqhC0utpiXeyiTl2m0xrykpzrawuw9duY3riUTYepW9jgL4vbsOv8JbLy1Da3MbaHAgDcZLr06Q65KyZ9fzBdWHLhR%2Be5WTjA%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957328b50dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:36 UTC

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
283 B 23ms
22ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfcmVxdWVzdCIsInZhbCI6Ijk5MSJ9XX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:37 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4d57d0000dfbfab987000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=nOrOeKo4xvMvj0AdPKyrvDVHRA70k3GeAtidrK0neisykh6RS%2F61eY12vUcYYKCDepcBXis7TOSBcMMPWKmF0i2j48LgJz0%2FTyK2eyPHqS59mlPLo2OJRlPaDlDNZ35A%2FR6cE8C398eUOw%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957359fa9dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:37 UTC

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 36ms
17ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021031101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ff01c3620edd0df1abcb0745f7ec94bde06d97dde3f152e8a8c5844272475f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6413
x-xss-protection: 0

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 68ms
54ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1611170586013198"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6403
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:37 GMT

GET
H3-Q050 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/221/ Frame 01A6 12 KB
5 KB 7ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/221/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reisekostenabrechnung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.reisekostenabrechnung.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 4984
date: Wed, 17 Mar 2021 18:26:59 GMT
expires: Thu, 17 Mar 2022 18:26:59 GMT
last-modified: Tue, 08 Dec 2020 21:41:15 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 11198
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 Ttnmja7GWy_egJOPMyxoEySbUmHRsVi1cDV04sNKFMM.js Show response
pagead2.googlesyndication.com/bg/ Frame 01A6 14 KB
6 KB 34ms
21ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ttnmja7GWy_egJOPMyxoEySbUmHRsVi1cDV04sNKFMM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4ed9e68daec65b2fde80938f332c6813249b5261d1b158b5703574e2c34a14c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:13:55 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 1182
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5785
x-xss-protection: 0
expires: Thu, 17 Mar 2022 21:13:55 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
224 B 39ms
39ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=221&t=2&li=gpt_2021031101&jk=3971796041233386&bg=!dnWldTHNAAbUo7L91KM7ACkAdvg8WhbUf4sidQKUTDcXS1L8laUVfFFoGhxkWjcgyG0Fmfzy6ywKjwIAAABJUgAAAAloAQcKAHefeZkbjOFcG3Ut6jFeBBZBhPaXws0UlIadbAAmb8TfhKKc_YD01BHlnv0TnD6C2KKl2XgsF3ZMih-zzobMQpj-QCOiRyPZq5kdCYhZ6AI43NAnYgNmmDtvuntJIDTdYLGFkxMegma2LwtBATe5JD-HKz47Nq5A2JkB7cQ_Skblqd2bu2W5gzuShGulSns2whRLTF695XybCMDpkvZSh3yGOYgEAxe61w6mGybqB6wFmk4loZYz4fMh6NtEHrAlshtvJ0bljuJWxF917eI24Rm3dBhDoXpMZZwGnLJDvrdhjH1ZQOjH0sP6ihN8bFLpZ5mQjyQ8afqiD-N8RJ-u47yddzZKYa2WntYTMIEPCZBda3ffIBwifTikJ6fhOIvCIPv4hrV9MEYfQ5W8s8DPt8--yyi_Y9nbhbwruVr8mb0FTQhmmiKgXVchjA9d546JNP_68a2aLWKuknPEgDuvD19IrzNaXecwCcrWrlAjAGLZwO6BbP5_fvz4l_Espef-3nZMGFCm38dhxNhR2kAdB6_0eBFupc97dPPPBjiZgPh2jioi8gavcW3cBrJsEzA88joYdFMW4z_Vpz8c4ym0ei1RNN0AS2uA9LvqwzUTbvUq4xz1KVeO05RpmLL_Lgi-gpPhtW8oVOWiWUQyfXurUGErCQQkR1NZIsTW0e75hx3nfT13Va349OXX6b2I1YHNyPa1hkLi0_l8oxkBMOygAfIBErG5q3ieEHl6zyt4eV83jiPAvCdgBDeS9pC8K2-V_0nf_Yd78FpMr3duKIkIOhyKiSWHRv9ImB0Coh7wTo87jV6AKFVVQ7A

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
165 B 15ms
14ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 482 B
425 B 400ms
400ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=1781569029385043&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C420x330%7C310x340&ris=3&rcs=1&prev_scp=a%3D%257C6%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D6f1c86ebad23a9c4f3d9e02ac8a8dbbf%2Cee685f77592ce296910ee91457d66ba3%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D40%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D3%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D80%26reqt%3D1616016820388&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1616016820&dt=1616016820393&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=348&adys=926&adks=1838216046&ucis=6&ifi=6&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

2a8be398cf69c3e6d9b7e567a8736b5f6d9df75c212c0b90b151a6eb88cd3a6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:40 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 247
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 482 B
421 B 446ms
446ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=1766511257270886&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C420x330%7C310x340&ris=3&rcs=1&prev_scp=a%3D%257C6%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D6f1c86ebad23a9c4f3d9e02ac8a8dbbf%2Cee685f77592ce296910ee91457d66ba3%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D40%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D2%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D80%26reqt%3D1616016820395&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1616016820&dt=1616016820397&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=348&adys=664&adks=1838216047&ucis=7&ifi=7&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

cfa9df33ddcd5997a1bc37ac8938f95811ab466aaf288f04bad9cb28b5f3e3e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:40 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 247
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 482 B
422 B 399ms
399ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=2999800066094813&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C420x330%7C310x340&ris=3&rcs=1&prev_scp=a%3D%257C3%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D6f1c86ebad23a9c4f3d9e02ac8a8dbbf%2Cee685f77592ce296910ee91457d66ba3%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D40%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D1%26stl%3D84%2C152%2C194%2C27%2C94%2C122%2C91%2C20%2C26%2C201%2C187%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D80%26reqt%3D1616016820404&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1616016820&dt=1616016820406&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=348&adys=402&adks=1838216044&ucis=8&ifi=8&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

3db1f6d45dafa60fafb6408753cef362aae6d7ed8000e1d748da75cdf44eaa6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:40 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 482 B
799 B 363ms
363ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=3333961656633061&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C420x330%7C310x340&ris=3&rcs=1&prev_scp=a%3D%257C2%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D6f1c86ebad23a9c4f3d9e02ac8a8dbbf%2Cee685f77592ce296910ee91457d66ba3%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D40%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D0%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D80%26reqt%3D1616016820408&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1616016820&dt=1616016820409&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=348&adys=140&adks=2284364264&ucis=9&ifi=9&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

dee7b94da78ae074e389317347107a922ba45c261e5a78bc59fb796d67c1ca92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:40 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 490 B
429 B 373ms
373ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=1356634131396340&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C350x320%7C350x330%7C410x330&ris=3&rcs=1&prev_scp=a%3D%257C251%257C%26iid15%3D1408929%26iit%3D9%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreisekostenabrechnung_com-medrectangle-2-1408929%26eb_br%3D8667d34af751e626afa0f7877d61515b%2C6ac330e431a70c7d8ce9fb95aee95c72%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D750%26br2%3D750%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D1500%26reqt%3D1616016820411&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1616016820&dt=1616016820412&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1103&adks=1981148090&ucis=a&ifi=10&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=512&ohw=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

99b01d2d01686465c5a11f8ee823ceb4dc563049eff944fe3334f85392b95f72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:40 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 252
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
777 B 37ms
23ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
531 B 48ms
32ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 465 B
519 B 280ms
279ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=2701573013335640&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C420x330%7C310x340&ris=1&rcs=2&prev_scp=a%3D%257C6%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D09900f25ac768e2ab6f6a1b9b20b686a%2Cbf9a045b836005b6c23b7b0749249612%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D26%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D3%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C19%2C20%2C17%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D40%26reqt%3D1616016820896&eri=1&cookie=ID%3Dd24887b9dae7ce82-22f3a382d3ba00b0%3AT%3D1616016820%3AS%3DALNI_Mbde4va9n33fe_20E2CWMDt0oGIQA&bc=31&abxe=1&lmt=1616016820&dt=1616016820899&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=348&adys=926&adks=1838216046&ucis=b&ifi=11&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

4a4fe5147f0ba52feecf256ac0036eb042f12a1691f711df4620b29451be5e84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 235
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 465 B
404 B 383ms
382ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=1551420801257582&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C420x330%7C310x340&ris=1&rcs=2&prev_scp=a%3D%257C6%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D09900f25ac768e2ab6f6a1b9b20b686a%2Cbf9a045b836005b6c23b7b0749249612%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D26%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D2%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C19%2C20%2C17%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D40%26reqt%3D1616016820905&eri=1&cookie=ID%3Dd24887b9dae7ce82-22f3a382d3ba00b0%3AT%3D1616016820%3AS%3DALNI_Mbde4va9n33fe_20E2CWMDt0oGIQA&bc=31&abxe=1&lmt=1616016820&dt=1616016820906&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=348&adys=664&adks=1838216047&ucis=c&ifi=12&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

242a118feb6a1164888c2691992971a307399992845b4cee83295057b2818a34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 235
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 465 B
410 B 360ms
359ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=1811224278311223&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C420x330%7C310x340&ris=1&rcs=2&prev_scp=a%3D%257C3%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D09900f25ac768e2ab6f6a1b9b20b686a%2Cbf9a045b836005b6c23b7b0749249612%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D26%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D1%26stl%3D84%2C152%2C194%2C27%2C94%2C122%2C91%2C20%2C26%2C201%2C187%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C19%2C20%2C17%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D40%26reqt%3D1616016820921&eri=1&cookie=ID%3Dd24887b9dae7ce82-22f3a382d3ba00b0%3AT%3D1616016820%3AS%3DALNI_Mbde4va9n33fe_20E2CWMDt0oGIQA&bc=31&abxe=1&lmt=1616016820&dt=1616016820923&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=348&adys=402&adks=1838216044&ucis=d&ifi=13&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

d74bbc606bda1dd3e58a7ab06db2951eb1e1796f713005c26b953a6ea62ce7fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 236
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 471 B
417 B 448ms
448ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=844367314690340&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C420x330%7C310x340&ris=1&rcs=2&prev_scp=a%3D%257C2%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D09900f25ac768e2ab6f6a1b9b20b686a%2Cbf9a045b836005b6c23b7b0749249612%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D26%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D0%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C19%2C20%2C17%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D40%26reqt%3D1616016820928&eri=1&cookie=ID%3Dd24887b9dae7ce82-22f3a382d3ba00b0%3AT%3D1616016820%3AS%3DALNI_Mbde4va9n33fe_20E2CWMDt0oGIQA&bc=31&abxe=1&lmt=1616016820&dt=1616016820930&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=348&adys=140&adks=2284364264&ucis=e&ifi=14&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

12b3c8eae2fe5af1db3154e204d173c247b64919db0a181f05a55e55388944c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 243
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 473 B
414 B 485ms
484ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=1792122498667105&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C350x320%7C350x330%7C410x330&ris=1&rcs=2&prev_scp=a%3D%257C251%257C%26iid15%3D1408929%26iit%3D9%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreisekostenabrechnung_com-medrectangle-2-1408929%26eb_br%3D2acc48f80457fdc6d4d6786673884135%2Cc16fac08e79a971524b1c6834f5caad3%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D280%26br2%3D750%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D750%26reqt%3D1616016820933&eri=1&cookie=ID%3Dd24887b9dae7ce82-22f3a382d3ba00b0%3AT%3D1616016820%3AS%3DALNI_Mbde4va9n33fe_20E2CWMDt0oGIQA&bc=31&abxe=1&lmt=1616016820&dt=1616016820935&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1103&adks=1981148090&ucis=f&ifi=15&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=512&ohw=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

b726f640fbd2d80ddcf3c5e283fe701e054526de4ea5a2328e60459d795e498f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 242
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
146 B 16ms
15ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
146 B 17ms
16ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 48 KB
12 KB 259ms
259ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=951758337321598&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C420x330%7C310x340&ris=1&rcs=3&prev_scp=a%3D%257C6%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D780324bcbe122aeb7768d94246861ef2%2Cad0061a38dd7c6f7bcb692aee88dfda4%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D14%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D2%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C19%2C20%2C17%2C19%2C20%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D26%26reqt%3D1616016821409&eri=1&cookie=ID%3Dd24887b9dae7ce82%3AT%3D1616016820%3AS%3DALNI_MY23LV3q1DT-QweOlMk2xYhFG1Y4w&bc=31&abxe=1&lmt=1616016821&dt=1616016821412&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=348&adys=664&adks=1838216047&ucis=g&ifi=16&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

4d945a036e928a9758246d0fa097939d99b3e8e35c50eb30020ef5614c1c93a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11738
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
123 B 15ms
15ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
123 B 15ms
15ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
8 KB 360ms
360ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=2690592451715680&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C420x330%7C310x340&ris=1&rcs=3&prev_scp=a%3D%257C3%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D780324bcbe122aeb7768d94246861ef2%2Cad0061a38dd7c6f7bcb692aee88dfda4%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D14%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D1%26stl%3D84%2C152%2C194%2C27%2C94%2C122%2C91%2C20%2C26%2C201%2C187%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C19%2C20%2C17%2C19%2C20%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D26%26reqt%3D1616016821429&eri=1&cookie=ID%3Dd24887b9dae7ce82%3AT%3D1616016820%3AS%3DALNI_MY23LV3q1DT-QweOlMk2xYhFG1Y4w&bc=31&abxe=1&lmt=1616016821&dt=1616016821432&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=348&adys=402&adks=1838216044&ucis=h&ifi=17&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

76bcd6777531af5ae5203c6cbaa574c68736d2fa0bb6011d51dd321ea8e18164

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8604
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 25 KB
11 KB 325ms
324ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=2004932057843004&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C420x330%7C310x340&ris=1&rcs=3&prev_scp=a%3D%257C2%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D780324bcbe122aeb7768d94246861ef2%2Cad0061a38dd7c6f7bcb692aee88dfda4%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D14%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D0%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C19%2C20%2C17%2C19%2C20%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D26%26reqt%3D1616016821438&eri=1&cookie=ID%3Dd24887b9dae7ce82%3AT%3D1616016820%3AS%3DALNI_MY23LV3q1DT-QweOlMk2xYhFG1Y4w&bc=31&abxe=1&lmt=1616016821&dt=1616016821440&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=348&adys=140&adks=2284364264&ucis=i&ifi=18&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

69c7140c465fc1a08442f09feb783e9790e4eb675cdda73d3dece608f0bafa3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11398
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 27 KB
12 KB 284ms
282ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=1707784222094086&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C350x320%7C350x330%7C410x330&ris=1&rcs=3&prev_scp=a%3D%257C251%257C%26iid15%3D1408929%26iit%3D9%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreisekostenabrechnung_com-medrectangle-2-1408929%26eb_br%3Dfe1f34fd0c4fe8bf8d52adece55deeb2%2C674294a1b21a1e89fc99c14c9b17be44%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D28%26br2%3D750%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D280%26reqt%3D1616016821441&eri=1&cookie=ID%3Dd24887b9dae7ce82%3AT%3D1616016820%3AS%3DALNI_MY23LV3q1DT-QweOlMk2xYhFG1Y4w&bc=31&abxe=1&lmt=1616016821&dt=1616016821443&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1103&adks=1981148090&ucis=j&ifi=19&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=512&ohw=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

1afeffa0c18907dd7e1e9ce9564e6eb8221974664a89c1db0b6adf38b255fa59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11838
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012101070013000/ Frame 74C0 185 KB
53 KB 34ms
8ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012101070013000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0812a00aee80133b732c5cb2e0362ee2a52ae9f50c126d43e73f98163db9711f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 35025
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53820
x-xss-protection: 0
server: sffe
date: Wed, 17 Mar 2021 11:49:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "ee5348f2de7cdf64"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 17 Mar 2022 11:49:56 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012101070013000/v0/ Frame 74C0 12 KB
5 KB 33ms
7ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012101070013000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

981f6ac4a0eed80f6a40eef39d86ce7876f6e360d8b3a2f57f2617bb12895dc3

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 35025
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4559
x-xss-protection: 0
server: sffe
date: Wed, 17 Mar 2021 11:49:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "c3a321a15743f406"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 17 Mar 2022 11:49:56 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012101070013000/v0/ Frame 74C0 87 KB
27 KB 45ms
19ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012101070013000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4024d5169b2506f3421052b45f5d66154de796baf2443d9326ac40107ce5cfb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 35025
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27206
x-xss-protection: 0
server: sffe
date: Wed, 17 Mar 2021 11:49:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "1f991b6a8daa2b14"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 17 Mar 2022 11:49:56 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012101070013000/v0/ Frame 74C0 3 KB
1 KB 46ms
21ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012101070013000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c7fa743da4cd37829cd0e7c02e877f094400036be87c8e1fd9d2c3f5f68a8fa5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 35025
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1376
x-xss-protection: 0
server: sffe
date: Wed, 17 Mar 2021 11:49:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "512b909f94eb26fb"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 17 Mar 2022 11:49:56 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012101070013000/v0/ Frame 74C0 40 KB
13 KB 43ms
18ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012101070013000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

194a2819816bb760d4c5ba2ba825cf1926b853c821842697c3024ec74a36f66c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 35025
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12793
x-xss-protection: 0
server: sffe
date: Wed, 17 Mar 2021 11:49:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "1e3ef417618f7e28"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 17 Mar 2022 11:49:56 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 74C0 6 KB
765 B 14ms
13ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e47a27d91c2487289d6607ee10d7cb7b31944a5ed3ff5ffc86ec8526e9374af0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 17 Mar 2021 21:12:33 GMT
server: ESF
date: Wed, 17 Mar 2021 21:33:41 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 17 Mar 2021 21:33:41 GMT

GET
H2 200 2076313506083323656
tpc.googlesyndication.com/simgad/6461186685714968570/ Frame 74C0 64 KB
64 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6461186685714968570/2076313506083323656

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

57759546953786ff698ce45fd0324c47238aa59cde9f2bc443c499f719da34dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 19:55:17 GMT
x-content-type-options: nosniff
age: 5904
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 65634
x-xss-protection: 0
last-modified: Mon, 30 Sep 2019 14:28:23 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 17 Mar 2022 19:55:17 GMT

GET
DATA 200
OK truncated
/ Frame 74C0 220 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: daf79d666932d07416a4fbc69b64fccfecc59651707cd9a2bc75126d08ccb1ac

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 74C0 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 894e32f3b7d381eb29be215146a39449a3da919114e8782045ebf06fe5731697

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 de.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 74C0 3 KB
3 KB 15ms
14ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/de.png

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8471f381394962167d7d0cbbd9ffbd1f19d3ef6c48a7d9e3209142e674481368

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 00:08:17 GMT
x-content-type-options: nosniff
server: cafe
age: 77124
etag: 6601037253665971276
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2958
x-xss-protection: 0
expires: Thu, 18 Mar 2021 00:08:17 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 74C0 295 B
399 B 16ms
15ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 16 Mar 2021 22:17:05 GMT
x-content-type-options: nosniff
server: cafe
age: 83796
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 17 Mar 2021 22:17:05 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 74C0 0
0 14ms
13ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQkvBMqc2vZIzoAnuZcOeHVS_WTgW4lkFNUrJYmS9iHH2J9FVslA6j5qlAFF16leYvVcp8oOLoDn7xhtwumsSkMe0USPg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 74C0 0
0 60ms
59ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CkuRJtXVSYKbtG9uW3gPZ0afgDOWPu5Zh1v64moANlpOe1NAREAEgpczXamD7gYCAiAqgAZSw-cMDyAEJqQKMAU63JPizPuACAKgDAcgDCqoEjQJP0AVuY-x6m2Yqf3bKveNG2fUFkFIIfsEW_OSACUA5FrLcWcJQo1RgOR4_S4Vxa-dBjmnqr16sXf0n5aHU4N9ZFtdsFBSAXxIeitniThP2-yX7O-26FHu3_KHmDJHuCBnb9E6xwDN8hj9oUK80vie4Kb5KbkXd1Sg__LwXAUuq3b7y_wPo1d_hIFK1grKWRa-nG-h34XxGcFy4P4kzzFiZQHHdvwsQpfb1k2u8CtCZR-aF_uBaTP_At9tKWqWyHRJFBiOt4X72p18qtpAhMOu8kwf1Cmno4NUVaw5ZTK71aRYVw7hXKF9DyMUPcJBHtTldihtI6jDMzwbrtFgBDsFOlLZZxxqgjOhXXCcGJMAE8-rS258B4AQBkgUECAQYAZIFBAgFGASgBi6AB9TPhjyoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwDyBwQQyM0I0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi00NDM2NzI3MDk2OTY2NTU5gAoDyAsB2BMMshcaChgIABIUcHViLTU5MDIwODMyODUzMDI3Nzk&sigh=oRQanVaLL8Q&template_id=484&tpd=AGWhJmtueqOMBMyPnPMocJlZnxE4Rz7Q2XANTMudgk6yhZCDTg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 142.250.185.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s51-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
559 B 19ms
19ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjUxNTgifV19XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4e5c30000dfbf36baa000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=2%2BCvJSDjw6o%2FwLjPDE1tdH6vTLO2iSSe09r%2BUAKkm9itvMllqA1fz46VcCO4iyd%2BZKnGKXZHUeR7y7SVd0Yx4eur0h1SsgDfKNjl3BXzrxogIKht7M1g0cThho1XGsEqhREP0%2BVS6LWBnA%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319574f9dfbdfbf-FRA
expires: Tue, 16 Mar 2021 21:33:41 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
315 B 21ms
19ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8yIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiI0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQyOTI5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiNzgwMzI0YmNiZTEyMmFlYjc3NjhkOTQyNDY4NjFlZjIsYWQwMDYxYTM4ZGQ3YzZmN2JjYjY5MmFlZTg4ZGZkYTQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDI5MjkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MTYwMTY4MTUsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDE0LCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMTQsImJpZF9mbG9vcl9wcmV2IjowLjAwMDI2LCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8yIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MjQxMTIzNTE3In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQyOTI5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiI0OTc0OTAyODMyIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4e5c50000dfbf6a3f7000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=kVimOit%2BV%2F7eO%2FuMOhVzKCqvEPhMo%2FdIuP3xa%2FX4GieT%2Fnt2ufttH0QbLUeOGa9fxoP3aLKaRQ47wi0nK5R5eFiMPF4PVoLgLx7hONCcKjPnZUxhE5IR%2BDtK3AIBjFZnvKRmVWLLJ74EVw%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319574fadffdfbf-FRA
expires: Tue, 16 Mar 2021 21:33:41 UTC

GET
H2 200 4974902832 Show response
g.ezoic.net/dac/ 0
93 B 93ms
36ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/4974902832
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/porpoiseant/banger.js?cb=192-2&bv=13&v=46&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 17 Mar 2021 21:33:41 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
363 B 22ms
21ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8yIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDMtMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMiJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIzIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii02MCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4e5c50000dfbf3f055000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lHGSOxS1nYH3BQfL3gOLw3l2X3RHm%2B4hZbgz4hHLF7Za2lkCAnT3Naiq1juMhmBnlojC5mT5EM%2BLYRDUn6HNx7mzGlUR4kjRtKWSv4qYYgVH1CMcWqBOvMRF7BUV7GzNGGRJtepghdwP7w%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319574fae03dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:41 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
285 B 33ms
32ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8yIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYXVjdGlvbl9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJiaWRfZmxvb3JfaW5pdGlhbCI6ODAsImJpZF9mbG9vcl9wcmV2IjoyNiwiYmlkX2Zsb29yX2ZpbGxlZCI6MTQsImF1Y3Rpb25fY291bnQiOjQsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjI4MCwibXVsdGlfYWRfdW5pdCI6MiwibXVsdGlfYWRfY291bnQiOjQsIm5ldHdvcmtfY29kZSI6MjE3MzIxMTg5MTQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMn1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4e5c60000dfbf9c36b000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4huW5Z8Fld6EzKr8TYZYiAwS1nHYcpXWRrk5aXZP95eSRUAf9X3Oy0N2hs5PJG3xoVXESdkr4Mo5XUrB1xc7xMHW01EKYBCvmfVEGWx5Fw17GYEWi0j0tEo9%2Bog%2FDqS6h0WXWD4I75jEgw%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319574fae04dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:41 UTC

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 74C0 15 KB
16 KB 5ms
5ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b4d07892cde715d50bb69c1982df496385d1dfd8f9d1867c31f19a3c8634cfae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.reisekostenabrechnung.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 19:52:31 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:19:00 GMT
server: sffe
age: 6070
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15816
x-xss-protection: 0
expires: Thu, 17 Mar 2022 19:52:31 GMT

GET
H3-Q050 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 74C0 15 KB
16 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29f6da0a8c21c5681511bb9b08663d3fd2c5d09c9bd8054ec354c563b8c8b7c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.reisekostenabrechnung.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 10 Mar 2021 22:41:50 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:55 GMT
server: sffe
age: 600711
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15784
x-xss-protection: 0
expires: Thu, 10 Mar 2022 22:41:50 GMT

GET
H2 200 container.html Show response
be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 4D58 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e86479d6e54449d1085c2149e190a615c6bead407b20bacbcf5852b5d65f1fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reisekostenabrechnung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.reisekostenabrechnung.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2973
date: Wed, 17 Mar 2021 21:33:37 GMT
expires: Thu, 17 Mar 2022 21:33:37 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 4
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 34ms
14ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca625f204331905abf3b4d86a89dfb9799c63771723b9b15c5b54c1f9fb2b83c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615980824644616"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28204
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:41 GMT

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
286 B 20ms
18ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQwODkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwNTI3MSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiI0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxNDA4OTI5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTA1MjcxLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiZmUxZjM0ZmQwYzRmZThiZjhkNTJhZGVjZTU1ZGVlYjIsNjc0Mjk0YTFiMjFhMWU4OWZjOTljMTRjOWIxN2JlNDQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE0MDg5MjkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MC4wMDAyOCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDI4LCJiaWRfZmxvb3JfcHJldiI6MC4wMDI4LCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDUyNzEsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxNDA4OTI5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTA1MjcxLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgyNDExMjM1MTcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE0MDg5MjkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDUyNzEsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjQ5NzQ5MDUyNzEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4e5fd0000dfbf9c36d000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=L7t%2FMLpfIVhd2kag94vlPiYOmwvCPzFUJ2VRj0weQfdworrDRJgnWHWCr8A6ikGYhyB1X49zRPOmR6T17jM5E%2BanCl3IZxPMECd7dxz50BlAZwSrlBBykp69iVJCLWWrdUEDY83S%2FI1aLA%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319574ffe5edfbf-FRA
expires: Tue, 16 Mar 2021 21:33:41 UTC

GET
H2 200 4974905271 Show response
g.ezoic.net/dac/ 0
17 B 37ms
36ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/4974905271
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/porpoiseant/banger.js?cb=192-2&bv=13&v=46&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 17 Mar 2021 21:33:41 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
372 B 20ms
19ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQwODkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwNTI3MSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDMtMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMiJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIzIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii02MCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4e5fe0000dfbf15aa7000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=CAQdR14IuLpetCgmhnwj3zJpgZixEkRYtpOldS7xiru3VVB4gQSPYWnz1c4%2BSnCdxDpB3tTzXLrv%2BhsY7seNEENNbQAH1hsO69L6%2Fp3Y8TepMGkkfOkTwJhf3BdqE%2Br%2F9pdBlwHJGCoreQ%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319574ffe60dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:41 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
281 B 20ms
19ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTQwODkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MTYwMTY4MTUsImF1Y3Rpb25fZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAwLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiYmlkX2Zsb29yX2luaXRpYWwiOjE1MDAsImJpZF9mbG9vcl9wcmV2IjoyODAsImJpZF9mbG9vcl9maWxsZWQiOjI4LCJhdWN0aW9uX2NvdW50Ijo0LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjoyOTYsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjIxNzMyMTE4OTE0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDUyNzF9XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4e5fe0000dfbf992d8000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=c1C6dZyMYEEb8T4%2Biz18fvxD4wft5eYcYXtcPxgHvb3cwftnODUFA1nmpYedoavjB90k2cJRQm9MlaSFBXw4BLeGBnbbJPcp2kjBeI2knINrQUOSiY2RV6aT4zEFxJfzvHKnZwcgqivUzg%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319574ffe61dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:41 UTC

GET
H3-Q050 200 container.html Show response
be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 3FEC 6 KB
3 KB 34ms
20ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e86479d6e54449d1085c2149e190a615c6bead407b20bacbcf5852b5d65f1fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reisekostenabrechnung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.reisekostenabrechnung.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2973
date: Wed, 17 Mar 2021 21:33:37 GMT
expires: Thu, 17 Mar 2022 21:33:37 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 4
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 container.html Show response
be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 1B53 6 KB
3 KB 8ms
8ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e86479d6e54449d1085c2149e190a615c6bead407b20bacbcf5852b5d65f1fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reisekostenabrechnung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.reisekostenabrechnung.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2973
date: Wed, 17 Mar 2021 21:33:37 GMT
expires: Thu, 17 Mar 2022 21:33:37 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 4
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
311 B 22ms
21ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiI0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQyOTI5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiNzgwMzI0YmNiZTEyMmFlYjc3NjhkOTQyNDY4NjFlZjIsYWQwMDYxYTM4ZGQ3YzZmN2JjYjY5MmFlZTg4ZGZkYTQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDI5MjkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MC4wMDAxNCwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDE0LCJiaWRfZmxvb3JfcHJldiI6MC4wMDAyNiwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MjQxMTIzNTE3In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQyOTI5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiI0OTc0OTAyODMyIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4e6430000dfbf10b14000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=pVb%2FZ300kkXER9gK1T7qkG0Uk6hWzLDkJHqPE4SK9k8UFHfckVs27YJe3W0Xg9RoN%2F3ssFDwVBZ9Hw1Big7PGeGBFK7OaV%2FXP6G9Aq8OydWNufXL8aAklMnK5AXq%2FHABHiOsEww89x6TKw%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957506ed4dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:41 UTC

GET
H2 200 4974902832 Show response
g.ezoic.net/dac/ 0
17 B 26ms
25ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/4974902832
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/porpoiseant/banger.js?cb=192-2&bv=13&v=46&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 17 Mar 2021 21:33:41 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
310 B 17ms
16ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDMtMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMiJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIzIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii02MCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4e6430000dfbf8a9b1000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZFy7F2mSebDWS801RiF1GKvH4RJW1rnhchhFJrrWeT0RZc8OySUSVpKzfKifNZqEScy34U%2BJ6%2BdSBfq9ojrmX5CLApcYKgtWBgUFemMj%2Fw%2BKivD5hua2nxuaztTjn%2FFcd4m1ghLn3VJbZQ%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957506ed5dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:41 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
414 B 18ms
18ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MTUsImF1Y3Rpb25fZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAzLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiYmlkX2Zsb29yX2luaXRpYWwiOjgwLCJiaWRfZmxvb3JfcHJldiI6MjYsImJpZF9mbG9vcl9maWxsZWQiOjE0LCJhdWN0aW9uX2NvdW50Ijo0LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjozNTYsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50Ijo0LCJuZXR3b3JrX2NvZGUiOjIxNzMyMTE4OTE0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzJ9XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4e6430000dfbfc6a40000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=mFrBKSNlUBfvNeAKzKBeabOOrZaws4BU817wAj9Miw4pkH54I6u9ZBIfNN3VCQpcYrha2Bie5Mu2B2cleTxBdufC1Y3SJECZhS7AVJQYW2JzjweCfJEbVwmITIO2g6l2L8HKKyg0HDlEQQ%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957506ed6dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:41 UTC

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9C4A 656 B
377 B 36ms
34ms Document
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjQrumbATAB&v=APEucNXEVdjzJv4Z1_mRNmg171JGgXiVhxZY6SP1TFwKhoCrw-XTmb7C3X5rHlyoH9b5nNmkUGj8Jb08E1PUoO7ONuptC9gVW_vQLd9nl9b6g8s4a8u-lXKwCyBZ3LDqnl9vDY_QYa6RvEh3HkFn7lh69pQk4bu93rJ7-2zDUjTiAu-Ud-uZVBEeByEVizpJJ_8Y7WCx2hnWlA723x3o9-OFLgeF8JxcnEj8pCPn2zULSc64Vp5Qlsc

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

1170a116f6521465e0d4f0df36d070b1502f257e88dbeb459d31d3e2c3fb861b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJfnugEQw7j0ARjQrumbATAB&v=APEucNXEVdjzJv4Z1_mRNmg171JGgXiVhxZY6SP1TFwKhoCrw-XTmb7C3X5rHlyoH9b5nNmkUGj8Jb08E1PUoO7ONuptC9gVW_vQLd9nl9b6g8s4a8u-lXKwCyBZ3LDqnl9vDY_QYa6RvEh3HkFn7lh69pQk4bu93rJ7-2zDUjTiAu-Ud-uZVBEeByEVizpJJ_8Y7WCx2hnWlA723x3o9-OFLgeF8JxcnEj8pCPn2zULSc64Vp5Qlsc
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl-bXIGMJ45jSICbpEAsfl3M2XbQ3afWFCc2ep4Vcwse419QXHDrCN6dwpUmkM
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 17 Mar 2021 21:33:41 GMT
server: cafe
cache-control: private
content-length: 284
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2B5C 23 KB
11 KB 55ms
52ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BXZzVbShdvDpS_5HzgnEseC8YcO8DKgzGZghKx47tPHRUJq-YSaTFXzkp3bNq1J0rVY-Dg5gda7P1HcEuFty2xqGZFhByGIYz3C7_RjNjNe8qVTTKq2ivwkvf3DgbsbyalNzC3YqC-ORbR_sjyXOUSrRKDnA&cry=1&dbm_d=AKAmf-CGL-tPYQZYmqtmeO3yqocDnqVa11KzUEafQRmMZJlRvjYPno2Z9I_OoNZVkwZSHYck0mzAQwX0tKUpRZnR4AgBXqUhIUIe6Gxh1dBxl9mKMZIay4DNlSmQoT0zWZEwr5tBqHfBFagCKEWIa9BAJCnkOKUJVkUHq2sPoXk24OOWtWArKlIOg93ne4C8UsJ_Odn0socXjyrUOZ6YKdW6-c1J1TZ84DIupXvVYSaQUJwPUdpyGyc9a2MG9Y-XVB4raqdGc6KRybS5ABkZ-m_j1Ehrjzw0i_xI6Z8GKL0afHP1utOyY8BxIdkS5VupKvN4fwk_DLH_fM39aChXjRoS2wsWEKvm0D4gRsvzvvb-3IC4TDftX_bjG9pugHZxvVactVFm9S8mHhCVdXBZ868EsOJq6Mgg-KtOYmSSey3GWTs8344lJMhlgv_C8NVPzJHZ-8qs6Nm3PoVudoIFiJzBBw-1XxnmOmHMisbZzlA538GrHOGtt5RkBH7_zOo4JnsNS7YfyHV8-enqM8jYrNfHk__kCt01CwkuuOl4AWxhgWuatSMR3gsfucWwSHOC6J0JEYouRPj1zaQ-dEiPf-W33gShKHQoVxcsobNkCs2ItMyE6TySolCvXxzwz7ijb-709CHQNC5whyHWHAmZxwIamJAsuX8vfaxcWlqEeRzYvzc9BzXJuH1wTCwYDoCTHZD7JmJ0MtIezfXgglFPZw2Muiuqb9t5BBH5W2jxqUXAEa3CnLy64HBz8WU8g5L19gEaiPcZ5zfkq7t4V48__mkpkdgZJlHV7vBX41FUGJMZIJZlExJM_DuqogyIqVN3UwBQ1jXvrb--ZPpvPRc49poEoqgmn9hgsl6r542CwkM-KdAkRLxX26Xi85GNUOCsK3SA3QVt-UU_iRMWhDK5ArPUuvRlBLv-jr5zehzYg0dYpNqYYb3gcJFVIozHIM9tC8AkrLPDOMXsCLhWYqrXpUxtDM4iTEMCr3vIC6MAdL1lm60GYeNFrxVw6t9rs0y0v3IxrpgTbz-DJ4xE6S2cB7nBpsJwNCGg3kkOQPeZ8BR3wxe8pK95EMoQ2lKQRk2FVkq1hXG0nP3JwxE1IAyEHHid1x0aDfgsy1roUCi69wh7c4eDhnByKIlVpTyDo3-jqk3tBhT58TtPTgIq0E6QAOu_BzThiJIuTVdem6kb8bLCspt14ovZgFSfUUfURbKkKI4uxo_baKUkzhKMku13MXL0i9kn2QXCpkZrDIdKsbwRoQJaFNM-RjXg17QIeS59atLq7CP9ubX5_0bOrDSrT14IgRrnmZhnZukqHxFwXdjPp1Z6JfQ0_01GJPUiMQREo7qPmg0HVR8WjFDKhG6TBxAaZ0OVmXC6htFuG8zQLgz0EtxTiRRLk-Cnt0n_eNCyXPT0_KytwP76DT-IBM1029wMC-GoAifVPnDqdC4P4zuM5ed-eDSGOf0JhNVEfMn21HhLMFwDOnbzgdlOMs-vcgretA9DQCO5pGOSOsDNclMYj2z6YCcgOlbrhqU7q0fGGpyrYakUcor1O2BoD5yJuew0-Wa24lvGW6w5-sKE2glxpuslJASOPJQtXbWisK0HLWoEsPvC-gi2GSm2BYHpxVES1eC6Wc0GR9aNaVyFuKwCeBJuQTaF1zmSTyg_kCX7AHVZI7DPgO5_S88v8mZIXRMeT7CQX3FwFWHtK908aTNEoaaYJK3_ROZ2S2P--jRxXVisESmCk2mInwYsIF-fqCLppwKl9XQ_vniaOXxi4KcAllQoBQ6SWpnu8VV_XIS_nlU9OeJbUQJrYLdwoDk8DpccZC_5J7jMTJ6XkcQX4KsGipWhr0LIBQvGg1Lol9aVx7lTaDYJiXZkoe1Zm5M1aP16tJ2ougUTgyI1ffpiE_fPF1sDBU8UDJNEjPOlY5NKI2ZQKjKRmpouLc76kNixvARDEiGWrWh3v7-SmieO7BPrO7-KhHeb5-zq6y93BSDCA8-W7AiX_FaU2Z7ob_MTkOi7ydfueOBySClJ6NNBSof3HTq2i0OqN9NLl6UPUVo4Ch_VRCcZT71nB9RH0j9-JvNrcPxK7_njtY0lGiB6SkD_gPH5AgrAh8hw2Uz_E5cgwhBEXQ0d0QNcbAzmXWI7-a1-LI-fW9HEuKF-RUAO0Tzbf8AuU24dujNPD65TuHY4aNzg4ou2oLRQfi9QNXLGNQrtqI6zgJDGWGpEGsXnjjR2FV4J7rUEx9UfjXuWEKcIeTJUCniZf2HSmAO7dQpI99wvF7PMl340tdWylGiAXHBkDHtoC13IEHNNCoQKXb6JD2YeQsX5iu7rauzkq2HWA8BqHRWtih1HgiMly-NojL-a2mO0i3nEJQmbuhxoc2qW9Umc21h487XlT0BSEK0hVMfivfLjTVZjOSLjuodWquXg7ArAji29G4nvrrZjRWb96ys_BVs4NsxR64YIBg7wMi29DvCHo5brrHFsvrMSWVM6hLZ3Rr3Lx3Wl3IXl28mWI6zYqhLulGzQuqyonf2vpxfDwoIQ2LeR-2vTWZain_x4Z35F1_l7xvx1jJHCeEwDg7D2yjwVq3AjMA55iyj-k9gElSS1bVpdqJOl2r3OGeglW5eUxabnrngIAD795El6g0fO9ZbX08KE8wLSYqBjA40iwRcd8wcnA7GDNzBoJWEqTR_xgUWfnxl2Of0BhVQeReEBesQyI4sOJVtc2R7RlKbtWM2RN-4zKgz6O07i8Wu_hjEFh0tnURdhoU47eMrJEgjINqTNF6tS_GAZCbbtPjGJOH1bbPJiWr5N8FgxPRNT9dDD2Uzf4DXZyMhlrmD0NUQ_XyE-G8e2Y5QQNURY4ZtnCaotUHx86lu7c-ohzpyEexyoXrGehxW4bkCMPMj4ksrmEGJy8Kipn8SrMc_qLryZ3doPCGHDcck3yNZfQFQ_z_lXcnW6DP9Qcwma1c9I8wd9FUIdGdAEkMoKDfoI3pphUhbZ482jyL6rwN5uipEZ_Wfjy_9fzUCHS6c7Z-jxs59Fmr76psbvlz7RPrUg3iLO0aVALSDZijJvQnmE3CZgNg5K35g7xU_GhBggDwKeFK3B2W6pqWHlTCjlSmwU-jbmeoZdM84uFHyGzh3nbWtsRcm0d-AWtM0o6efjo_xWafALz09jg_Uy5AD7LDDcTMadCc3i1g-SsuCUCHdqHhz_5jE7gaL1NMhU2PlY7ZxNbJuTIb74ekVFpiSBXZS8FJYJELHjVqnTOdpha1_bXQcAP1caJxcyYmMPiraW7IMOfd-z33ZExETEuUPIyYXOBwNPZ6REattbhPD_rrxOHrvdArjkUI9xH6-ho9jhHyxV7f2mQUzaPq4O7QsI5_U8_-oYaR84ZRBlrw&cid=CAASEuRoHcGIhjZjXONbzAywBA06UQ&rfl=2%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

27eec350cab567b43a120b0a93f0a0b70a5af6dbb609e19fb6d9f253fbbbf424

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11529
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame 2B5C 2 KB
2 KB 31ms
9ms Script
application/javascript 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=115750&plc=4171841&sid=18330&dvregion=0&unit=728x90&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&prr=1&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0imxtQHTB-UYtU6gx6hDpC8&DVP_DBM_1=3060631&DVP_DBM_2=11763542&DVP_DBM_3=32118322&DVP_DBM_4=326784848&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=353802656712&turl=https://www.reisekostenabrechnung.com/&DVP_PP_BUNDLE_ID=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 8d6487dc2599772b6ccb8ed3c214aefeddf16e73d868abb94f2223c133af06d0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:41 GMT
Content-Encoding: gzip
Last-Modified: Sun, 16 Aug 2020 05:50:11 GMT
Server: Microsoft-IIS/10.0
ETag: "ec21f1b9173d61:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 1338

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 2B5C 7 KB
3 KB 31ms
10ms Script
application/javascript 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&advid=3398311&adsrv=0&btreg=&btadsrv=&tagtype=&dvtagver=6.1.src&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVPX_PP_IMP_ID=ABAjH0imxtQHTB-UYtU6gx6hDpC8&DVP_DBM_1=3060631&DVP_DBM_2=11763542&DVP_DBM_3=32118322&DVP_DBM_4=326784848&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=353802656712&turl=https://www.reisekostenabrechnung.com/&DVP_PP_BUNDLE_ID=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: fa57c3f9d183c672e35364859903c259235517855e530d6707404031c7b3db97

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Mar 2021 18:15:47 GMT
Server: Microsoft-IIS/10.0
ETag: "80cb748d591bd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3005

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 2B5C 2 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/window_focus_fy2019.js

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:31:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 155
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:31:06 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2B5C 117 KB
36 KB 43ms
29ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

941c260356b6aa75782a27384179a63581c9e41b42155774982f36b0d84cde9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615980836519751"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36389
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:41 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 2B5C 13 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

570c04b30a5c8fa6ceaff96ea6d3a0dfabd85dee3edae40e38b0344a7278f254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 56
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5991
x-xss-protection: 0
server: cafe
etag: 8832118191516519848
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:45 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2B5C 42 B
498 B 58ms
38ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CFvKUTpG_7erSH7gs0PlGp1-3Z1no0thnkmWj3-kDVgT4dzCRyLFDho9x8Oer5wEZw4XhkpeiW_HFD_7dxsbPmIdk__Qekg0BhJGtEosOBO0ZG59E

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
366 B 25ms
24ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8xIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDI5MjkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6Ijc4MDMyNGJjYmUxMjJhZWI3NzY4ZDk0MjQ2ODYxZWYyLGFkMDA2MWEzOGRkN2M2ZjdiY2I2OTJhZWU4OGRmZGE0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQyOTI5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzEiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MC4wMDAxNCwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDE0LCJiaWRfZmxvb3JfcHJldiI6MC4wMDAyNiwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8xIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgyNDExMjM1MTcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDI5MjkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiNDk3NDkwMjgzMiJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4e65a0000dfbf708ae000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=jQhFbQNwngDdKu4hvorK7%2FwNa5A0df6pahIM83IodkDxpn6asXqreHj8%2BE%2FcF0f%2BOKDdlqnS5ql8US9Fxa1zOrBQLLYdH4mqPE2zUrEejPIJDQ%2ByRZcvXpon%2FajoOaAm39z7BHH%2FiZkpQA%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957509f05dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:41 UTC

GET
H2 200 4974902832 Show response
g.ezoic.net/dac/ 0
17 B 26ms
26ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/4974902832
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/porpoiseant/banger.js?cb=192-2&bv=13&v=46&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 17 Mar 2021 21:33:41 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
289 B 26ms
25ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8xIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wMy0xNyJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIyIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjMifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTYwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4e65a0000dfbf36bb1000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=wVpS0o9XBq51MMiKHTP%2BV8maY3%2Fq0R4dT%2BgUvQaEH7FRcsX1e3RdZ%2FQfVlOJEaqbNcDUei1YUWQY83hhskQfPi0yIMqltDKDL90mtrUxx%2FZj5%2FeGneTeNQnVmowxcmBYStDCbIUmP3HZ3g%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957509f07dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:41 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
290 B 25ms
24ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8xIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYXVjdGlvbl9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJiaWRfZmxvb3JfaW5pdGlhbCI6ODAsImJpZF9mbG9vcl9wcmV2IjoyNiwiYmlkX2Zsb29yX2ZpbGxlZCI6MTQsImF1Y3Rpb25fY291bnQiOjQsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjM5MCwibXVsdGlfYWRfdW5pdCI6MSwibXVsdGlfYWRfY291bnQiOjQsIm5ldHdvcmtfY29kZSI6MjE3MzIxMTg5MTQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMn1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4e65b0000dfbf7fa18000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UdkhInt1XF%2BEpGO9PtRVw76DL0bOQ1LPp%2Ffkazm7AvO%2FMQMsyfFn1lXNkUd5TOcwPIQvqHkiU%2FdSD8gkV2VxwN0C6nPO8SimE3QSzAAk8m0gfhW%2FG9Y7ZCvol74IC22YNH%2FPkOl4zviLKw%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957509f08dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:41 UTC

GET
H3-Q050 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame DD9E 656 B
475 B 40ms
39ms Document
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjQudGZATAB&v=APEucNXvBd6uvEjRC2PlZBt91Bgp6b1SN1BferOMnjqpCcYiaF_keILvN0Pe-0QEJENaVhXGY3xF5C-1tPogueURAFMvnhvGnsL0fnldSU4zBnxo7eLEdBDygEVViSXI9gk_OUGTo0avI1hRN0IoNmfU3nt6TZb8yt6_6aB_0SpvE9b61u2EEl_KzdKR0E3YZ0pb1cAQlb27Mr_MxAY_PNcELOCIpTpEWnhCqgdNczIUwSyVGRtraFk

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

1170a116f6521465e0d4f0df36d070b1502f257e88dbeb459d31d3e2c3fb861b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJfnugEQw7j0ARjQudGZATAB&v=APEucNXvBd6uvEjRC2PlZBt91Bgp6b1SN1BferOMnjqpCcYiaF_keILvN0Pe-0QEJENaVhXGY3xF5C-1tPogueURAFMvnhvGnsL0fnldSU4zBnxo7eLEdBDygEVViSXI9gk_OUGTo0avI1hRN0IoNmfU3nt6TZb8yt6_6aB_0SpvE9b61u2EEl_KzdKR0E3YZ0pb1cAQlb27Mr_MxAY_PNcELOCIpTpEWnhCqgdNczIUwSyVGRtraFk
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl-bXIGMJ45jSICbpEAsfl3M2XbQ3afWFCc2ep4Vcwse419QXHDrCN6dwpUmkM
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 17 Mar 2021 21:33:41 GMT
server: cafe
cache-control: private
content-length: 284
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3FEC 23 KB
11 KB 65ms
62ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CakDbbBXNpwcEVcDTqqRR5SOFqtZdk0GexMZ8jX4mUJRw1QpvZKCXbKekWkaiIv_3fnMLRIKAlgKdLae4oZb-h0JV4DhL-KsT4w2XJpLXS6HnZrh1My6Erq_mvRWfw3b5jZYYf1xgJhBTt6WvJ7bsEj2GuWA&cry=1&dbm_d=AKAmf-DnTnH325XmpREuVgBHYsjQaawAzQqZMcpGqJ6-Grhgo67V3Df9r5yQ2vSphvx960FTtvX6sG-AC2EAnk5ZTBp1auMEp0zXX3mDwsh9Oea1bpx9tCNmnUkXlC8g13kh9AreC_8tAIzsnez4PL_guAGuK7nEDxMQwUx18N0pA9DE-qUUPZm1Mtrlp5qpvlj0wNKbu4IvsMFxMkmpgVJIqpaY0lAQ1gX3eK41fTGBsGErUCggU_Pf2mWFNBOkDyEqQAPt3iYbPLlNCqxpL7q1LXMHhTggm-1zNf6mHIcr97WJ9Km2q__4S6TdrWlElfLkd473nIgYA2G22B9nt2K0GYHcBaGRNtDhb36XtK21ShE95ctwjGOdfekyciZnFqCJjAgRW8Fbr_AZpKT6dLxx0_y0RnCwCwNjvCx4afzuLpnDAYUMoHgeRkD4mIfCBCVSmwRXMdKyyTWvgCvArsz_a19eMLqU9Y-TowPDxgHidRyQLMVne9NLcwfwnfo28uyb7TNe4NaUKljK4X7bsDbQUE5nBz1GaGJOCujxiDgU9u7qwgUeKZI3FDWZGVnOObTtqzrNLufxTfL6rtzw4rEHNDhjV460XhtZbc_TNX00FryrK9a9Ptq5pirhki7S_ujBCnLm_6HFLrcePG2aA6OCQdwDCEAwk7IDoWp6RYuamZLAsUFaGatA-cfCOQaH_3UahxBx8_qUY5YHcV3g80ia13uxwl_BgcbHw6vVbsJg1C4tItSrbEhVUVnI_qHfZ68hAa2JU6c6gslnKUpop2xL5lU_XzmpZKy6b-ze0Yw41wAARaYrWKkoDFWSJ05FPA8KIfTzQ5n7iPy0Fa152eVl7zjCilrCFv1zQExj9hOJH8Rqg7Pc28tEstz7jFC2GKgqWdCnE1pObn2cvPf4O3xseGgqEYgWeJKkPBu9ESxWu9J9x66LERhBmFLb6zcN-c_kdS_vspdxy8rAV1JZcu-id4MqH8Me0nDmNBQcIS8PcwxerHK-VR5RojoQpK66u8VFmhoMOrr4oG1jnCUVXk-jbR4LBJk-n6QhBoaTpdber-71M7NENn8EGU1S6AYR9NhUGbdvVEoBLyGpD1lxRoZm7AJQnsoTxCWJsIFwMLIduXUMKBOZ1UXPZxS3d0XFgwLXEeeiZ3FLvnb5-LZzJqgsB6kh0pL8i6P5FMkQKBqa27wEYx7b7x0UgbyHth62-VS_2Fakgb-CSnpapIu26bxiB9Ebb-yB4q6-XT7uTCMyMmkD6V6h53QrZ5JGwZdTG3YOIeJUEl5qlbiZPDU3b43qZHS-dCED5gm27DWKTG-AsowVFjfkpY2yNwhnO9Wg5duccZMwmWwPnUJiKlafbQ1slCa3cveW_7SqOB8RsfCXoF27BgBjY1ZwmeUl9WK4zNenznelUN2LRkk9MLLqIqnf6yfJo3V7oxNToeJXm-ZUi1AlLRCZegTtUAPDoErRZzDRiK6gce8hcKAbaJZ20szAspEBMA_d8VcBvufVDe-iNFyQP8HQVN3PQ640kAu2vKFh5iTjz-08Vav7gAMWOQ6xf6t_Mllb08ddiA0mbOuoDAUm2kautWSx2eD-WpGcvnZ1GI5W1Y5triKqhjaNRxc8MEaeQZxJVUyrD48-00J2b_aXgAakwnfbvB9sKjI6RIzFV0jViawUFkUZiKzdD85GnV856We0reuKpXnyNWEzjAFvgQq0v2pVXrlhfy7jOanDNKUK-1zo6QO97RSBlVjXcjVeCDWdrsupVJX8nD_uGQPFZ15_NgG13hGABmVStO8DiJaVAIPLUBQX-s7cVZYSA8frOZq-bEQ0Hw1TnRip32gVYdRGz6HZj3zHjl0MJFIemb0FCQsGF1wuvfBMl8YcCAc5KoXKBwIlitCzhvXlS3NB0lizi-BHyekhYgIVXTfhGpgs6n8cVSIjAyTlU7NTsbbpkF0I1jOM9rZvXWFOxMOexd9ayaZuOu4Piejf55LhrsUhNuvn1CxhhhXNzyxqdriWnYnD-cs8q7TA971E7qPgoet0nHzywbvxtFMQTjVK1n5L5sG0LVyRMzIL3resMJV4tul23dKC2C6ngPjD7_8Nor56Vc9WcVXj5-h4tsTe8gkdlEzSLKxJfI9M6OBRaB2tl6HBFZeuP2pheY8u8VlnicxM7FdJl63d_kAFuGBO2UT7ou4Jay0f9Wdg85Oa-FBZyJXJPX-n2JJRUC9vHffWuziF4YhAfHZ457_AmkBT547oKyuQIbtR2kuXHHCd4uKedrE1mSHWH_Gja1qnYQOJPyvdN1v4HcuJpm916CtN9J_u3xjcxVuUFEeQ8A9AMOBSY9MFypuwAEAdua1Js3NTDV8-CM1vlgZG2dgBgyvNz60H0_GMz6Iwn4GQ-UlZk8v8vBYtu4AYrdTcjkizi6YDDjTNaflRKhuBRtrlSbS9p_B7TlUsAMBt40qRxdsb-j5SUtgoPDrurLfIzQhGtZ0hwC8QrTL-P5NJ7NThj5l3sfceEznF6DR1yivF9XIAkgaZaZg5XwuHdAallG3YEjWkuNElEFfFYrUC5doAFDGOgQi7Iu7_FBv6Nf-Jfb-a1WahbXJggD_Qf7XqeWBksumc2-Po0Dd4aXeAgz9SigZVP-qMIRy7-gJS3CwSU8qim1GFcj7ewSKb6Kd6wInv2C7Fz_f9rcPGh_72X7e7CB8brpf4u4pSZ8wlJR5sYHTWBzehX1xjLZOjQD9fQT_rbCTSDezuXBe91s9T94pC6QCRilmPaWkQpcb-SxxQnIIM0Cf6ejsWSrjUwRL_ggG_T_UgrCEvFR5_E8R2LEOsqgow9WYt_oQop4weL9tNnZnGqyVU3lkjdLXwuaEwEzDVgOYfnTA_oy0WeQPFd2bN4cCDq6BRveRmJGCtoMNfDDVROlBDKxNPxU4WZ6VEXKe0ZyVo1KJ-nFsS3UDRoiwvv7-4PgN0HYcJEFsajqfoiCcHOz88dDYaMT8eZ5NeA7i4yCdSpTb0Zcw3ck8SVnc6JvM3m3QKFCu4eoMD6kC4QiIJ0vIexG89X5js1dbnZi9YIFwogu4fpHXiGJDc0exvkg1JbRY51rIYjDT-EcPKv1NmUjGVZGciMQhewAXHKysEc2uKaTMD2wd26DLqcNB_0i-jqY5az6gfBHmP-jZEQXhrIn7RR9prvlM-2QPLMEFx8_EvnPd2HL_irUCPJwZQY1R6oColqQxeVwy9_9zUUZc6_2rQ3hyCX8rQWyE8kc3gM19rZchID1WSbJeb89wZ1D4Yk0mb7Cc3&cid=CAASEuRozjSN79n9dIGzGp2Jn8JycQ&rfl=1%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

acaf64465266980ab0ec564d519cef9a9de50bad211281054dcf53e6d9927a33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11548
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3FEC 42 B
107 B 43ms
37ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C1pF_pOPRLmkKMlpn5eC0aiw8k2bpy9MrDzg6n6CbXfp5v7neuPr50bL1eIa1GoIu9YFXLZBXWRoFelWpSispSEAuGkSHoWcqBf5UYd3uG4EiRFuc

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame 3FEC 2 KB
2 KB 13ms
10ms Script
application/javascript 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=115845&plc=4229316&sid=18330&dvregion=0&unit=300x250&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&prr=1&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0iYBflHIXTYXFl5zO5Olpav&DVP_DBM_1=3060631&DVP_DBM_2=11817068&DVP_DBM_3=32229098&DVP_DBM_4=322198736&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=353802656712&turl=https://www.reisekostenabrechnung.com/&DVP_PP_BUNDLE_ID=
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 8d6487dc2599772b6ccb8ed3c214aefeddf16e73d868abb94f2223c133af06d0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:41 GMT
Content-Encoding: gzip
Last-Modified: Sun, 16 Aug 2020 05:50:11 GMT
Server: Microsoft-IIS/10.0
ETag: "ec21f1b9173d61:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 1338

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 3FEC 7 KB
3 KB 12ms
9ms Script
application/javascript 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&advid=3398311&adsrv=0&btreg=&btadsrv=&tagtype=&dvtagver=6.1.src&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVPX_PP_IMP_ID=ABAjH0iYBflHIXTYXFl5zO5Olpav&DVP_DBM_1=3060631&DVP_DBM_2=11817068&DVP_DBM_3=32229098&DVP_DBM_4=322198736&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=353802656712&turl=https://www.reisekostenabrechnung.com/&DVP_PP_BUNDLE_ID=
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: fa57c3f9d183c672e35364859903c259235517855e530d6707404031c7b3db97

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Mar 2021 18:15:47 GMT
Server: Microsoft-IIS/10.0
ETag: "80cb748d591bd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3005

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 3FEC 2 KB
1 KB 11ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/window_focus_fy2019.js

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:31:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 155
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:31:06 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3FEC 117 KB
36 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

941c260356b6aa75782a27384179a63581c9e41b42155774982f36b0d84cde9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615980836519751"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36389
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:41 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 3FEC 13 KB
6 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

570c04b30a5c8fa6ceaff96ea6d3a0dfabd85dee3edae40e38b0344a7278f254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 56
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5991
x-xss-protection: 0
server: cafe
etag: 8832118191516519848
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:45 GMT

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame 3FEC 0
0 18ms
13ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSM5j2xHGrzZWASB11LtD_Owu06NCnOBuNv43M_0ZQa_z47y2XItRoUWkZZ4Gf2n5I7o40k8yh792156w-X-h07arGfCg
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-Q050 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 5E83 656 B
460 B 39ms
36ms Document
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CM-nKBD9yigYrdL3bjAB&v=APEucNU7xCrF81jCmgfMo1L4Mh3FKPWjQTG42X0dmktpKTfNPclwy4TdHEYIU_o5-hZ2va1g2dBoK44-DRyVX999Zb1of2LOx0QdcjzlTlRf11UBIkoTg1POuneWNPqYdsViyi6jAMC0EsOvXnPn1jJ1o9j_JtLnjJPX8KLOp8oTe6AxgkW1Whb1-JvKtFBkpV9beSYFiHxMTQqtdE2Fsi6aphvsjQEOKR1q6204fmxixYJocaE0f9U

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

1170a116f6521465e0d4f0df36d070b1502f257e88dbeb459d31d3e2c3fb861b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CM-nKBD9yigYrdL3bjAB&v=APEucNU7xCrF81jCmgfMo1L4Mh3FKPWjQTG42X0dmktpKTfNPclwy4TdHEYIU_o5-hZ2va1g2dBoK44-DRyVX999Zb1of2LOx0QdcjzlTlRf11UBIkoTg1POuneWNPqYdsViyi6jAMC0EsOvXnPn1jJ1o9j_JtLnjJPX8KLOp8oTe6AxgkW1Whb1-JvKtFBkpV9beSYFiHxMTQqtdE2Fsi6aphvsjQEOKR1q6204fmxixYJocaE0f9U
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl-bXIGMJ45jSICbpEAsfl3M2XbQ3afWFCc2ep4Vcwse419QXHDrCN6dwpUmkM
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 17 Mar 2021 21:33:41 GMT
server: cafe
cache-control: private
content-length: 284
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 1B53 55 KB
22 KB 58ms
56ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ai4to2xQxic6eyLMK0kC3x0twP3dGOSHl-YSt5H2Z6HFaLVLERequCCvBUErsuScflOp1tn7cHAmIqCSTaE3lwWeqsxwwaqAsv-J656G3ObvT18Gze3VQ5b9-IeBnyBmzhm_jV9TZeQYJm2rk46oRcNemqrg&dbm_d=AKAmf-DYBbYSDplEq3oXTc0Kno_bX9pjLr841IIXW3J1mfjM8yILRaQIsiUaAX5WrA4UrdZlHLu0N589vgtigh4pDPaDQLlh8jOEC8DQPHh3Dyjm-oWRcVaNPoUiD2JWm_O4BMAcwfc9jn2uyszWblTEEZsfRS3lC3gnci1dQBxZnhZKDrC1rJFBXmK4Mn1XClX8mUOo4hiHOvkFZwHgsGA-refiLvBZr53mt8lO1HgM47azoJOpO6D85syj9EGrwJx-MPY-len5IJIwxcr_L4KnvrnYU1Fkwy_pje16KjOqQerfLHJpPynYCyU61tMNtyU5IS-9JesW71jRf8YQ85o9vxvYlwXffONg_UKt9qBs3yNhHPWsCRZlIsLWvpg9C4GaW55cXD4iGfkUQod0K71Vb51x0nSSDT1wWhKtxbeIP8ZX0KAVTHC29hylWPUa_KDbkqnO6KkjCnACCJnkzuChSrS6cD31HD_pCCl0EvJYPAQP2aKk_6FSYtQGhSwLRozNF1JMwH_aDvvduaA8JEb3dShyoRWKTfyof9E6YFLc5UOBQodlqOGr1y94YKG4aWDEcw0gOY1qfZR90Fdg2tkuHqf9AI6_2NXM9w6JbhzW3DUWfSw-EX2ECrqhrB3j4isXNGpbLnoximthGsWD56zI7oQgPwhSjz379mJfjanrMvQOd-o1wR3gIhNU167Jf3fGRB9MnWAGB3h-YqZou7R9Qvbjcm3WBBYIYL-nFJ6Mc5vz1pbD7GQ2K8lZtNA1cZvQlSfkt42RToLKBV5wBv9YwS1GJTUcwlZtlQKllqexGOpzyI9Qivx7dfQT1D602MdcoB02Ud4pWgudC9tFioB0qs3WEN_JjlSWtX3FHFrpNmDK1JUtZeUlv3-BtcjVLZAEUWJrHVMQI5LyUdI_ggSmjFvEI_lufn1lEOEPeEqFa52B3vtx1l3HMVq0rnKZM81--EfR0tvBVOWkM8x6Pg7bq6LSgkonSbLmrQjlHGLfkOjgOGzhORR0DNtu3JSqAGflNdWdny6pOUvfWgJcW1EwwPHdW_OIVDEgVXQ89FXdzalE-0TOFMN2hMAliZSQgv6BBfHo-VfvG0aBq8TZlYlnxMdNmu3zYmXGT1jYQXL_VIFODP_WV3OcDIpmMKsvQsO3pa0PdffQVHW2mI0G8gzTgSS0mULAH23DA3aaK_fBH86nLbwsBUBgrsuiX5akabipm2y4TqOVI3mCdlHAb8Ufz4bUQR31YZsTIYu-JQmEREOg7MIuabo1HkobKOKVDCZcfrvf38VBbEYWndDzhdcTH15c-J5GePFE0VbYfrvQXW9VL3deF-8ArcaT5cAC18Y1HOuHOzDJIHAZrU-2T4GN1PeOVkE6MZyFMjdfxS48gFpHjMscNxHzoI13g23dPT4SHg0OcVpZd64U04O4ff5D-Tlq8dT-WTSFjs2mHDgLDYpbK5eI5NkOhvLSg7shdZra6GfK1RbUweMbeOwjqkrO8-VzgdKj-hYMI95jSdtLzEVFxzwrZtUtzR6Rnuzgz7CivMtlCCynK_N62L0L69BA4Oj7cxIqBAMOJr_1Yyf4Nb-ms2ZztEpQ-3LsyXSOa-UDJjiq2RFPUaF9DMmWx_s6EGTk1-wVvIOFLX7tH3di785JarGSNwsPKWMz1jnaGf-6ZTvPaHXp7cdh4cYaUixZqLBxeCmS9gn8sJiq4qzgYFToqIn4KaehSJ_zTbd2g5q2Kh3jp1TqCrN0FBaeiiTBDGKaTfrEKRJVrsZcmaoj4cbupZPOpi1p0U8ee4VJ8nUDTKoX997EaZsrqCrMrZ07D40yoiJXN-I4CS6wP2aFV22OTNzsceS39tdYJ-0VXbPRpsPvrj-qKcDwHp92RiH-RjbcdBqGVWkCPeUdvfXhS3CaxBZnpdVdnO8RtAPoKeHuMDMgqWqAnwcUzJmgqYbIG01qOAwCCUjDqE_eHnK4KWXFa2SkVeU66vtwGYq3u0H6eLw9xJhZpz1E0nCLi93TfHgt9T8j-8o1VmeToldmeDNWOnH0W1idCu4qbBBjs3ObHOLLuQUW6UrwOXKaqWiK9iYv-aV2NT5WFjbl3-ZOxdTkB6GqqsDsD2XY6fdwkcMH3d1bTxO4dZJ-racCa-4h3ezMNvavurr9MCJUlLa28JeOQOxz7CkJtkeesnKzcr-HzDrXymCeusjmxLL_efTpP0yTtW4eAPs_TSFYUrtWaVNlNk-RGcJfhCfJNw5AADqXhbO_DrrjfYMpuZheShETsLmYKlnO3gXXrv_gjvi3xiwOZ6FmBrNYwPyecLJgVj-lynBBSKczyhj7O9DE3XS9HJotW9Xjy0wA5lX1B7xvboSmdsOMBi28v7DjRMTYXr_dAnolbGt52f2uhZr0VXhTexJTxcRbfBYHeTV2SOUnpK0ABXet1Hghy-jnhOurtAZUQhlg3TdFdP5CICZG5RpkXAgKSNzQEqmJ3FXWS7eIVy_q6ulZ95KIsgRn8pU2Azmdww_ibf5PTIE3yEuDYCQ5nDqp3l4IGSLDJiOt8NJCr1h5J754W5uJOfPANrboxZVgYwmgxi2LWp63oT9ql4GqYxYkkEe9I91tm5msVBGI6qov02iCEmOHesK7byYW72zFgCz5zDjFzPY7RfVjPbe62rw2GNskTVA0C-ya4zk9AHP6-D5xPP9b0sng5gRTZZi8XVLDQ2dtWmHfUmLG8KA15XkbxsiJdVZ_Bp40BD_8OieExoaPbxkaWRkxdY0Hz1nq5n1Oa5r-NwBNBU21_MgvrJ1hRGMt0SnStJH-9u81dgG-p1FaLOXwap653diB3Yy1RrxzLPAICq_wPL0UDNaSp5zcvDBNW3h0OckiaZV6Z30CihFR-mBSfYB9v2Lz-SzbYDEQUcuXcbhjd1eo6mjI5TBH2BfhZ3DchOENmQAIiu90ZJuBzgkdvY4pbCaHjkq4ZSaSPD-ZSW3b_CTsmVBHcifxnfHAvel5_ZyNpBevvdPRmzXrvEOitHZxAy8kk_Kj7K69nNgTjW2jPIcS-asI9AJbg1kH6N0hLsf_tEKqlrSELja9nyd5JxvRAN53EUgvpXfx91PZbpwbEpeUp8RJH3Fvy9O3xCdMk1fwZefYfvMGyeaQgLGw682ocyQhe2tJ-JH6wC0QVSeRetyB6CqNCx5qBvDZEAv3gTyDbzb3Qtw1ml3d_mFwStBz42jTswECWpGHf9AjDQDBrL00vJFfkTuJzsr3Gl2GWgdSu7CsABvNQ0mAyNE&cid=CAASEuRogZ35CHGTj4lG8hwvMqZ3oA&rfl=1%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

97952878d17a7f73936246ad05d0e401e5d6a4eb841f75ecfec366673dfc9e2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22642
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1B53 42 B
107 B 41ms
39ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Bu6uTvsyh875fsdMs4tfHF_VdR9tiqZslvap7tWGOy8eP0SLomYmHXjQnhFvx-xOJLSgHF5n9ACmw5x56DvZM8aB5F0oEgtn_xAQ-bYhvyHRhQbnU

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 1B53 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/window_focus_fy2019.js

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:31:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 155
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:31:06 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1B53 117 KB
36 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

941c260356b6aa75782a27384179a63581c9e41b42155774982f36b0d84cde9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615980836519751"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36389
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:41 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 1B53 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

570c04b30a5c8fa6ceaff96ea6d3a0dfabd85dee3edae40e38b0344a7278f254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 56
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5991
x-xss-protection: 0
server: cafe
etag: 8832118191516519848
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:45 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9C4A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1&C=1

43 B
1014 B

70ms
69ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjQrumbATAB&v=APEucNXEVdjzJv4Z1_mRNmg171JGgXiVhxZY6SP1TFwKhoCrw-XTmb7C3X5rHlyoH9b5nNmkUGj8Jb08E1PUoO7ONuptC9gVW_vQLd9nl9b6g8s4a8u-lXKwCyBZ3LDqnl9vDY_QYa6RvEh3HkFn7lh69pQk4bu93rJ7-2zDUjTiAu-Ud-uZVBEeByEVizpJJ_8Y7WCx2hnWlA723x3o9-OFLgeF8JxcnEj8pCPn2zULSc64Vp5Qlsc
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 17 Mar 2021 21:33:42 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Wed, 17 Mar 2021 21:33:42 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9C4A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YFJ1tpglDO4yMV6sKhW0OAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1

43 B
894 B

49ms
49ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjQrumbATAB&v=APEucNXEVdjzJv4Z1_mRNmg171JGgXiVhxZY6SP1TFwKhoCrw-XTmb7C3X5rHlyoH9b5nNmkUGj8Jb08E1PUoO7ONuptC9gVW_vQLd9nl9b6g8s4a8u-lXKwCyBZ3LDqnl9vDY_QYa6RvEh3HkFn7lh69pQk4bu93rJ7-2zDUjTiAu-Ud-uZVBEeByEVizpJJ_8Y7WCx2hnWlA723x3o9-OFLgeF8JxcnEj8pCPn2zULSc64Vp5Qlsc
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 17 Mar 2021 21:33:42 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 9C4A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHKtBlqDTVpv9xTLnguCd-4&google_cver=1

43 B
1 KB

34ms
29ms

Image
image/gif

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHKtBlqDTVpv9xTLnguCd-4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjQrumbATAB&v=APEucNXEVdjzJv4Z1_mRNmg171JGgXiVhxZY6SP1TFwKhoCrw-XTmb7C3X5rHlyoH9b5nNmkUGj8Jb08E1PUoO7ONuptC9gVW_vQLd9nl9b6g8s4a8u-lXKwCyBZ3LDqnl9vDY_QYa6RvEh3HkFn7lh69pQk4bu93rJ7-2zDUjTiAu-Ud-uZVBEeByEVizpJJ_8Y7WCx2hnWlA723x3o9-OFLgeF8JxcnEj8pCPn2zULSc64Vp5Qlsc

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
X-Proxy-Origin: 217.138.207.188; 217.138.207.188; 693.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.141:80
AN-X-Request-Uuid: 098cf8ea-cd26-4a60-8877-4db394d7953f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHKtBlqDTVpv9xTLnguCd-4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 9C4A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3ODIxNDk4MzE0OTI1ODMxNw%3D%3D

170 B
190 B

79ms
48ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3ODIxNDk4MzE0OTI1ODMxNw%3D%3D

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
X-Proxy-Origin: 217.138.207.188; 217.138.207.188; 693.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.228:80
AN-X-Request-Uuid: 68d2e175-d46d-40fc-badf-a0be2e944096
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3ODIxNDk4MzE0OTI1ODMxNw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-Q050 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/ Frame 2B5C 21 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BXZzVbShdvDpS_5HzgnEseC8YcO8DKgzGZghKx47tPHRUJq-YSaTFXzkp3bNq1J0rVY-Dg5gda7P1HcEuFty2xqGZFhByGIYz3C7_RjNjNe8qVTTKq2ivwkvf3DgbsbyalNzC3YqC-ORbR_sjyXOUSrRKDnA&cry=1&dbm_d=AKAmf-CGL-tPYQZYmqtmeO3yqocDnqVa11KzUEafQRmMZJlRvjYPno2Z9I_OoNZVkwZSHYck0mzAQwX0tKUpRZnR4AgBXqUhIUIe6Gxh1dBxl9mKMZIay4DNlSmQoT0zWZEwr5tBqHfBFagCKEWIa9BAJCnkOKUJVkUHq2sPoXk24OOWtWArKlIOg93ne4C8UsJ_Odn0socXjyrUOZ6YKdW6-c1J1TZ84DIupXvVYSaQUJwPUdpyGyc9a2MG9Y-XVB4raqdGc6KRybS5ABkZ-m_j1Ehrjzw0i_xI6Z8GKL0afHP1utOyY8BxIdkS5VupKvN4fwk_DLH_fM39aChXjRoS2wsWEKvm0D4gRsvzvvb-3IC4TDftX_bjG9pugHZxvVactVFm9S8mHhCVdXBZ868EsOJq6Mgg-KtOYmSSey3GWTs8344lJMhlgv_C8NVPzJHZ-8qs6Nm3PoVudoIFiJzBBw-1XxnmOmHMisbZzlA538GrHOGtt5RkBH7_zOo4JnsNS7YfyHV8-enqM8jYrNfHk__kCt01CwkuuOl4AWxhgWuatSMR3gsfucWwSHOC6J0JEYouRPj1zaQ-dEiPf-W33gShKHQoVxcsobNkCs2ItMyE6TySolCvXxzwz7ijb-709CHQNC5whyHWHAmZxwIamJAsuX8vfaxcWlqEeRzYvzc9BzXJuH1wTCwYDoCTHZD7JmJ0MtIezfXgglFPZw2Muiuqb9t5BBH5W2jxqUXAEa3CnLy64HBz8WU8g5L19gEaiPcZ5zfkq7t4V48__mkpkdgZJlHV7vBX41FUGJMZIJZlExJM_DuqogyIqVN3UwBQ1jXvrb--ZPpvPRc49poEoqgmn9hgsl6r542CwkM-KdAkRLxX26Xi85GNUOCsK3SA3QVt-UU_iRMWhDK5ArPUuvRlBLv-jr5zehzYg0dYpNqYYb3gcJFVIozHIM9tC8AkrLPDOMXsCLhWYqrXpUxtDM4iTEMCr3vIC6MAdL1lm60GYeNFrxVw6t9rs0y0v3IxrpgTbz-DJ4xE6S2cB7nBpsJwNCGg3kkOQPeZ8BR3wxe8pK95EMoQ2lKQRk2FVkq1hXG0nP3JwxE1IAyEHHid1x0aDfgsy1roUCi69wh7c4eDhnByKIlVpTyDo3-jqk3tBhT58TtPTgIq0E6QAOu_BzThiJIuTVdem6kb8bLCspt14ovZgFSfUUfURbKkKI4uxo_baKUkzhKMku13MXL0i9kn2QXCpkZrDIdKsbwRoQJaFNM-RjXg17QIeS59atLq7CP9ubX5_0bOrDSrT14IgRrnmZhnZukqHxFwXdjPp1Z6JfQ0_01GJPUiMQREo7qPmg0HVR8WjFDKhG6TBxAaZ0OVmXC6htFuG8zQLgz0EtxTiRRLk-Cnt0n_eNCyXPT0_KytwP76DT-IBM1029wMC-GoAifVPnDqdC4P4zuM5ed-eDSGOf0JhNVEfMn21HhLMFwDOnbzgdlOMs-vcgretA9DQCO5pGOSOsDNclMYj2z6YCcgOlbrhqU7q0fGGpyrYakUcor1O2BoD5yJuew0-Wa24lvGW6w5-sKE2glxpuslJASOPJQtXbWisK0HLWoEsPvC-gi2GSm2BYHpxVES1eC6Wc0GR9aNaVyFuKwCeBJuQTaF1zmSTyg_kCX7AHVZI7DPgO5_S88v8mZIXRMeT7CQX3FwFWHtK908aTNEoaaYJK3_ROZ2S2P--jRxXVisESmCk2mInwYsIF-fqCLppwKl9XQ_vniaOXxi4KcAllQoBQ6SWpnu8VV_XIS_nlU9OeJbUQJrYLdwoDk8DpccZC_5J7jMTJ6XkcQX4KsGipWhr0LIBQvGg1Lol9aVx7lTaDYJiXZkoe1Zm5M1aP16tJ2ougUTgyI1ffpiE_fPF1sDBU8UDJNEjPOlY5NKI2ZQKjKRmpouLc76kNixvARDEiGWrWh3v7-SmieO7BPrO7-KhHeb5-zq6y93BSDCA8-W7AiX_FaU2Z7ob_MTkOi7ydfueOBySClJ6NNBSof3HTq2i0OqN9NLl6UPUVo4Ch_VRCcZT71nB9RH0j9-JvNrcPxK7_njtY0lGiB6SkD_gPH5AgrAh8hw2Uz_E5cgwhBEXQ0d0QNcbAzmXWI7-a1-LI-fW9HEuKF-RUAO0Tzbf8AuU24dujNPD65TuHY4aNzg4ou2oLRQfi9QNXLGNQrtqI6zgJDGWGpEGsXnjjR2FV4J7rUEx9UfjXuWEKcIeTJUCniZf2HSmAO7dQpI99wvF7PMl340tdWylGiAXHBkDHtoC13IEHNNCoQKXb6JD2YeQsX5iu7rauzkq2HWA8BqHRWtih1HgiMly-NojL-a2mO0i3nEJQmbuhxoc2qW9Umc21h487XlT0BSEK0hVMfivfLjTVZjOSLjuodWquXg7ArAji29G4nvrrZjRWb96ys_BVs4NsxR64YIBg7wMi29DvCHo5brrHFsvrMSWVM6hLZ3Rr3Lx3Wl3IXl28mWI6zYqhLulGzQuqyonf2vpxfDwoIQ2LeR-2vTWZain_x4Z35F1_l7xvx1jJHCeEwDg7D2yjwVq3AjMA55iyj-k9gElSS1bVpdqJOl2r3OGeglW5eUxabnrngIAD795El6g0fO9ZbX08KE8wLSYqBjA40iwRcd8wcnA7GDNzBoJWEqTR_xgUWfnxl2Of0BhVQeReEBesQyI4sOJVtc2R7RlKbtWM2RN-4zKgz6O07i8Wu_hjEFh0tnURdhoU47eMrJEgjINqTNF6tS_GAZCbbtPjGJOH1bbPJiWr5N8FgxPRNT9dDD2Uzf4DXZyMhlrmD0NUQ_XyE-G8e2Y5QQNURY4ZtnCaotUHx86lu7c-ohzpyEexyoXrGehxW4bkCMPMj4ksrmEGJy8Kipn8SrMc_qLryZ3doPCGHDcck3yNZfQFQ_z_lXcnW6DP9Qcwma1c9I8wd9FUIdGdAEkMoKDfoI3pphUhbZ482jyL6rwN5uipEZ_Wfjy_9fzUCHS6c7Z-jxs59Fmr76psbvlz7RPrUg3iLO0aVALSDZijJvQnmE3CZgNg5K35g7xU_GhBggDwKeFK3B2W6pqWHlTCjlSmwU-jbmeoZdM84uFHyGzh3nbWtsRcm0d-AWtM0o6efjo_xWafALz09jg_Uy5AD7LDDcTMadCc3i1g-SsuCUCHdqHhz_5jE7gaL1NMhU2PlY7ZxNbJuTIb74ekVFpiSBXZS8FJYJELHjVqnTOdpha1_bXQcAP1caJxcyYmMPiraW7IMOfd-z33ZExETEuUPIyYXOBwNPZ6REattbhPD_rrxOHrvdArjkUI9xH6-ho9jhHyxV7f2mQUzaPq4O7QsI5_U8_-oYaR84ZRBlrw&cid=CAASEuRoHcGIhjZjXONbzAywBA06UQ&rfl=2%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

70d82c6075989e0082b4917c6685f5f6bec1e673d0a80160eac61b3f1cdcb1a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8471
x-xss-protection: 0
server: cafe
etag: 753583566593306265
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:49 GMT

GET
H3-Q050 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2B5C 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 17:30:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187367
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Mar 2022 17:30:54 GMT

GET
H/1.1 200
OK dvbs_src_internal79.js Show response
cdn.doubleverify.com/ Frame 2B5C 53 KB
17 KB 10ms
10ms Script
application/javascript 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal79.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=115750&plc=4171841&sid=18330&dvregion=0&unit=728x90&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&prr=1&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0imxtQHTB-UYtU6gx6hDpC8&DVP_DBM_1=3060631&DVP_DBM_2=11763542&DVP_DBM_3=32118322&DVP_DBM_4=326784848&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=353802656712&turl=https://www.reisekostenabrechnung.com/&DVP_PP_BUNDLE_ID=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 40adb937145b21abf0b1dde7dfa4d0a80be21ce7bf7d4f85ca944022a23c6785

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:41 GMT
Content-Encoding: gzip
Last-Modified: Sun, 16 Aug 2020 05:50:22 GMT
Server: Microsoft-IIS/10.0
ETag: "0a34a219173d61:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 16756

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4C06 22 KB
8 KB 8ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Mar 2021 17:55:06 GMT
expires: Tue, 15 Mar 2022 17:55:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 185915
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame DD9E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1&C=1

43 B
894 B

56ms
56ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjQudGZATAB&v=APEucNXvBd6uvEjRC2PlZBt91Bgp6b1SN1BferOMnjqpCcYiaF_keILvN0Pe-0QEJENaVhXGY3xF5C-1tPogueURAFMvnhvGnsL0fnldSU4zBnxo7eLEdBDygEVViSXI9gk_OUGTo0avI1hRN0IoNmfU3nt6TZb8yt6_6aB_0SpvE9b61u2EEl_KzdKR0E3YZ0pb1cAQlb27Mr_MxAY_PNcELOCIpTpEWnhCqgdNczIUwSyVGRtraFk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 17 Mar 2021 21:33:42 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Wed, 17 Mar 2021 21:33:42 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame DD9E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YFJ1tpglDO4yMV6sKhW0PwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1

43 B
894 B

48ms
47ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjQudGZATAB&v=APEucNXvBd6uvEjRC2PlZBt91Bgp6b1SN1BferOMnjqpCcYiaF_keILvN0Pe-0QEJENaVhXGY3xF5C-1tPogueURAFMvnhvGnsL0fnldSU4zBnxo7eLEdBDygEVViSXI9gk_OUGTo0avI1hRN0IoNmfU3nt6TZb8yt6_6aB_0SpvE9b61u2EEl_KzdKR0E3YZ0pb1cAQlb27Mr_MxAY_PNcELOCIpTpEWnhCqgdNczIUwSyVGRtraFk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 17 Mar 2021 21:33:42 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame DD9E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHKtBlqDTVpv9xTLnguCd-4&google_cver=1

43 B
1 KB

30ms
25ms

Image
image/gif

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHKtBlqDTVpv9xTLnguCd-4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjQudGZATAB&v=APEucNXvBd6uvEjRC2PlZBt91Bgp6b1SN1BferOMnjqpCcYiaF_keILvN0Pe-0QEJENaVhXGY3xF5C-1tPogueURAFMvnhvGnsL0fnldSU4zBnxo7eLEdBDygEVViSXI9gk_OUGTo0avI1hRN0IoNmfU3nt6TZb8yt6_6aB_0SpvE9b61u2EEl_KzdKR0E3YZ0pb1cAQlb27Mr_MxAY_PNcELOCIpTpEWnhCqgdNczIUwSyVGRtraFk

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
X-Proxy-Origin: 217.138.207.188; 217.138.207.188; 693.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.26:80
AN-X-Request-Uuid: ba5cff0a-7b17-4154-ba7c-28aa19a15ab9
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHKtBlqDTVpv9xTLnguCd-4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame DD9E
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3ODIxNDk4MzE0OTI1ODMxNw%3D%3D

170 B
484 B

75ms
47ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3ODIxNDk4MzE0OTI1ODMxNw%3D%3D

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
X-Proxy-Origin: 217.138.207.188; 217.138.207.188; 693.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.42:80
AN-X-Request-Uuid: 7e34ea38-dcac-4a57-8bf2-e6d2583b00fa
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3ODIxNDk4MzE0OTI1ODMxNw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5E83
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1&C=1

43 B
894 B

48ms
48ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM-nKBD9yigYrdL3bjAB&v=APEucNU7xCrF81jCmgfMo1L4Mh3FKPWjQTG42X0dmktpKTfNPclwy4TdHEYIU_o5-hZ2va1g2dBoK44-DRyVX999Zb1of2LOx0QdcjzlTlRf11UBIkoTg1POuneWNPqYdsViyi6jAMC0EsOvXnPn1jJ1o9j_JtLnjJPX8KLOp8oTe6AxgkW1Whb1-JvKtFBkpV9beSYFiHxMTQqtdE2Fsi6aphvsjQEOKR1q6204fmxixYJocaE0f9U
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 17 Mar 2021 21:33:42 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Wed, 17 Mar 2021 21:33:42 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5E83
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YFJ1tpglDO4yMV6sKhW0PwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1

43 B
894 B

48ms
47ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM-nKBD9yigYrdL3bjAB&v=APEucNU7xCrF81jCmgfMo1L4Mh3FKPWjQTG42X0dmktpKTfNPclwy4TdHEYIU_o5-hZ2va1g2dBoK44-DRyVX999Zb1of2LOx0QdcjzlTlRf11UBIkoTg1POuneWNPqYdsViyi6jAMC0EsOvXnPn1jJ1o9j_JtLnjJPX8KLOp8oTe6AxgkW1Whb1-JvKtFBkpV9beSYFiHxMTQqtdE2Fsi6aphvsjQEOKR1q6204fmxixYJocaE0f9U
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 17 Mar 2021 21:33:42 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHJrbIyi0-vY6TF7T4zrgiE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 5E83
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHKtBlqDTVpv9xTLnguCd-4&google_cver=1

43 B
1 KB

54ms
24ms

Image
image/gif

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHKtBlqDTVpv9xTLnguCd-4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM-nKBD9yigYrdL3bjAB&v=APEucNU7xCrF81jCmgfMo1L4Mh3FKPWjQTG42X0dmktpKTfNPclwy4TdHEYIU_o5-hZ2va1g2dBoK44-DRyVX999Zb1of2LOx0QdcjzlTlRf11UBIkoTg1POuneWNPqYdsViyi6jAMC0EsOvXnPn1jJ1o9j_JtLnjJPX8KLOp8oTe6AxgkW1Whb1-JvKtFBkpV9beSYFiHxMTQqtdE2Fsi6aphvsjQEOKR1q6204fmxixYJocaE0f9U

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
X-Proxy-Origin: 217.138.207.188; 217.138.207.188; 693.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.56:80
AN-X-Request-Uuid: 120a5529-bd2e-4281-bce5-22e99eafe7a1
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHKtBlqDTVpv9xTLnguCd-4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 5E83
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3ODIxNDk4MzE0OTI1ODMxNw%3D%3D

170 B
190 B

37ms
36ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3ODIxNDk4MzE0OTI1ODMxNw%3D%3D

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
X-Proxy-Origin: 217.138.207.188; 217.138.207.188; 693.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.150:80
AN-X-Request-Uuid: 037d0b65-1193-4abe-8f44-f539a6ad673f
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjg3ODIxNDk4MzE0OTI1ODMxNw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK bst2tv3.html Show response
cdn3.doubleverify.com/ Frame 4D4D 1 KB
1 KB 31ms
9ms Document
text/html 2a02:26f0:10c:488::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn3.doubleverify.com/bst2tv3.html
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal79.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:488::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 86be5d6a3d661fd3d5d72f254a347dec5c66cad569117f51dad297acba02f558

Request headers

Host: cdn3.doubleverify.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Tue, 02 Sep 2014 17:01:36 GMT
Accept-Ranges: bytes
ETag: "01818ecfc6cf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
Content-Length: 806
Cache-Control: max-age=63908
Date: Wed, 17 Mar 2021 21:33:41 GMT
Connection: keep-alive

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 2B5C 4 KB
2 KB 87ms
31ms Script
text/javascript 213.254.244.14
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_617226565698&jsTagObjCallback=__tagObject_callback_617226565698&num=6&ctx=1828362&cmp=115750&plc=4171841&sid=18330&advid=&adsrv=&unit=728x90&isdvvid=&uid=617226565698&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&dup=null&brid=0&brver=&bridua=3&turl=https://www.reisekostenabrechnung.com/&chro=0&hist=2&winh=90&winw=970&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=2&htmlmsging=1&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0imxtQHTB-UYtU6gx6hDpC8&DVP_DBM_1=3060631&DVP_DBM_2=11763542&DVP_DBM_3=32118322&DVP_DBM_4=326784848&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=353802656712&DVP_PP_BUNDLE_ID=&prr=1&aUrlD=&m1=13&noc=12&fcifrms=5&brh=2&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5DC6%3AD6%3C%40DE6%3F23C649%3FF%3F8%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5DC6%3AD6%3C%40DE6%3F23C649%3FF%3F8%5D4%40%3ETar9EEADTbpTauTau36a_cc7576%607h42__7hbhf%60hf_bcdaa5%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3ETar9EEADTbpTauTau36a_cc7576%607h42__7hbhf%60hf_bcdaa5%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal79.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.14 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 0ed81d9ca60ba526fba872f7f3a3464692efeaa5e99c12279bad8111c207c78d

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
X-DV-Response: 0
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Date: Wed, 17 Mar 2021 21:33:41 GMT
Expires: 3/16/2021 9:33:42 PM

GET
H/1.1 200
OK dv-match6.js Show response
cdn.doubleverify.com/ Frame A141 4 KB
2 KB 9ms
9ms Script
application/javascript 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-match6.js
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: d03755898b05a3d69377bf7da16ccb307e789a0f569b4dbbcb7b29bdecf967c5

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:41 GMT
Content-Encoding: gzip
Last-Modified: Sun, 11 Mar 2018 04:45:12 GMT
Server: Microsoft-IIS/10.0
ETag: "03c84bdf3b8d31:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=22963
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1935

GET
H3-Q050 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/ Frame 3FEC 21 KB
8 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CakDbbBXNpwcEVcDTqqRR5SOFqtZdk0GexMZ8jX4mUJRw1QpvZKCXbKekWkaiIv_3fnMLRIKAlgKdLae4oZb-h0JV4DhL-KsT4w2XJpLXS6HnZrh1My6Erq_mvRWfw3b5jZYYf1xgJhBTt6WvJ7bsEj2GuWA&cry=1&dbm_d=AKAmf-DnTnH325XmpREuVgBHYsjQaawAzQqZMcpGqJ6-Grhgo67V3Df9r5yQ2vSphvx960FTtvX6sG-AC2EAnk5ZTBp1auMEp0zXX3mDwsh9Oea1bpx9tCNmnUkXlC8g13kh9AreC_8tAIzsnez4PL_guAGuK7nEDxMQwUx18N0pA9DE-qUUPZm1Mtrlp5qpvlj0wNKbu4IvsMFxMkmpgVJIqpaY0lAQ1gX3eK41fTGBsGErUCggU_Pf2mWFNBOkDyEqQAPt3iYbPLlNCqxpL7q1LXMHhTggm-1zNf6mHIcr97WJ9Km2q__4S6TdrWlElfLkd473nIgYA2G22B9nt2K0GYHcBaGRNtDhb36XtK21ShE95ctwjGOdfekyciZnFqCJjAgRW8Fbr_AZpKT6dLxx0_y0RnCwCwNjvCx4afzuLpnDAYUMoHgeRkD4mIfCBCVSmwRXMdKyyTWvgCvArsz_a19eMLqU9Y-TowPDxgHidRyQLMVne9NLcwfwnfo28uyb7TNe4NaUKljK4X7bsDbQUE5nBz1GaGJOCujxiDgU9u7qwgUeKZI3FDWZGVnOObTtqzrNLufxTfL6rtzw4rEHNDhjV460XhtZbc_TNX00FryrK9a9Ptq5pirhki7S_ujBCnLm_6HFLrcePG2aA6OCQdwDCEAwk7IDoWp6RYuamZLAsUFaGatA-cfCOQaH_3UahxBx8_qUY5YHcV3g80ia13uxwl_BgcbHw6vVbsJg1C4tItSrbEhVUVnI_qHfZ68hAa2JU6c6gslnKUpop2xL5lU_XzmpZKy6b-ze0Yw41wAARaYrWKkoDFWSJ05FPA8KIfTzQ5n7iPy0Fa152eVl7zjCilrCFv1zQExj9hOJH8Rqg7Pc28tEstz7jFC2GKgqWdCnE1pObn2cvPf4O3xseGgqEYgWeJKkPBu9ESxWu9J9x66LERhBmFLb6zcN-c_kdS_vspdxy8rAV1JZcu-id4MqH8Me0nDmNBQcIS8PcwxerHK-VR5RojoQpK66u8VFmhoMOrr4oG1jnCUVXk-jbR4LBJk-n6QhBoaTpdber-71M7NENn8EGU1S6AYR9NhUGbdvVEoBLyGpD1lxRoZm7AJQnsoTxCWJsIFwMLIduXUMKBOZ1UXPZxS3d0XFgwLXEeeiZ3FLvnb5-LZzJqgsB6kh0pL8i6P5FMkQKBqa27wEYx7b7x0UgbyHth62-VS_2Fakgb-CSnpapIu26bxiB9Ebb-yB4q6-XT7uTCMyMmkD6V6h53QrZ5JGwZdTG3YOIeJUEl5qlbiZPDU3b43qZHS-dCED5gm27DWKTG-AsowVFjfkpY2yNwhnO9Wg5duccZMwmWwPnUJiKlafbQ1slCa3cveW_7SqOB8RsfCXoF27BgBjY1ZwmeUl9WK4zNenznelUN2LRkk9MLLqIqnf6yfJo3V7oxNToeJXm-ZUi1AlLRCZegTtUAPDoErRZzDRiK6gce8hcKAbaJZ20szAspEBMA_d8VcBvufVDe-iNFyQP8HQVN3PQ640kAu2vKFh5iTjz-08Vav7gAMWOQ6xf6t_Mllb08ddiA0mbOuoDAUm2kautWSx2eD-WpGcvnZ1GI5W1Y5triKqhjaNRxc8MEaeQZxJVUyrD48-00J2b_aXgAakwnfbvB9sKjI6RIzFV0jViawUFkUZiKzdD85GnV856We0reuKpXnyNWEzjAFvgQq0v2pVXrlhfy7jOanDNKUK-1zo6QO97RSBlVjXcjVeCDWdrsupVJX8nD_uGQPFZ15_NgG13hGABmVStO8DiJaVAIPLUBQX-s7cVZYSA8frOZq-bEQ0Hw1TnRip32gVYdRGz6HZj3zHjl0MJFIemb0FCQsGF1wuvfBMl8YcCAc5KoXKBwIlitCzhvXlS3NB0lizi-BHyekhYgIVXTfhGpgs6n8cVSIjAyTlU7NTsbbpkF0I1jOM9rZvXWFOxMOexd9ayaZuOu4Piejf55LhrsUhNuvn1CxhhhXNzyxqdriWnYnD-cs8q7TA971E7qPgoet0nHzywbvxtFMQTjVK1n5L5sG0LVyRMzIL3resMJV4tul23dKC2C6ngPjD7_8Nor56Vc9WcVXj5-h4tsTe8gkdlEzSLKxJfI9M6OBRaB2tl6HBFZeuP2pheY8u8VlnicxM7FdJl63d_kAFuGBO2UT7ou4Jay0f9Wdg85Oa-FBZyJXJPX-n2JJRUC9vHffWuziF4YhAfHZ457_AmkBT547oKyuQIbtR2kuXHHCd4uKedrE1mSHWH_Gja1qnYQOJPyvdN1v4HcuJpm916CtN9J_u3xjcxVuUFEeQ8A9AMOBSY9MFypuwAEAdua1Js3NTDV8-CM1vlgZG2dgBgyvNz60H0_GMz6Iwn4GQ-UlZk8v8vBYtu4AYrdTcjkizi6YDDjTNaflRKhuBRtrlSbS9p_B7TlUsAMBt40qRxdsb-j5SUtgoPDrurLfIzQhGtZ0hwC8QrTL-P5NJ7NThj5l3sfceEznF6DR1yivF9XIAkgaZaZg5XwuHdAallG3YEjWkuNElEFfFYrUC5doAFDGOgQi7Iu7_FBv6Nf-Jfb-a1WahbXJggD_Qf7XqeWBksumc2-Po0Dd4aXeAgz9SigZVP-qMIRy7-gJS3CwSU8qim1GFcj7ewSKb6Kd6wInv2C7Fz_f9rcPGh_72X7e7CB8brpf4u4pSZ8wlJR5sYHTWBzehX1xjLZOjQD9fQT_rbCTSDezuXBe91s9T94pC6QCRilmPaWkQpcb-SxxQnIIM0Cf6ejsWSrjUwRL_ggG_T_UgrCEvFR5_E8R2LEOsqgow9WYt_oQop4weL9tNnZnGqyVU3lkjdLXwuaEwEzDVgOYfnTA_oy0WeQPFd2bN4cCDq6BRveRmJGCtoMNfDDVROlBDKxNPxU4WZ6VEXKe0ZyVo1KJ-nFsS3UDRoiwvv7-4PgN0HYcJEFsajqfoiCcHOz88dDYaMT8eZ5NeA7i4yCdSpTb0Zcw3ck8SVnc6JvM3m3QKFCu4eoMD6kC4QiIJ0vIexG89X5js1dbnZi9YIFwogu4fpHXiGJDc0exvkg1JbRY51rIYjDT-EcPKv1NmUjGVZGciMQhewAXHKysEc2uKaTMD2wd26DLqcNB_0i-jqY5az6gfBHmP-jZEQXhrIn7RR9prvlM-2QPLMEFx8_EvnPd2HL_irUCPJwZQY1R6oColqQxeVwy9_9zUUZc6_2rQ3hyCX8rQWyE8kc3gM19rZchID1WSbJeb89wZ1D4Yk0mb7Cc3&cid=CAASEuRozjSN79n9dIGzGp2Jn8JycQ&rfl=1%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

70d82c6075989e0082b4917c6685f5f6bec1e673d0a80160eac61b3f1cdcb1a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8471
x-xss-protection: 0
server: cafe
etag: 753583566593306265
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:49 GMT

GET
H3-Q050 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 3FEC 41 KB
15 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 17:30:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187367
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Mar 2022 17:30:54 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 1B53 111 KB
39 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 13:10:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30209
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:10:13 GMT

GET
H3-Q050 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/elements/html/ Frame 1B53 8 KB
3 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ai4to2xQxic6eyLMK0kC3x0twP3dGOSHl-YSt5H2Z6HFaLVLERequCCvBUErsuScflOp1tn7cHAmIqCSTaE3lwWeqsxwwaqAsv-J656G3ObvT18Gze3VQ5b9-IeBnyBmzhm_jV9TZeQYJm2rk46oRcNemqrg&dbm_d=AKAmf-DYBbYSDplEq3oXTc0Kno_bX9pjLr841IIXW3J1mfjM8yILRaQIsiUaAX5WrA4UrdZlHLu0N589vgtigh4pDPaDQLlh8jOEC8DQPHh3Dyjm-oWRcVaNPoUiD2JWm_O4BMAcwfc9jn2uyszWblTEEZsfRS3lC3gnci1dQBxZnhZKDrC1rJFBXmK4Mn1XClX8mUOo4hiHOvkFZwHgsGA-refiLvBZr53mt8lO1HgM47azoJOpO6D85syj9EGrwJx-MPY-len5IJIwxcr_L4KnvrnYU1Fkwy_pje16KjOqQerfLHJpPynYCyU61tMNtyU5IS-9JesW71jRf8YQ85o9vxvYlwXffONg_UKt9qBs3yNhHPWsCRZlIsLWvpg9C4GaW55cXD4iGfkUQod0K71Vb51x0nSSDT1wWhKtxbeIP8ZX0KAVTHC29hylWPUa_KDbkqnO6KkjCnACCJnkzuChSrS6cD31HD_pCCl0EvJYPAQP2aKk_6FSYtQGhSwLRozNF1JMwH_aDvvduaA8JEb3dShyoRWKTfyof9E6YFLc5UOBQodlqOGr1y94YKG4aWDEcw0gOY1qfZR90Fdg2tkuHqf9AI6_2NXM9w6JbhzW3DUWfSw-EX2ECrqhrB3j4isXNGpbLnoximthGsWD56zI7oQgPwhSjz379mJfjanrMvQOd-o1wR3gIhNU167Jf3fGRB9MnWAGB3h-YqZou7R9Qvbjcm3WBBYIYL-nFJ6Mc5vz1pbD7GQ2K8lZtNA1cZvQlSfkt42RToLKBV5wBv9YwS1GJTUcwlZtlQKllqexGOpzyI9Qivx7dfQT1D602MdcoB02Ud4pWgudC9tFioB0qs3WEN_JjlSWtX3FHFrpNmDK1JUtZeUlv3-BtcjVLZAEUWJrHVMQI5LyUdI_ggSmjFvEI_lufn1lEOEPeEqFa52B3vtx1l3HMVq0rnKZM81--EfR0tvBVOWkM8x6Pg7bq6LSgkonSbLmrQjlHGLfkOjgOGzhORR0DNtu3JSqAGflNdWdny6pOUvfWgJcW1EwwPHdW_OIVDEgVXQ89FXdzalE-0TOFMN2hMAliZSQgv6BBfHo-VfvG0aBq8TZlYlnxMdNmu3zYmXGT1jYQXL_VIFODP_WV3OcDIpmMKsvQsO3pa0PdffQVHW2mI0G8gzTgSS0mULAH23DA3aaK_fBH86nLbwsBUBgrsuiX5akabipm2y4TqOVI3mCdlHAb8Ufz4bUQR31YZsTIYu-JQmEREOg7MIuabo1HkobKOKVDCZcfrvf38VBbEYWndDzhdcTH15c-J5GePFE0VbYfrvQXW9VL3deF-8ArcaT5cAC18Y1HOuHOzDJIHAZrU-2T4GN1PeOVkE6MZyFMjdfxS48gFpHjMscNxHzoI13g23dPT4SHg0OcVpZd64U04O4ff5D-Tlq8dT-WTSFjs2mHDgLDYpbK5eI5NkOhvLSg7shdZra6GfK1RbUweMbeOwjqkrO8-VzgdKj-hYMI95jSdtLzEVFxzwrZtUtzR6Rnuzgz7CivMtlCCynK_N62L0L69BA4Oj7cxIqBAMOJr_1Yyf4Nb-ms2ZztEpQ-3LsyXSOa-UDJjiq2RFPUaF9DMmWx_s6EGTk1-wVvIOFLX7tH3di785JarGSNwsPKWMz1jnaGf-6ZTvPaHXp7cdh4cYaUixZqLBxeCmS9gn8sJiq4qzgYFToqIn4KaehSJ_zTbd2g5q2Kh3jp1TqCrN0FBaeiiTBDGKaTfrEKRJVrsZcmaoj4cbupZPOpi1p0U8ee4VJ8nUDTKoX997EaZsrqCrMrZ07D40yoiJXN-I4CS6wP2aFV22OTNzsceS39tdYJ-0VXbPRpsPvrj-qKcDwHp92RiH-RjbcdBqGVWkCPeUdvfXhS3CaxBZnpdVdnO8RtAPoKeHuMDMgqWqAnwcUzJmgqYbIG01qOAwCCUjDqE_eHnK4KWXFa2SkVeU66vtwGYq3u0H6eLw9xJhZpz1E0nCLi93TfHgt9T8j-8o1VmeToldmeDNWOnH0W1idCu4qbBBjs3ObHOLLuQUW6UrwOXKaqWiK9iYv-aV2NT5WFjbl3-ZOxdTkB6GqqsDsD2XY6fdwkcMH3d1bTxO4dZJ-racCa-4h3ezMNvavurr9MCJUlLa28JeOQOxz7CkJtkeesnKzcr-HzDrXymCeusjmxLL_efTpP0yTtW4eAPs_TSFYUrtWaVNlNk-RGcJfhCfJNw5AADqXhbO_DrrjfYMpuZheShETsLmYKlnO3gXXrv_gjvi3xiwOZ6FmBrNYwPyecLJgVj-lynBBSKczyhj7O9DE3XS9HJotW9Xjy0wA5lX1B7xvboSmdsOMBi28v7DjRMTYXr_dAnolbGt52f2uhZr0VXhTexJTxcRbfBYHeTV2SOUnpK0ABXet1Hghy-jnhOurtAZUQhlg3TdFdP5CICZG5RpkXAgKSNzQEqmJ3FXWS7eIVy_q6ulZ95KIsgRn8pU2Azmdww_ibf5PTIE3yEuDYCQ5nDqp3l4IGSLDJiOt8NJCr1h5J754W5uJOfPANrboxZVgYwmgxi2LWp63oT9ql4GqYxYkkEe9I91tm5msVBGI6qov02iCEmOHesK7byYW72zFgCz5zDjFzPY7RfVjPbe62rw2GNskTVA0C-ya4zk9AHP6-D5xPP9b0sng5gRTZZi8XVLDQ2dtWmHfUmLG8KA15XkbxsiJdVZ_Bp40BD_8OieExoaPbxkaWRkxdY0Hz1nq5n1Oa5r-NwBNBU21_MgvrJ1hRGMt0SnStJH-9u81dgG-p1FaLOXwap653diB3Yy1RrxzLPAICq_wPL0UDNaSp5zcvDBNW3h0OckiaZV6Z30CihFR-mBSfYB9v2Lz-SzbYDEQUcuXcbhjd1eo6mjI5TBH2BfhZ3DchOENmQAIiu90ZJuBzgkdvY4pbCaHjkq4ZSaSPD-ZSW3b_CTsmVBHcifxnfHAvel5_ZyNpBevvdPRmzXrvEOitHZxAy8kk_Kj7K69nNgTjW2jPIcS-asI9AJbg1kH6N0hLsf_tEKqlrSELja9nyd5JxvRAN53EUgvpXfx91PZbpwbEpeUp8RJH3Fvy9O3xCdMk1fwZefYfvMGyeaQgLGw682ocyQhe2tJ-JH6wC0QVSeRetyB6CqNCx5qBvDZEAv3gTyDbzb3Qtw1ml3d_mFwStBz42jTswECWpGHf9AjDQDBrL00vJFfkTuJzsr3Gl2GWgdSu7CsABvNQ0mAyNE&cid=CAASEuRogZ35CHGTj4lG8hwvMqZ3oA&rfl=1%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:28:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 320
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:28:21 GMT

GET
H3-Q050 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/ Frame 1B53 21 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/abg_lite.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

70d82c6075989e0082b4917c6685f5f6bec1e673d0a80160eac61b3f1cdcb1a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8471
x-xss-protection: 0
server: cafe
etag: 753583566593306265
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:49 GMT

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 39A5 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Mar 2021 17:55:06 GMT
expires: Tue, 15 Mar 2022 17:55:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 185916
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK dvbs_src_internal79.js Show response
cdn.doubleverify.com/ Frame 3FEC 53 KB
17 KB 11ms
11ms Script
application/javascript 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal79.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=115845&plc=4229316&sid=18330&dvregion=0&unit=300x250&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&prr=1&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0iYBflHIXTYXFl5zO5Olpav&DVP_DBM_1=3060631&DVP_DBM_2=11817068&DVP_DBM_3=32229098&DVP_DBM_4=322198736&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=353802656712&turl=https://www.reisekostenabrechnung.com/&DVP_PP_BUNDLE_ID=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 40adb937145b21abf0b1dde7dfa4d0a80be21ce7bf7d4f85ca944022a23c6785

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Encoding: gzip
Last-Modified: Sun, 16 Aug 2020 05:50:22 GMT
Server: Microsoft-IIS/10.0
ETag: "0a34a219173d61:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 16756

GET
H3-Q050 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 1B53 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 17:30:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187368
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Mar 2022 17:30:54 GMT

GET
H3-Q050 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F1B7 1 KB
854 B 6ms
6ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 17 Mar 2021 03:14:09 GMT
expires: Thu, 18 Mar 2021 03:14:09 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 65973
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 1B53 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4caa82121ce30bcf487dfc3bd525740de5435be8594f0f5073e9cdeb632bb393

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js Show response
pagead2.googlesyndication.com/bg/ Frame 4C06 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25c788c3d6b5a5f5931ef45abc5640af29b16f379c2e1634dc32c6c225327f38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 16:25:17 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 104905
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5657
x-xss-protection: 0
expires: Wed, 16 Mar 2022 16:25:17 GMT

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
399 B 22ms
22ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjEyOSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8xIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMTYzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQyOTI5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiIyMjkifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDI5MjkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMyIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjI2OCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQwODkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwNTI3MSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjI5MSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:42 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4e7330000dfbf7fa20000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Gk%2FRIwvVRhT2MApHEzTmTvQch1Xm%2FVGPE%2Be9l4B5CNFgPc8GnQL%2Bl%2BOXvsyyR7Dn9HilHK%2FQZKQnGmoYUGzXz7ZAebEbtlmEVKCoVO2zXRZFWUumfFXGDDb3zF5XeyQfI6iGvxoXoSGmBQ%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 63195751e86bdfbf-FRA
expires: Tue, 16 Mar 2021 21:33:41 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
310 B 23ms
23ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMzQ4In0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIxNDAifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQyOTI5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzEiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjM0OCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiNDE0In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8yIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIzNDgifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjY4OCJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDI5MjkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMyIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMzQ4In0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiI5NjIifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxNDA4OTI5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTA1MjcxLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIxMDY2In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJ0cnVlIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:42 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4e7330000dfbf298bf000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=wIVUMCNWvHqzMAP8PQDVkLtiAKdSzyG9mJ5lD8CuRuUNhOSdG%2BWHJ6TWJ1gUo16f7swozpOjJ7gb%2BHLZNAgTpeg9y0KEiZ%2FfwSCfavszVXqgbWaJ1lm%2BnJDBEL5h6abyAxVCPtgt67u1Eg%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 63195751e86ddfbf-FRA
expires: Tue, 16 Mar 2021 21:33:42 UTC

GET
H/1.1 200
OK bst2tv3.html Show response
cdn3.doubleverify.com/ Frame C08D 1 KB
1 KB 9ms
9ms Document
text/html 2a02:26f0:10c:488::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn3.doubleverify.com/bst2tv3.html
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal79.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:488::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 86be5d6a3d661fd3d5d72f254a347dec5c66cad569117f51dad297acba02f558

Request headers

Host: cdn3.doubleverify.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Tue, 02 Sep 2014 17:01:36 GMT
Accept-Ranges: bytes
ETag: "01818ecfc6cf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
Content-Length: 806
Cache-Control: max-age=63907
Date: Wed, 17 Mar 2021 21:33:42 GMT
Connection: keep-alive

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 3FEC 3 KB
1 KB 30ms
30ms Script
text/javascript 213.254.244.14
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_450794641456&jsTagObjCallback=__tagObject_callback_450794641456&num=6&ctx=1828362&cmp=115845&plc=4229316&sid=18330&advid=&adsrv=&unit=300x250&isdvvid=&uid=450794641456&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&dup=null&brid=0&brver=&bridua=3&turl=https://www.reisekostenabrechnung.com/&srcurlD=0&ssl=1&refD=1&htmlmsging=1&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0iYBflHIXTYXFl5zO5Olpav&DVP_DBM_1=3060631&DVP_DBM_2=11817068&DVP_DBM_3=32229098&DVP_DBM_4=322198736&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=353802656712&DVP_PP_BUNDLE_ID=&prr=1&aUrlD=&m1=13&noc=12&fcifrms=5&brh=2&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5DC6%3AD6%3C%40DE6%3F23C649%3FF%3F8%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5DC6%3AD6%3C%40DE6%3F23C649%3FF%3F8%5D4%40%3ETar9EEADTbpTauTau36a_cc7576%607h42__7hbhf%60hf_bcdaa5%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal79.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.14 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 028281c5a4e141790ec249fcdff5c6d222aae0da4084138528f348bc0446f570

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
X-DV-Response: 0
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Date: Wed, 17 Mar 2021 21:33:41 GMT
Expires: 3/16/2021 9:33:41 PM

GET
H/1.1 200
OK dv-match6.js Show response
cdn.doubleverify.com/ Frame CA5A 4 KB
2 KB 9ms
9ms Script
application/javascript 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-match6.js
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: d03755898b05a3d69377bf7da16ccb307e789a0f569b4dbbcb7b29bdecf967c5

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Encoding: gzip
Last-Modified: Sun, 11 Mar 2018 04:45:12 GMT
Server: Microsoft-IIS/10.0
ETag: "03c84bdf3b8d31:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=22962
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1935

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 41CC 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Mar 2021 17:55:06 GMT
expires: Tue, 15 Mar 2022 17:55:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 185916
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK bsevent.gif
tps20517.doubleverify.com/ Frame 2B5C 807 B
1 KB 76ms
25ms Image
image/gif 213.254.244.14
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tps20517.doubleverify.com/bsevent.gif?impid=fa166ac2232542388a19452762688465&dvp_or2=1&cbust=1616016822080263
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.14 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:41 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/gif
Cache-Control: max-age=0
Content-Length: 860
Expires: 3/16/2021 9:33:42 PM

GET
H/1.1 200
OK dv-measurements1146.js Show response
cdn.doubleverify.com/ Frame 77B4 476 KB
86 KB 11ms
11ms Script
application/javascript 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements1146.js
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: ada2b7b8e97b28a0c397cf381249d2ba6b7bd3c6f028cb071ef548e6451d31e7

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Mar 2021 07:48:29 GMT
Server: Microsoft-IIS/10.0
ETag: "80c475eb11bd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946083600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 87408

GET
H3-Q050 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E7F7 1 KB
750 B 7ms
6ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 17 Mar 2021 03:14:09 GMT
expires: Thu, 18 Mar 2021 03:14:09 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 65973
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 2B5C 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 297eec780e6e5d5bec30a668257ae57716d5c2d9223d5314a215691fad59d36e

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 t.js;adv=11297208284209;ec=11297212736296;adv.a=9080429;c.a=24153710;s.a=2103608;p.a=273624679;a.a=468022857;cache=2267428552;%22async Show response
ad.atdmt.com/i/ Frame 1B53 0
0 56ms
36ms Script
text/html 2a03:2880:f02d:5:face:b00c:0:8c
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.atdmt.com/i/t.js;adv=11297208284209;ec=11297212736296;adv.a=9080429;c.a=24153710;s.a=2103608;p.a=273624679;a.a=468022857;cache=2267428552;%22async
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f02d:5:face:b00c:0:8c , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 impression Show response
impression.link/ Frame 1B53 68 B
549 B 239ms
177ms Script
image/png 143.204.202.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://impression.link/impression?branch_key=key_live_ljOlMvJZ565wI6bVcOuPYagjwsoHp4MX&%243p=a_doubleclick&%24android_deepview=&%24android_url=https%3A%2F%2Fwww.worldremit.com%2F&%24ios_deepview=&%24ios_url=https%3A%2F%2Fwww.worldremit.com%2F&cat={cat}&src={src}&t_url={unescapedlpurl}&type={type}&~branch_ad_format=Cross-Platform%20Display&~campaign=Display%20Web%20Activity&~channel=DoubleClick&~feature=paid%20advertising
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.202.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-16.fra53.r.cloudfront.net
Software: openresty/1.13.6.2 /
Resource Hash: 13f86bd1a6d578ee82ca0c54a9a634e03d8d7db09380d72590b158f173f53790

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:42 GMT
via: 1.1 6080b2713e502211e152f21f5c59c5a7.cloudfront.net (CloudFront)
last-modified: Thu, 29 Oct 2020 21:20:06 GMT
server: openresty/1.13.6.2
x-amz-cf-pop: FRA53-C1
etag: "5f9b3206-44"
x-cache: Miss from cloudfront
content-type: text/plain
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 68
x-amz-cf-id: 4VxKOc8EsUs5fF2WHcKDpOGHogCdhprxl-E7KanNOg-CYWx8qRFgBw==
expires: Wed, 17 Mar 2021 21:33:41 GMT

GET
H3-Q050 200 index.html Show response
s0.2mdn.net/9080429/1589458486121/ Frame B3B3 74 KB
23 KB 34ms
21ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9080429/1589458486121/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

893e9e87a8ec52e665a42c3c3854931ef2bb5868006e8a1797d38f84febdead5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /9080429/1589458486121/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 23495
date: Wed, 17 Mar 2021 11:40:28 GMT
expires: Thu, 18 Mar 2021 11:40:28 GMT
last-modified: Thu, 14 May 2020 12:14:46 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=86400
age: 35594
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1B53 0
575 B 122ms
65ms Other
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuK-L6fz4OlK-wf-FCvBQLOaM1KYB3Fu758WpWCbLcDn8oN-Vzt6kI9NpiH73-R8RTkhIlm8zEpiRAN5OaDYhYdQxGX0oGql3bhPxHmX_f0L8vUEIBqZrIQP3t6n0zdTZBhCOt6ipPceYVLXuMsMXj4JiUy47saz0X2bTI09JKFPcDPKZaMMi1nuPzxyBtxRCbiBnUegNjTue_694ltvbEga52Z8Cz02frjzu7XQq85ZS7EgGxzhGlx01r2inpHSeZf14mjdkvuYkx-0w5nStgLdPDRHEDaVmsD8Pm_d0At1Ih2VcOs1nPIaMOq1hBz91YrfI9bxNOWmkBjCmq4U4Ci5rTA-4ZWyOwtI_jJloBD5akvcJnxpPOEm7Lw741tXd5dfnJCKLLX1GZSmOAmPfAdvv7ORsQs5VUfUfYFjiXqhmbGDmoJSCWtHTT_YCY3b6wgNsE_04rJWVuOfKtlMrf9TkzsfZYi5XB1-7yahMM3kdN_ONlG7rw7EZpKBza9atQJgFiWpInLYAa0lOlBs8F3aEwBVjjE2djmnM9zraftBFFScP6RSXf9fexC1wf8-pNg3PIDtrmxY95a3TOJTZ0_dWTK1e3NAbGtFKWjvrGhyTOyeU6Rvv5USDrStk7iwto8p_IIvrQRn8iLvSnBBvtNMQrrbZil2NZLbBeCjnxj7y1Bq5ieLEyUeUb_l5v0-Eb8MUT8XflWv7cGOSp-xiAqUiMkSSJUwIRWNIM8WqqhMMHRvU-QWoQYA7PMXl0bjnwR9lc6sXgeGMUAU-50RppiC_LsXB2qFZNylD5hJFnazH7E2_1dQa3vmgu3fk62WyT74mtLR8_0oX7YPs-Rhn38DMKn9gZA7v91gvNHp7F76SCudxfudbW__9_Z4843BviAecOD9wqfupvMbnT3A5o9Mc07jy7so1XVLxFBU8TLh1y-7htVuNpM9GfptUHR8rf0tFxekEQ7Wh8Sv14Nv2dHitBTvUoTRPGi2k6fJo33BTB5qmw5Mvgf0iwy_l3vtAESxptKPsLCTO7hU4jQloCsehN54APd_52_L1OIov1HiZy55BYn2zQYE4Gh75uDViIRkWyHsMJyGc4RdXKF3XE-YdRxSsZWIJfc5GWgVJ4tgW2QT7robqQm5Ch5qclXU1uy5DBScZ6nLM0VjhJmc_Qyc7bH-EL-pIZ-n6WqAR5Fc8nkekMR0oApFeinSzvNJMAimiI95gYRRC6isRO0SZIy4pAbYoJ6t48crxTTaUVoOnaAPgQAbbzZ9zS8OHLn4LEcWh3mSBJYcVFGSbJ8ZJYL3VjiwhLWOVRfu8kFVT8a5A9vctFKoOpSNldeESL312j-5uLjlXuOO-h-80VfuCHTDyzXNSC4Drzzv3h5n9IM0udGT1564jxM&sai=AMfl-YSDcdSWED2e8tOcf-ELbn-Sc14owUB0Vuulct0AMznzHCdv-Zq6kzwt2FS12Cppr6PTOAdPBvONI5MXpLIVpkdYfsQB1F0ler37QseWQrbw0uYVqoaK4QqRL06wEMyaJKm53tNeP6pvrqouubbuz_7TMOFQJ44wCpzCD7q2VVqcCmRWx33t&sig=Cg0ArKJSzCFzwy-DMLQuEAE&urlfix=1&omid=0&rm=1&ctpt=149&cbvp=1&cstd=147&cisv=r20210316.22397&adurl=

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 17 Mar 2021 21:33:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK / Show response
servedby.flashtalking.com/imp/8/115750;4171841;201;jsappend;DV360;DV360FY20AcrobatCTXCustomIntentCompetitiveFRDSKBAN728x90/ Frame 2B5C 2 KB
2 KB 90ms
39ms Script
text/javascript 205.185.216.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://servedby.flashtalking.com/imp/8/115750;4171841;201;jsappend;DV360;DV360FY20AcrobatCTXCustomIntentCompetitiveFRDSKBAN728x90/?ftOBA=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fbe2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-37%2Fhtml%2Fcontainer.html&us_privacy=${US_PRIVACY}&cachebuster=295362.3346909591
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.216.10 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: prod-xre-app39.frk11 /
Resource Hash: 2974b2232a2d352cf6df3075489663ae71ecb923452ded1df33e69950ca3cdcc

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: prod-xre-app39.frk11
X-HW: 1616016822.dop041.pa1.t,1616016822.cds219.pa1.shn,1616016822.dop041.pa1.t,1616016822.cds022.pa1.sc,1616016822.cds022.pa1.p
P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Cache-Control: no-cache, no-store
Connection: Keep-Alive
Content-Type: text/javascript
Content-Length: 1758
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dv-measurements1146.js Show response
cdn.doubleverify.com/ Frame B66C 476 KB
86 KB 10ms
10ms Script
application/javascript 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements1146.js
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: ada2b7b8e97b28a0c397cf381249d2ba6b7bd3c6f028cb071ef548e6451d31e7

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Mar 2021 07:48:29 GMT
Server: Microsoft-IIS/10.0
ETag: "80c475eb11bd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946083600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 87408

GET
H3-Q050 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B12A 1 KB
750 B 6ms
5ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 17 Mar 2021 03:14:09 GMT
expires: Thu, 18 Mar 2021 03:14:09 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 65973
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 3FEC 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b1c8d2a4407efecded0a09f6926c8b81a55fd09d3f4250d86c1a7032b0c3bf3

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK bsevent.gif
tps20519.doubleverify.com/ Frame 3FEC 807 B
1 KB 79ms
26ms Image
image/gif 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tps20519.doubleverify.com/bsevent.gif?impid=a02effa0b2de4c8bb903acde135b77db&pltfrm=Linux%20x86_64&dvp_or1=1&cbust=1616016822199290
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:41 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/gif
Cache-Control: max-age=0
Content-Length: 860
Expires: 3/16/2021 9:33:42 PM

GET
H/1.1 200
OK bsevent.gif
tps20519.doubleverify.com/ Frame 3FEC 807 B
1 KB 77ms
25ms Image
image/gif 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tps20519.doubleverify.com/bsevent.gif?impid=a02effa0b2de4c8bb903acde135b77db&dvp_or2=1&cbust=1616016822199369
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:41 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/gif
Cache-Control: max-age=0
Content-Length: 860
Expires: 3/16/2021 9:33:42 PM

GET
H/1.1 200
OK / Show response
servedby.flashtalking.com/imp/8/115845;4229316;201;jsappend;DV360;DV360FY20CCBEHCustomIntentFRDSKBAN300x250/ Frame 3FEC 2 KB
2 KB 65ms
27ms Script
text/javascript 205.185.216.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://servedby.flashtalking.com/imp/8/115845;4229316;201;jsappend;DV360;DV360FY20CCBEHCustomIntentFRDSKBAN300x250/?ftOBA=1&ft_domain=www.reisekostenabrechnung.com&ft_ifb=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&us_privacy=${US_PRIVACY}&cachebuster=955845.341251612
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.216.10 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: prod-xre-app49.frk11 /
Resource Hash: 293f573379222c90a2f4b195fd3add80e4642cd9349a609b870cd2116b4cb25b

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: prod-xre-app49.frk11
X-HW: 1616016822.dop041.pa1.t,1616016822.cds219.pa1.shn,1616016822.dop041.pa1.t,1616016822.cds022.pa1.sc,1616016822.cds022.pa1.p
P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Cache-Control: no-cache, no-store
Connection: Keep-Alive
Content-Type: text/javascript
Content-Length: 1718
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame F1B7
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1&google_push=AQvitUIIFPv-zFMaAe6ykAsb8B0h5nzv5AuBs3aDq4Oz-14_R1qa9C88Ib98RpsRat2HKB52Eci7MRbExc5HRP-GbHiyFlOWjzYt
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzQ5Njk5OTg3MjY4MzA1OTMyNw==
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1

43 B
407 B

82ms
25ms

Image
image/gif

46.228.164.11
TURN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.228.164.11 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:41 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame F1B7 35 B
464 B 45ms
8ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGrbieRq_6tOzV0mUDDvWHk&google_cver=1&google_push=AQvitUInWXSpH1rgtW5QhN9q1f0LgRN4zC20km5apTWy_Y5PqEjbwk0HkBYvcgKmq3fLK5jlCk0D4gNPQO341TcqtZ7jpYBNL51r

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame F1B7
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUJNxa8Hxql5SiRHepzsFKFBzz_2h98QhDm8Q__1_Yr...

170 B
190 B

33ms
32ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUJNxa8Hxql5SiRHepzsFKFBzz_2h98QhDm8Q__1_Yr-114-SjrVQj76qzm4F9-MKHbfbMrf7CwDdRkHvUhxvv3DkTPvcA8L

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: PingMatch/v2.0.30-619-g1028223#rel-ec2-master i-0ae06fec161a2bbf2@eu-central-1a@dxedge-app-eu-central-1-prod-asg
P3P: policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUJNxa8Hxql5SiRHepzsFKFBzz_2h98QhDm8Q__1_Yr-114-SjrVQj76qzm4F9-MKHbfbMrf7CwDdRkHvUhxvv3DkTPvcA8L
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame F1B7
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEDeuKqu6wPNHWf8gYwfMw80&google_cver=1&google_push=AQvitUJK2Q7QhkxnVpM9KPZFqL2M6sgDGJol-gKglnAaZUS0AoJGm1PLoKnnaDlMrEq1c7CUCuKcP_2FexX...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUJK2Q7QhkxnVpM9KPZFqL2M6sgDGJol-gKglnAaZUS0AoJGm1PLoKnnaDlMrEq1c7CUCuKcP_2FexX3Wz_CohhvTUDqp-4&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw

170 B
190 B

33ms
33ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUJK2Q7QhkxnVpM9KPZFqL2M6sgDGJol-gKglnAaZUS0AoJGm1PLoKnnaDlMrEq1c7CUCuKcP_2FexX3Wz_CohhvTUDqp-4&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:41 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUJK2Q7QhkxnVpM9KPZFqL2M6sgDGJol-gKglnAaZUS0AoJGm1PLoKnnaDlMrEq1c7CUCuKcP_2FexX3Wz_CohhvTUDqp-4&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: clear
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame F1B7
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGyTJw_NwO-27VhLNDQC5kI&google_cver=1&google_push=AQvitUKp85wJYAK-aRPwM3ilSLhSpXD_LYmI08nT2Y67__lIDFvT3QVL8u3iMRne6ObbQvEAxwS6UVdn...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEGyTJw_NwO-27VhLNDQC5kI&google_cver=1&google_push=AQvitUKp85wJYAK-aRPwM3ilSLhSpXD_LYmI08nT2Y67__lIDFvT3QVL8u3iMRne6ObbQvEAxwS...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDc4MTM5NTg4NzM0Njg3ODc5NA&google_push=AQvitUKp85wJYAK-aRPwM3ilSLhSpXD_LYmI08nT2Y67__lIDFvT3QVL8u3iMRne6ObbQvEAxwS6UV...

170 B
190 B

33ms
33ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDc4MTM5NTg4NzM0Njg3ODc5NA&google_push=AQvitUKp85wJYAK-aRPwM3ilSLhSpXD_LYmI08nT2Y67__lIDFvT3QVL8u3iMRne6ObbQvEAxwS6UVdnZDfKwS3CQgGGc3pDyh-X

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDc4MTM5NTg4NzM0Njg3ODc5NA&google_push=AQvitUKp85wJYAK-aRPwM3ilSLhSpXD_LYmI08nT2Y67__lIDFvT3QVL8u3iMRne6ObbQvEAxwS6UVdnZDfKwS3CQgGGc3pDyh-X
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
expires: -1

GET
H3-Q050 204 attr
cm.g.doubleclick.net/pixel/ Frame F1B7 0
26 B 32ms
31ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JsfDwADYzcOZWZtcJh8JaIzjG6N3bK1GJLdVuEYDNYYy4Suz-Bm6IMDnI

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK t2tv7.html Show response
cdn.doubleverify.com/ Frame 1D93 12 KB
4 KB 11ms
9ms Document
text/html 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/t2tv7.html
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 29f21aea7fc613d2618b70a483e0b4bf50ba3f4ce4109fa429ce580ec57ef991

Request headers

Host: cdn.doubleverify.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

Cache-Control: max-age=946080000
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Thu, 11 Sep 2014 19:15:16 GMT
Accept-Ranges: bytes
ETag: "0ba3b8f4cdcf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
Content-Length: 3880
Date: Wed, 17 Mar 2021 21:33:42 GMT
Connection: keep-alive

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 77B4 1 KB
1 KB 87ms
35ms Script
text/javascript 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&bridua=3&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5DC6%3AD6%3C%40DE6%3F23C649%3FF%3F8%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5DC6%3AD6%3C%40DE6%3F23C649%3FF%3F8%5D4%40%3ETar9EEADTbpTauTau36a_cc7576%607h42__7hbhf%60hf_bcdaa5%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3ETar9EEADTbpTauTau36a_cc7576%607h42__7hbhf%60hf_bcdaa5%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&uid=1616016822240221&jsCallback=dvCallback_1616016822240410&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&htmlmsging=1&chro=0&hist=2&winh=90&winw=728&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=1146&tgjsver=1146&lvvn=28&m1=13&refD=2&referrer=https%3A%2F%2Fbe2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-37%2Fhtml%2Fcontainer.html&fcifrms=5&brh=2&dvp_epl=380&noc=12&ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&adsrv=0&advid=3398311&turl=https://www.reisekostenabrechnung.com/&errorURL=https://tps.doubleverify.com/visit.jpg&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVP_DBM_1=3060631&DVP_DBM_2=11763542&DVP_DBM_3=32118322&DVP_DBM_4=326784848&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=353802656712&DVPX_PP_IMP_ID=ABAjH0imxtQHTB-UYtU6gx6hDpC8&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=1884286265.484844&dvp_tukv=12457885434.993061&dvp_uuid=919198772525.5514&dvp_strhd=0.39999932050704956&dvpx_strhd=0.39999932050704956&dvp_tuid=1291220598753&dvp_vcms=29&dvp_slmsd=137&dvp_vcmsd=166
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 02e57aeb229809e992f733b45041bec6d5a6a2344972ea9ced30bb06ab76404d

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:41 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Expires: 3/16/2021 9:33:42 PM

GET
H3-Q050 200 JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js Show response
pagead2.googlesyndication.com/bg/ Frame 39A5 14 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25c788c3d6b5a5f5931ef45abc5640af29b16f379c2e1634dc32c6c225327f38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 16:25:17 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 104905
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5657
x-xss-protection: 0
expires: Wed, 16 Mar 2022 16:25:17 GMT

GET
H/1.1 200
OK t2tv7.html Show response
cdn.doubleverify.com/ Frame B4CD 12 KB
4 KB 9ms
9ms Document
text/html 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/t2tv7.html
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 29f21aea7fc613d2618b70a483e0b4bf50ba3f4ce4109fa429ce580ec57ef991

Request headers

Host: cdn.doubleverify.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

Cache-Control: max-age=946080000
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Thu, 11 Sep 2014 19:15:16 GMT
Accept-Ranges: bytes
ETag: "0ba3b8f4cdcf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
Content-Length: 3880
Date: Wed, 17 Mar 2021 21:33:42 GMT
Connection: keep-alive

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame B66C 1 KB
1 KB 31ms
30ms Script
text/javascript 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&bridua=3&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5DC6%3AD6%3C%40DE6%3F23C649%3FF%3F8%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5DC6%3AD6%3C%40DE6%3F23C649%3FF%3F8%5D4%40%3ETar9EEADTbpTauTau36a_cc7576%607h42__7hbhf%60hf_bcdaa5%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&uid=1616016822339559&jsCallback=dvCallback_1616016822339786&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&htmlmsging=1&chro=0&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=1146&tgjsver=1146&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2Fbe2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-37%2Fhtml%2Fcontainer.html&fcifrms=5&brh=2&dvp_epl=267&noc=12&ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&adsrv=0&advid=3398311&turl=https://www.reisekostenabrechnung.com/&errorURL=https://tps.doubleverify.com/visit.jpg&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVP_DBM_1=3060631&DVP_DBM_2=11817068&DVP_DBM_3=32229098&DVP_DBM_4=322198736&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=353802656712&DVPX_PP_IMP_ID=ABAjH0iYBflHIXTYXFl5zO5Olpav&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=4694602525.075235&dvp_tukv=29853245.820509147&dvp_uuid=11381370.062731279&dvp_strhd=0.2749999985098839&dvpx_strhd=0.2749999985098839&dvp_tuid=274714145564&dvp_vcms=6&dvp_slmsd=171&dvp_vcmsd=177
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.0 / ASP.NET
Resource Hash: 6ef4f49da52b8f5f17154a5b951f71822b15304ec98e556ba99cb3dc19f1cfdb

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:41 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Expires: 3/16/2021 9:33:41 PM

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame E7F7
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1&google_push=AQvitUK5524PQ0MUFL70YS48lIZ61jmvAq5FEZUEtExtYWd_xp72aSwxiLxFSJEI_a93MNtRqFR6QLxIutpQNyCA-T8cMttCbg
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzQ5Njk5OTg3MjY4MzA1OTMyNw==
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1

43 B
407 B

26ms
26ms

Image
image/gif

46.228.164.11
TURN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.228.164.11 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:41 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame E7F7
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGrbieRq_6tOzV0mUDDvWHk&google_cver=1&google_push=AQvitUJdRDlejVcHb01NcQfUDpO9pbcC-n7tBRz11kNuO6smuAOdsVSRrh...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AQvitUJdRDlejVcHb01NcQfUDpO9pbcC-n7tBRz11kNuO6smuAOdsVSRrhIaX0tZKoB-OJXMcbfVZt6AhBDtr6UdkMAa0gCVweo&google_hm=D6K3-ip...

170 B
190 B

35ms
34ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AQvitUJdRDlejVcHb01NcQfUDpO9pbcC-n7tBRz11kNuO6smuAOdsVSRrhIaX0tZKoB-OJXMcbfVZt6AhBDtr6UdkMAa0gCVweo&google_hm=D6K3-ipeowN5PqE5rDQ-gA

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AQvitUJdRDlejVcHb01NcQfUDpO9pbcC-n7tBRz11kNuO6smuAOdsVSRrhIaX0tZKoB-OJXMcbfVZt6AhBDtr6UdkMAa0gCVweo&google_hm=D6K3-ipeowN5PqE5rDQ-gA
pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame E7F7
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUKDZCwFNme81nLqqaP9j_RzHY4CnDIEkhVHw8sQCZp...

170 B
190 B

33ms
33ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUKDZCwFNme81nLqqaP9j_RzHY4CnDIEkhVHw8sQCZpSXjn69AFtMhCjFYJu90_-gos0FklOS-iNL3SN0lV1cTz_LLrIlt4

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: PingMatch/v2.0.30-619-g1028223#rel-ec2-master i-0ae06fec161a2bbf2@eu-central-1a@dxedge-app-eu-central-1-prod-asg
P3P: policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUKDZCwFNme81nLqqaP9j_RzHY4CnDIEkhVHw8sQCZpSXjn69AFtMhCjFYJu90_-gos0FklOS-iNL3SN0lV1cTz_LLrIlt4
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame E7F7
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEDeuKqu6wPNHWf8gYwfMw80&google_cver=1&google_push=AQvitULEZYDZ5ZcJRPk9uEH3XE11qnrxymQqV1WS1D2Sia2qA0fW5g2kp8xsE8POWzq8qBe7KqVtHv2-deF...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitULEZYDZ5ZcJRPk9uEH3XE11qnrxymQqV1WS1D2Sia2qA0fW5g2kp8xsE8POWzq8qBe7KqVtHv2-deFTI5ezA86ZmMJsmyY&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw

170 B
190 B

34ms
33ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitULEZYDZ5ZcJRPk9uEH3XE11qnrxymQqV1WS1D2Sia2qA0fW5g2kp8xsE8POWzq8qBe7KqVtHv2-deFTI5ezA86ZmMJsmyY&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:41 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitULEZYDZ5ZcJRPk9uEH3XE11qnrxymQqV1WS1D2Sia2qA0fW5g2kp8xsE8POWzq8qBe7KqVtHv2-deFTI5ezA86ZmMJsmyY&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: clear
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame E7F7
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGyTJw_NwO-27VhLNDQC5kI&google_cver=1&google_push=AQvitUKTw-zyGbYPwydCAVGihJQ4paDRvsFaTsFCFLnl8o0wONEYPqze02a4TNyG6J4kZ9jCJLo5w5P6...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMzI5MTkyODMwMjc2MzcxOA&google_push=AQvitUKTw-zyGbYPwydCAVGihJQ4paDRvsFaTsFCFLnl8o0wONEYPqze02a4TNyG6J4kZ9jCJLo5w5...

170 B
190 B

33ms
33ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMzI5MTkyODMwMjc2MzcxOA&google_push=AQvitUKTw-zyGbYPwydCAVGihJQ4paDRvsFaTsFCFLnl8o0wONEYPqze02a4TNyG6J4kZ9jCJLo5w5P6OtcDqYNDdH1BooO9VA

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMzI5MTkyODMwMjc2MzcxOA&google_push=AQvitUKTw-zyGbYPwydCAVGihJQ4paDRvsFaTsFCFLnl8o0wONEYPqze02a4TNyG6J4kZ9jCJLo5w5P6OtcDqYNDdH1BooO9VA
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
expires: -1

GET
H3-Q050 204 attr
cm.g.doubleclick.net/pixel/ Frame E7F7 0
16 B 33ms
31ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JplstYi4ccRRBcP8-90Cf_-NmdDtu0By_JyL6xMm-7P1s0vwdZ_i6ToQk

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-Q050 200 DcmEnabler_01_242.js Show response
s0.2mdn.net/879366/ Frame B3B3 29 KB
10 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_242.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9080429/1589458486121/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77a6e7584722f285dd6b3039728b6f1aab3948e60b4c26298600f1a5ee155bbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9080429/1589458486121/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:23:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 587
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10603
x-xss-protection: 0
last-modified: Thu, 06 Feb 2020 15:49:49 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 21:23:55 GMT

GET
H3-Q050 200 gsap_3.0.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame B3B3 54 KB
22 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.0.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9080429/1589458486121/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8154aa9057e3367d9d3e4bb1f85db9645c01fc0690091aadc57dbae849ba3499

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9080429/1589458486121/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22005
x-xss-protection: 0
last-modified: Mon, 11 Nov 2019 18:08:13 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Mar 2021 21:33:42 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/ Frame B3B3 86 KB
28 KB 10ms
10ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9080429/1589458486121/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 522379
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27748
cf-request-id: 08e3b4e85500004d8a273b6000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-15851"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=xUEadLli1hbMYUj1tgDh2z0P7LWjOnwONeASqqqzSmDNOr6imP47iobu20MsarV%2BBWPuZK2u98HefILs3IS%2FpO3ui6bS8V2uLxtnH4WqSo53t%2BQD49uQEeALGhoPGMSagg%3D%3D"}],"max_age":604800,"group":"cf-nel"}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 63195753bccf4d8a-FRA
expires: Mon, 07 Mar 2022 21:33:42 GMT

GET
H/1.1 200
OK j-4171841-3341835.js Show response
cdn.flashtalking.com/xre/417/4171841/3341835/js/ Frame 2B5C 54 KB
15 KB 125ms
52ms Script
text/javascript 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/xre/417/4171841/3341835/js/j-4171841-3341835.js
Requested by: Host: servedby.flashtalking.com
URL: https://servedby.flashtalking.com/imp/8/115750;4171841;201;jsappend;DV360;DV360FY20AcrobatCTXCustomIntentCompetitiveFRDSKBAN728x90/?ftOBA=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fbe2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-37%2Fhtml%2Fcontainer.html&us_privacy=${US_PRIVACY}&cachebuster=295362.3346909591
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: d1e2b75ddf4d29937af3c47d551a10ec90a6e857a555e3998b52509cedd77c2a

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Encoding: gzip
Last-Modified: Thu, 11 Feb 2021 04:44:24 GMT
Server: Flashtalking (AKA)
ETag: W/"02f10906ad68e91c86ce5af719734afe"
Vary: Accept-Encoding
X-Varnish: 559646708 559295964
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 14958
Expires: Wed, 17 Mar 2021 21:53:42 GMT

GET
H/1.1 200
OK j-4229316-2787248.js Show response
cdn.flashtalking.com/xre/422/4229316/2787248/js/ Frame 3FEC 46 KB
13 KB 170ms
99ms Script
text/javascript 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/xre/422/4229316/2787248/js/j-4229316-2787248.js
Requested by: Host: servedby.flashtalking.com
URL: https://servedby.flashtalking.com/imp/8/115845;4229316;201;jsappend;DV360;DV360FY20CCBEHCustomIntentFRDSKBAN300x250/?ftOBA=1&ft_domain=www.reisekostenabrechnung.com&ft_ifb=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&us_privacy=${US_PRIVACY}&cachebuster=955845.341251612
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: e9c9d33909759c9d5518a848d0479261502be89380dd8901f2af584091faa901

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Feb 2021 20:15:23 GMT
Server: Flashtalking (AKA)
ETag: W/"a0a1b70885f8833c172b17f3a7bea984"
Vary: Accept-Encoding
X-Varnish: 623980243
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 13152
Expires: Wed, 17 Mar 2021 21:53:42 GMT

GET
H3-Q050 200 JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js Show response
pagead2.googlesyndication.com/bg/ Frame 41CC 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25c788c3d6b5a5f5931ef45abc5640af29b16f379c2e1634dc32c6c225327f38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 16:25:17 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 104905
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5657
x-xss-protection: 0
expires: Wed, 16 Mar 2022 16:25:17 GMT

GET
H3-Q050 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
146 B 15ms
14ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
146 B 16ms
15ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 351 B
378 B 242ms
242ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=281687354067496&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C420x330%7C310x340&ris=2&rcs=3&prev_scp=a%3D%257C6%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3D780324bcbe122aeb7768d94246861ef2%2Cad0061a38dd7c6f7bcb692aee88dfda4%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D14%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D3%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C19%2C20%2C17%2C19%2C20%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D26%26reqt%3D1616016821401&eri=1&cookie=ID%3Dd24887b9dae7ce82%3AT%3D1616016820%3AS%3DALNI_MY23LV3q1DT-QweOlMk2xYhFG1Y4w&bc=31&abxe=1&lmt=1616016822&dt=1616016822419&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=348&adys=962&adks=1838216046&ucis=k&ifi=20&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

ec966c6935469f98fffcc5f54814228ea1733dc59be245a5d7b5f669dfa28751

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:42 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 153
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame B12A
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1&google_push=AQvitUIy6rA4HdQQhvixf3cbuHbbH22yl1EdtSX0YFxcVVezwM9kalghDzjvuLQktRfp_A6YEp5emBerZV5BhbhMv-q2-jAA4P4
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzQ5Njk5OTg3MjY4MzA1OTMyNw==
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1

43 B
407 B

26ms
26ms

Image
image/gif

46.228.164.11
TURN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.228.164.11 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame B12A
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGrbieRq_6tOzV0mUDDvWHk&google_cver=1&google_push=AQvitUJ5jyBQBvLOkcsJNHeBWGdbUlmHUJqWLBNc4FlFJxV079wj9IQnkZ...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AQvitUJ5jyBQBvLOkcsJNHeBWGdbUlmHUJqWLBNc4FlFJxV079wj9IQnkZjN49dNHDUq4YMK9aCyDc1hKSD7S_4mkaeh_FxOhVg&google_hm=D6K3-ip...

170 B
190 B

32ms
32ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AQvitUJ5jyBQBvLOkcsJNHeBWGdbUlmHUJqWLBNc4FlFJxV079wj9IQnkZjN49dNHDUq4YMK9aCyDc1hKSD7S_4mkaeh_FxOhVg&google_hm=D6K3-ipeowN5PqE5rDQ-gA

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AQvitUJ5jyBQBvLOkcsJNHeBWGdbUlmHUJqWLBNc4FlFJxV079wj9IQnkZjN49dNHDUq4YMK9aCyDc1hKSD7S_4mkaeh_FxOhVg&google_hm=D6K3-ipeowN5PqE5rDQ-gA
pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame B12A
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUKmFrL6HHUz4RPlACfLp1IpeKW-G71m6iPXuxEMO1B...

170 B
190 B

33ms
33ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUKmFrL6HHUz4RPlACfLp1IpeKW-G71m6iPXuxEMO1B4JhKLxmdsdGAUkZrLXsEU0ym7k7R2_ivxwsNDf6uL8uZGEjAbaiJJ

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: PingMatch/v2.0.30-619-g1028223#rel-ec2-master i-0ae06fec161a2bbf2@eu-central-1a@dxedge-app-eu-central-1-prod-asg
P3P: policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitUKmFrL6HHUz4RPlACfLp1IpeKW-G71m6iPXuxEMO1B4JhKLxmdsdGAUkZrLXsEU0ym7k7R2_ivxwsNDf6uL8uZGEjAbaiJJ
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame B12A
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEDeuKqu6wPNHWf8gYwfMw80&google_cver=1&google_push=AQvitUKIkaUrnCj78dgFEStYaL2WBWTO2YynKMEvUR2WDdW3hrZdWgH1DUgMBVLEgFsic7uMuziA0ZOkKGH...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUKIkaUrnCj78dgFEStYaL2WBWTO2YynKMEvUR2WDdW3hrZdWgH1DUgMBVLEgFsic7uMuziA0ZOkKGH4XGEtGl94MVb_eJM&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw

170 B
190 B

34ms
33ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUKIkaUrnCj78dgFEStYaL2WBWTO2YynKMEvUR2WDdW3hrZdWgH1DUgMBVLEgFsic7uMuziA0ZOkKGH4XGEtGl94MVb_eJM&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:41 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUKIkaUrnCj78dgFEStYaL2WBWTO2YynKMEvUR2WDdW3hrZdWgH1DUgMBVLEgFsic7uMuziA0ZOkKGH4XGEtGl94MVb_eJM&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: clear
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame B12A
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGyTJw_NwO-27VhLNDQC5kI&google_cver=1&google_push=AQvitUIu-tKfJsWCH6wlmY271LzIYNyX1px6HbdmDSy3drjwkVFz_TLhDD2t5AtZ7U_7iZ7fZkFBbmqO...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDc4MTM5NTg4NzM0Njg3ODc5NA&google_push=AQvitUIu-tKfJsWCH6wlmY271LzIYNyX1px6HbdmDSy3drjwkVFz_TLhDD2t5AtZ7U_7iZ7fZkFBbm...

170 B
190 B

33ms
32ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDc4MTM5NTg4NzM0Njg3ODc5NA&google_push=AQvitUIu-tKfJsWCH6wlmY271LzIYNyX1px6HbdmDSy3drjwkVFz_TLhDD2t5AtZ7U_7iZ7fZkFBbmqOP2jvV8U-WleYdHzFNrbD

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDc4MTM5NTg4NzM0Njg3ODc5NA&google_push=AQvitUIu-tKfJsWCH6wlmY271LzIYNyX1px6HbdmDSy3drjwkVFz_TLhDD2t5AtZ7U_7iZ7fZkFBbmqOP2jvV8U-WleYdHzFNrbD
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
expires: -1

GET
H3-Q050 204 attr
cm.g.doubleclick.net/pixel/ Frame B12A 0
16 B 32ms
31ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KN1RMJapdeVqmFkHx0k2aEuO_2G4wEu8q80FqT6av1WDQOsvRG8jOu7GA

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:42 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-Q050 200 Gilroy-SemiBold.ttf
s0.2mdn.net/9080429/1589458486121/ Frame B3B3 79 KB
36 KB 8ms
7ms Font
font/ttf 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9080429/1589458486121/Gilroy-SemiBold.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9080429/1589458486121/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d14179c52c8976762b2a18c43bf2bf151281ea48aaa8b2fd4433ea046cebba64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/9080429/1589458486121/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 08:01:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48720
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36779
x-xss-protection: 0
last-modified: Thu, 14 May 2020 12:14:46 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 18 Mar 2021 08:01:42 GMT

GET
H3-Q050 200 Gilroy-Medium.ttf
s0.2mdn.net/9080429/1589458486121/ Frame B3B3 79 KB
36 KB 8ms
8ms Font
font/ttf 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9080429/1589458486121/Gilroy-Medium.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9080429/1589458486121/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ea218661f49e28158ba378bd053b70c878adb09953e5ae48cab3768651a4abe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/9080429/1589458486121/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 01:15:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73100
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36988
x-xss-protection: 0
last-modified: Thu, 14 May 2020 12:14:46 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 18 Mar 2021 01:15:22 GMT

POST
H3-Q050 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1B53 0
515 B 128ms
59ms Other
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:42 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-Q050 200 logo_White.png
s0.2mdn.net/9080429/1589458486121/ Frame B3B3 4 KB
4 KB 9ms
8ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9080429/1589458486121/logo_White.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28161d419de84b0fb3c3bb264e0b244f907bb1bf505da450c833c34edf95d3a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9080429/1589458486121/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 03:40:24 GMT
x-content-type-options: nosniff
last-modified: Thu, 14 May 2020 12:14:46 GMT
server: sffe
age: 64398
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3892
x-xss-protection: 0
expires: Thu, 18 Mar 2021 03:40:24 GMT

GET
H3-Q050 200 trust_Logo_White.png
s0.2mdn.net/9080429/1589458486121/ Frame B3B3 4 KB
4 KB 7ms
6ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9080429/1589458486121/trust_Logo_White.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7dabd76ad06582c66fd0838e1e831a74a425bc01f73870eadd2ecc67af87b38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9080429/1589458486121/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 19:42:13 GMT
x-content-type-options: nosniff
last-modified: Thu, 14 May 2020 12:14:46 GMT
server: sffe
age: 6689
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4308
x-xss-protection: 0
expires: Thu, 18 Mar 2021 19:42:13 GMT

GET
H3-Q050 200 Convenience.png
s0.2mdn.net/9080429/1589458486121/ Frame B3B3 44 KB
44 KB 10ms
9ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9080429/1589458486121/Convenience.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

17dd9204e346e364c9539624fb7f5b547de6cbaf82a805a79fe37dc99edf801b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9080429/1589458486121/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 04:53:26 GMT
x-content-type-options: nosniff
last-modified: Thu, 14 May 2020 12:14:46 GMT
server: sffe
age: 60016
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44726
x-xss-protection: 0
expires: Thu, 18 Mar 2021 04:53:26 GMT

GET
H3-Q050 200 cta_Green.png
s0.2mdn.net/9080429/1589458486121/ Frame B3B3 2 KB
2 KB 9ms
8ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9080429/1589458486121/cta_Green.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bebfd51b68600bcc3ddf379ce44cd7f5efd700a8918e587be24ff865fdc361d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9080429/1589458486121/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:21:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 14 May 2020 12:14:46 GMT
server: sffe
age: 18717
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2022
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:21:45 GMT

GET
H3-Q050 200 bg_LightPurple.png
s0.2mdn.net/9080429/1589458486121/ Frame B3B3 1 KB
1 KB 9ms
8ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9080429/1589458486121/bg_LightPurple.png

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36e400cbc8956e93b9abeb302f00aab451688c688c49c32e8dbb6cc4761ebf69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9080429/1589458486121/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 07:17:02 GMT
x-content-type-options: nosniff
last-modified: Thu, 14 May 2020 12:14:46 GMT
server: sffe
age: 51400
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1449
x-xss-protection: 0
expires: Thu, 18 Mar 2021 07:17:02 GMT

GET
H/1.1 200 d9core Show response
d9.flashtalking.com/ Frame 2B5C 11 KB
4 KB 132ms
32ms Script
application/javascript 34.251.104.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d9.flashtalking.com/d9core
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/417/4171841/3341835/js/j-4171841-3341835.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.251.104.84 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-104-84.eu-west-1.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) OpenSSL/1.0.2k-fips /
Resource Hash: 92fcddd530f832a65860eedc146abbdfae76ac307cde548e7ed8c36d6977b9e2

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Encoding: gzip
Server: Apache/2.4.41 (Amazon) OpenSSL/1.0.2k-fips
ETag: c1371f93b03ae0af7d575e3774a51128
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST,SERVER
P3P: policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Access-Control-Allow-Origin: d9.flashtalking.com
Cache-Control: private, must-revalidate, proxy-revalidate, max-age=172800
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript;charset=utf-8
Content-Length: 3904

GET
H/1.1 200
OK index.html Show response
cdn.flashtalking.com/116327/3341835/ Frame EC5C 99 KB
18 KB 58ms
57ms Document
text/html 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/116327/3341835/index.html
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/417/4171841/3341835/js/j-4171841-3341835.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: d0cadf92e9b065836107866fa40b1d777cf50592d45091c5423c0d192b0a6743

Request headers

Host: cdn.flashtalking.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: flashtalkingad1="GUID=4824B75C5F0ECC"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Access-Control-Max-Age: 3000
Last-Modified: Thu, 28 Jan 2021 22:44:40 GMT
Content-Type: text/html
ETag: W/"93394824275144118a5a9d77af1ccdb0"
X-Varnish: 925350462
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=1200
Expires: Wed, 17 Mar 2021 21:53:42 GMT
Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Length: 17662
Connection: keep-alive
Server: Flashtalking (AKA)

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 2B5C 7 KB
3 KB 9ms
9ms Script
application/javascript 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=1828362&cmp=115750&sid=18330&plc=4171841&num=&adid=&advid=&adsrv=29&btreg=4171841&btadsrv=flashtalking&crt=3341835&crtname=&chnl=&unit=&pid=&uid=&dvtagver=6.1.src&dvp_ftimpid=E97D5CC5-F0DD-7E65-D420-74CAFC035653&343465521
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/417/4171841/3341835/js/j-4171841-3341835.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: fa57c3f9d183c672e35364859903c259235517855e530d6707404031c7b3db97

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Mar 2021 18:15:47 GMT
Server: Microsoft-IIS/10.0
ETag: "80cb748d591bd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3005

GET
H/1.1 200
OK iconc.png
secure.flashtalking.com/oba/icon/ Frame 2B5C 1 KB
2 KB 106ms
35ms Image
image/png 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.flashtalking.com/oba/icon/iconc.png?EDAA_icon=y
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: f75ada33b07cb31e16a0a0d3325961a22dc9526edb49bff04c31d7b7611f7025

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Last-Modified: Sat, 12 Apr 2014 19:14:32 GMT
Server: Flashtalking (AKA)
ETag: W/"db320ef6f3c45ab5c90887ef618de2bb"
X-Varnish: 528057889 340801437
Cache-Control: max-age=1080851
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 1308
Expires: Tue, 30 Mar 2021 09:47:53 GMT

GET
DATA 200
OK truncated
/ Frame 2B5C 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200 d9core Show response
d9.flashtalking.com/ Frame 3FEC 11 KB
4 KB 128ms
33ms Script
application/javascript 34.251.104.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d9.flashtalking.com/d9core
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/422/4229316/2787248/js/j-4229316-2787248.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.251.104.84 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-104-84.eu-west-1.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) OpenSSL/1.0.2k-fips /
Resource Hash: 49c5f156728fa40f3cc8ee749201723059f4c2f52d4a50a39adc7e32833c638c

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Encoding: gzip
Server: Apache/2.4.41 (Amazon) OpenSSL/1.0.2k-fips
ETag: c1371f93b03ae0af7d575e3774a51128
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST,SERVER
P3P: policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Access-Control-Allow-Origin: d9.flashtalking.com
Cache-Control: private, must-revalidate, proxy-revalidate, max-age=172800
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript;charset=utf-8
Content-Length: 3902

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 3FEC 7 KB
3 KB 10ms
9ms Script
application/javascript 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=1828362&cmp=115845&sid=18330&plc=4229316&num=&adid=&advid=&adsrv=29&btreg=4229316&btadsrv=flashtalking&crt=2787248&crtname=&chnl=&unit=&pid=&uid=&dvtagver=6.1.src&dvp_ftimpid=21EC7720-0A50-546F-9FA1-5791BD6ADB83&855125691
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/422/4229316/2787248/js/j-4229316-2787248.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: fa57c3f9d183c672e35364859903c259235517855e530d6707404031c7b3db97

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Mar 2021 18:15:47 GMT
Server: Microsoft-IIS/10.0
ETag: "80cb748d591bd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3005

GET
H/1.1 200
OK iconc.png
secure.flashtalking.com/oba/icon/ Frame 3FEC 1 KB
2 KB 115ms
34ms Image
image/png 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.flashtalking.com/oba/icon/iconc.png?EDAA_icon=y
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/xre/422/4229316/2787248/js/j-4229316-2787248.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: f75ada33b07cb31e16a0a0d3325961a22dc9526edb49bff04c31d7b7611f7025

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Last-Modified: Sat, 12 Apr 2014 19:14:32 GMT
Server: Flashtalking (AKA)
ETag: W/"db320ef6f3c45ab5c90887ef618de2bb"
X-Varnish: 528057889 340801437
Cache-Control: max-age=1080851
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 1308
Expires: Tue, 30 Mar 2021 09:47:53 GMT

GET
H/1.1 200
OK 2787248.gif
cdn.flashtalking.com/xre/422/4229316/2787248/image/ Frame 3FEC 93 KB
94 KB 95ms
95ms Image
image/gif 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flashtalking.com/xre/422/4229316/2787248/image/2787248.gif?877327743
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: dab782e34cabcce3f11dc1b6d28be09129b3283a6aeb2c83d9902839ea29b8a3

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Last-Modified: Thu, 11 Feb 2021 00:36:03 GMT
Server: Flashtalking (AKA)
ETag: W/"58935ca0e72a47059e03b0d2ab4bfd1d"
X-Varnish: 171616950 170773720
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 95573
Expires: Wed, 17 Mar 2021 21:53:42 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4C06 0
46 B 41ms
40ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BTSEJtXVSYIyANamN3gONl7bQBQAAAAA4AeAEAg&bg=!eHulez_NAAbUo7L91KM7ACkAdvg8WlWr5WxF5hjqdXgh_vXUGMqESoobaymzwKr2b3YDTYKWHlnRugIAAAFzUgAAADNoAQeZAtW1Pp_WqUjSj9l1JIZdtyFMpzEj0ASQvT9reAJx7wEq7xjcL_t6FCVRv0a4VlLVycAhoqNR_f6ACf45u_b38cwx4Rx0--psG59BzcyJA0h4WR6fnY47nBIB12b7IwQvjq7ZnqkepPqQtbjYK_7V0Vd7Co-u_Xwn4WGTmhG7v_iD3ruEILZ1K6ARgqAG2YRb0nYSpYPj8Cj_YS-xDzt6zusYrBi9EQD_ixT8pc1s8wzN9SKYVgsxYf5-xgDnLrXsqGaOpRrSD6QVmcLK3VKVKmFR3sQKoDn5dBzXonwDCIITfJoa44FpTS6Al_sSrIpkFrheepl_12FdxUvatfRIlDtYzFckaFeGRxV5CuviXCEHXg7hkUREvSugEusrNaZjrJMJOuqQ0CBNau35mxdy1MbgRXrgJ_rosDALJkK0pRXkR5psJuSdjHR8MHGaMWa02gq43_y_Nm7vaiPF_jA_6L0XH28yRFQhwXB_vKK2HrzINL1lrCPlq-bHfBBEEhSShLh_zB5ZTHyoGFBICTR9_7pgjJlpausGPnsNsxgdNJfs9RDcjiGyU6GlDM6XZXHYf14GqhjLMHQ92cSTXqvItEt-uPEAohRur7SXsRierrwdLz_rFyyKRIVJDPv-uahVCQsugJLwaVE0r3IBwnFFtoRS-o8GzI7Pj9jnfkYukxdqH7C_UfgPnQgPb8TDw4OG9Eb3w9gp7lGaP22Q_-nFjvTupBMCjTU3YewNqNmZaPw6mbgM1PNAFSRCBK1EiZI6mggylvtL8E55JRKfDo_Sp3iGDKQlzjjOw0zOSsVv7T3K50y0ImareZMHjMH3ocYp-KMl_ZlxSbrF55-U-8H4fpQLkK2VOR81SwQt0_cOsKPNpLGxVfuUlIUuhGPMvslSHi02JBTQmqq-82zL8YEivVBO_vMSUCvkrGh_Zhl53Fw65V7SUryOor-kxVUZ8cOuCYcHKmBRHQ

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dv-measurements1146.js Show response
cdn.doubleverify.com/ Frame 575C 476 KB
86 KB 10ms
9ms Script
application/javascript 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements1146.js
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: ada2b7b8e97b28a0c397cf381249d2ba6b7bd3c6f028cb071ef548e6451d31e7

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Mar 2021 07:48:29 GMT
Server: Microsoft-IIS/10.0
ETag: "80c475eb11bd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946083600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 87408

GET
H/1.1 200
OK dv-measurements1146.js Show response
cdn.doubleverify.com/ Frame F660 476 KB
86 KB 9ms
9ms Script
application/javascript 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements1146.js
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: ada2b7b8e97b28a0c397cf381249d2ba6b7bd3c6f028cb071ef548e6451d31e7

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Mar 2021 07:48:29 GMT
Server: Microsoft-IIS/10.0
ETag: "80c475eb11bd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946083600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 87408

GET
H/1.1 200
OK t2tv7.html Show response
cdn.doubleverify.com/ Frame 72CF 12 KB
4 KB 10ms
9ms Document
text/html 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/t2tv7.html
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 29f21aea7fc613d2618b70a483e0b4bf50ba3f4ce4109fa429ce580ec57ef991

Request headers

Host: cdn.doubleverify.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

Cache-Control: max-age=946080000
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Thu, 11 Sep 2014 19:15:16 GMT
Accept-Ranges: bytes
ETag: "0ba3b8f4cdcf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
Content-Length: 3880
Date: Wed, 17 Mar 2021 21:33:42 GMT
Connection: keep-alive

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 575C 3 KB
2 KB 29ms
29ms Script
text/javascript 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&bridua=3&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5DC6%3AD6%3C%40DE6%3F23C649%3FF%3F8%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5DC6%3AD6%3C%40DE6%3F23C649%3FF%3F8%5D4%40%3ETar9EEADTbpTauTau36a_cc7576%607h42__7hbhf%60hf_bcdaa5%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3ETar9EEADTbpTauTau36a_cc7576%607h42__7hbhf%60hf_bcdaa5%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=761&ddur=10&uid=1616016822695788&jsCallback=dvCallback_1616016822695406&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&htmlmsging=1&chro=0&hist=2&winh=90&winw=728&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=1146&tgjsver=1146&lvvn=28&m1=13&refD=2&referrer=https%3A%2F%2Fbe2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-37%2Fhtml%2Fcontainer.html&fcifrms=5&brh=2&dvp_epl=380&noc=12&ctx=1828362&cmp=115750&sid=18330&plc=4171841&crt=3341835&btreg=4171841&btadsrv=flashtalking&adsrv=29&errorURL=https://tps.doubleverify.com/visit.jpg&dvp_ftimpid=E97D5CC5-F0DD-7E65-D420-74CAFC035653&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_tcnt=2&dvp_sukv=1884286265.484844&dvp_tukv=922225210.3152801&dvp_uuid=143348469.86000654&dvp_strhd=0.2150004729628563&dvpx_strhd=0.2150004729628563&dvp_tuid=1571135943052&dvp_vcms=8&dvp_slmsd=46&dvp_vcmsd=54
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 773eb27e80f3e8ac73717276433272ae10a470067ea1b4485e783358a9198d38

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:41 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Expires: 3/16/2021 9:33:42 PM

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 39A5 0
23 B 41ms
41ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BhAhltXVSYImAOKrO7_UPo9G8gAQAAAAAOAHgBAI&bg=!PD-lP3vNAAbUo7L91KM7ACkAdvg8WvkeI7-Yl_JjB5tBzTh1UTJo1Yd2eCDOTUX9u10UzCehbKZFsQIAAAD2UgAAACZoAQcKAEVNPw0x7kaTzvJ98H79hLNV72k8f3QvGmBfugi-VL18GNIy5Z1HxRqAzy3bMzEpZ-Pt9oDnOhqrjRdyVpv9eWB31vxIdfGZAoUxVW0AjD6PkjQnAVFY_OwpC9ar8Y4dHLcthze5QZpJHKEit3v-tTU6Me4ivi40AMOXPvWTWgwOD5pGHe493kjEEhwGVacEXyZdS3_DzfCak5OD6g9NDP1gtFdGSrR0bk7NKeb8Aea0fVvTiq9tgnQinkfrxI9RI6Lx097Iz06ekrmauvSPlYqC95gizJDWt-oJfdaYjqHZ0qVuUg2qwfC2cY98CXto4k0RonIglMYTRnoYSjsDi45pJAYjxXnFIvIO_I6Zk_u1zjVA9_ooPWIIhmcQS6Gdb0ILTcE6DFMdeMzvCF_znBvVLXbWmHLAjyiWCWj94slmjJDYw27ItCD_6CvTRW--TH0SLVS1jflvzegyIMk27yXtt8DcAM06STWH4JJ9yCv7sU3KIK81-cIQcBFuV_1f0r6OWqEu6Zc7i6Nt54P1x0YExZsWOoXcZ7yR9i6_batAKj4KDINrnU9fvWGHYjh8uTuofIBN7wUTQXB5pOiRiilIvGvFF48_pelPQNfYCgnRQe6AIgJ4FWEa4YzbrVNcSzz8ZReG8Sim6bAdNSFoUTdTtNY_u3L4ByAyHM4RIFLrEuJw4NieyboVqj6AXu5CT_tUv5-yH_D3RiLAaUIcrUOXj3zzEzRRN0AXUt1_R2fDGcAXqryPtVsNg6uGzVlofsObQm9RqjCzhx7bJ4z6uCC_1WwBgnJUiUL9Ex3SVL0U3roKnvkkQ76lST4RRskc-uEpI4y5s8QjoWu3TOVERtLi0K5PZ4CjqnZL_x-0eR0atfucAC6qGiRRZyFaGV0j0PmD8lN4rxVZI3BMvpVNjcmyUCkh9IStVaHcQEpU8X4IEykUotZfr0cFJzOvRCs

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK t2tv7.html Show response
cdn.doubleverify.com/ Frame BF81 12 KB
4 KB 10ms
9ms Document
text/html 2a02:26f0:10c:49e::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/t2tv7.html
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:49e::4469 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 29f21aea7fc613d2618b70a483e0b4bf50ba3f4ce4109fa429ce580ec57ef991

Request headers

Host: cdn.doubleverify.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

Cache-Control: max-age=946080000
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Thu, 11 Sep 2014 19:15:16 GMT
Accept-Ranges: bytes
ETag: "0ba3b8f4cdcf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
Content-Length: 3880
Date: Wed, 17 Mar 2021 21:33:42 GMT
Connection: keep-alive

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame F660 4 KB
2 KB 28ms
27ms Script
text/javascript 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&bridua=3&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5DC6%3AD6%3C%40DE6%3F23C649%3FF%3F8%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5DC6%3AD6%3C%40DE6%3F23C649%3FF%3F8%5D4%40%3ETar9EEADTbpTauTau36a_cc7576%607h42__7hbhf%60hf_bcdaa5%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=831&ddur=10&uid=1616016822746459&jsCallback=dvCallback_1616016822746413&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&htmlmsging=1&chro=0&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=1146&tgjsver=1146&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2Fbe2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-37%2Fhtml%2Fcontainer.html&fcifrms=5&brh=2&dvp_epl=267&noc=12&ctx=1828362&cmp=115845&sid=18330&plc=4229316&crt=2787248&btreg=4229316&btadsrv=flashtalking&adsrv=29&errorURL=https://tps.doubleverify.com/visit.jpg&dvp_ftimpid=21EC7720-0A50-546F-9FA1-5791BD6ADB83&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_tcnt=2&dvp_sukv=4694602525.075235&dvp_tukv=110610829.1163224&dvp_uuid=340685522.24054486&dvp_strhd=0.2100002020597458&dvpx_strhd=0.2100002020597458&dvp_tuid=757505432982&dvp_vcms=6&dvp_slmsd=80&dvp_vcmsd=86
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.0 / ASP.NET
Resource Hash: f6b6c0dfaa89fe482fd724314eee367973d9d82d8d4181e2d24102ee378b9320

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Expires: 3/16/2021 9:33:42 PM

POST
H/1.1 200 lgc Show response
d9.flashtalking.com/ Frame 2B5C 118 B
798 B 43ms
42ms XHR
application/json 34.251.104.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d9.flashtalking.com/lgc
Requested by: Host: d9.flashtalking.com
URL: https://d9.flashtalking.com/d9core
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.251.104.84 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-104-84.eu-west-1.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) OpenSSL/1.0.2k-fips /
Resource Hash: a94187bbe2f8484d353b34a03e40646e2c67605b74289882a20a2752b4e83b74

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Encoding: gzip
Server: Apache/2.4.41 (Amazon) OpenSSL/1.0.2k-fips
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST,SERVER
P3P: policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Access-Control-Allow-Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=ISO-8859-1
Content-Length: 90

POST
H/1.1 200 lgc Show response
d9.flashtalking.com/ Frame 3FEC 103 B
787 B 45ms
45ms XHR
application/json 34.251.104.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d9.flashtalking.com/lgc
Requested by: Host: d9.flashtalking.com
URL: https://d9.flashtalking.com/d9core
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.251.104.84 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-104-84.eu-west-1.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) OpenSSL/1.0.2k-fips /
Resource Hash: 00c7f681cd8605d131a231554e654a1042ea218ea112b6a0c653001a63bedeac

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Content-Encoding: gzip
Server: Apache/2.4.41 (Amazon) OpenSSL/1.0.2k-fips
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST,SERVER
P3P: policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Access-Control-Allow-Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=ISO-8859-1
Content-Length: 79

GET
H/1.1 200
OK 1_Send_for_Signature_PopUp.png
cdn.flashtalking.com/116327/3341835/ Frame EC5C 8 KB
9 KB 47ms
45ms Image
image/png 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flashtalking.com/116327/3341835/1_Send_for_Signature_PopUp.png
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: 638eafaa23d3d1f411bff28ebc87ae6aa09d3c110228e93fa6868632a7cd4d36

Request headers

Referer: https://cdn.flashtalking.com/116327/3341835/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Last-Modified: Thu, 28 Jan 2021 22:44:40 GMT
Server: Flashtalking (AKA)
ETag: W/"2f4a1776710125f3fa0dc333eb48486a"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
X-Varnish: 970305907
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 8159
Expires: Wed, 17 Mar 2021 21:53:42 GMT

GET
H/1.1 200
OK Layer_1.png
cdn.flashtalking.com/116327/3341835/ Frame EC5C 25 KB
25 KB 46ms
45ms Image
image/png 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flashtalking.com/116327/3341835/Layer_1.png
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: 637fac9268b2df661905ddb54af762320839777e0102c34bf2b66fa76f9a18bb

Request headers

Referer: https://cdn.flashtalking.com/116327/3341835/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Last-Modified: Thu, 28 Jan 2021 22:44:40 GMT
Server: Flashtalking (AKA)
ETag: W/"df9212f2da46675867faee41ce88a759"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
X-Varnish: 1021428834 1021595436
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 25293
Expires: Wed, 17 Mar 2021 21:53:42 GMT

GET
H/1.1 200
OK 3_signature.png
cdn.flashtalking.com/116327/3341835/ Frame EC5C 5 KB
6 KB 92ms
45ms Image
image/png 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flashtalking.com/116327/3341835/3_signature.png
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: fea355bd50e55e29f7b964c046b880bcf1218c0d9bae25d0c2e222dee6a0c6e9

Request headers

Referer: https://cdn.flashtalking.com/116327/3341835/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Last-Modified: Thu, 28 Jan 2021 22:44:40 GMT
Server: Flashtalking (AKA)
ETag: W/"489deec4bc3c729b33207e39d2fbb62d"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
X-Varnish: 925062658
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 5341
Expires: Wed, 17 Mar 2021 21:53:42 GMT

GET
H/1.1 200
OK 3_FullWidth_Phone_acrobat-conversion-batch_sign.png
cdn.flashtalking.com/116327/3341835/ Frame EC5C 32 KB
33 KB 116ms
45ms Image
image/png 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flashtalking.com/116327/3341835/3_FullWidth_Phone_acrobat-conversion-batch_sign.png
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: 2f703dab5fd89d7a9063b534991c35445b154575428aa7e2397d819fc8263f7a

Request headers

Referer: https://cdn.flashtalking.com/116327/3341835/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:43 GMT
Last-Modified: Thu, 28 Jan 2021 22:44:40 GMT
Server: Flashtalking (AKA)
ETag: W/"cbbad8a1c53a7db1ae06a9db1a350142"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
X-Varnish: 627607361
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 32746
Expires: Wed, 17 Mar 2021 21:53:43 GMT

GET
H/1.1 200
OK Adobe_Corporate_Logo.png
cdn.flashtalking.com/116327/3341835/ Frame EC5C 2 KB
3 KB 171ms
99ms Image
image/png 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flashtalking.com/116327/3341835/Adobe_Corporate_Logo.png
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: ab512420f81c4a334d7064d9dbcab398fd69a83f54158a96d8960001b39995c0

Request headers

Referer: https://cdn.flashtalking.com/116327/3341835/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:43 GMT
Last-Modified: Thu, 28 Jan 2021 22:44:40 GMT
Server: Flashtalking (AKA)
ETag: W/"a4f76265703447635e112e8cf79a89a1"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
X-Varnish: 395647568
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 2460
Expires: Wed, 17 Mar 2021 21:53:43 GMT

GET
H/1.1 200
OK CTA.png
cdn.flashtalking.com/116327/3341835/ Frame EC5C 4 KB
5 KB 137ms
44ms Image
image/png 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flashtalking.com/116327/3341835/CTA.png
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: 7858a7bc511749ce9b0097ac9d6c6464c8f96fc392e69bc857a81b1b80457369

Request headers

Referer: https://cdn.flashtalking.com/116327/3341835/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:43 GMT
Last-Modified: Thu, 28 Jan 2021 22:44:40 GMT
Server: Flashtalking (AKA)
ETag: W/"4d560cc47c8af1725db348bc982f91ac"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
X-Varnish: 27333345 26765027
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 4052
Expires: Wed, 17 Mar 2021 21:53:43 GMT

GET
H/1.1 200
OK 2_Collect-e-signatures--in-Google-Drive_01.png
cdn.flashtalking.com/116327/3341835/ Frame EC5C 4 KB
4 KB 97ms
46ms Image
image/png 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flashtalking.com/116327/3341835/2_Collect-e-signatures--in-Google-Drive_01.png
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: ca7e2ea27a1cd7ac6f4afa24d3ae3c342b696b7e31f725a84ee227789cac42fe

Request headers

Referer: https://cdn.flashtalking.com/116327/3341835/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:43 GMT
Last-Modified: Thu, 28 Jan 2021 22:44:40 GMT
Server: Flashtalking (AKA)
ETag: W/"5e91c13e3a401b3a3e49a410806ea256"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
X-Varnish: 991378940 993409841
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 3791
Expires: Wed, 17 Mar 2021 21:53:43 GMT

GET
H/1.1 200
OK 1-2_Collect-e-signatures--in-Google-Drive_02.png
cdn.flashtalking.com/116327/3341835/ Frame EC5C 3 KB
4 KB 78ms
55ms Image
image/png 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flashtalking.com/116327/3341835/1-2_Collect-e-signatures--in-Google-Drive_02.png
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: 4fe5c678cf87925228025af1ab82c092bd7bd1af07c563ebec076326f10d07f5

Request headers

Referer: https://cdn.flashtalking.com/116327/3341835/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:43 GMT
Last-Modified: Thu, 28 Jan 2021 22:44:40 GMT
Server: Flashtalking (AKA)
ETag: W/"c5d204e0114fe04b2a63b1a7d490bcf9"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
X-Varnish: 1026204878 1027736442
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 3153
Expires: Wed, 17 Mar 2021 21:53:43 GMT

GET
H/1.1 200
OK 3_Collect-e-signatures--with-3_Acrobat-DC._02.png
cdn.flashtalking.com/116327/3341835/ Frame EC5C 3 KB
3 KB 68ms
46ms Image
image/png 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flashtalking.com/116327/3341835/3_Collect-e-signatures--with-3_Acrobat-DC._02.png
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: 0c0538855201c28a681611fe4ccc74e127e756e1bd05c047f75f0406f4d602be

Request headers

Referer: https://cdn.flashtalking.com/116327/3341835/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:43 GMT
Last-Modified: Thu, 28 Jan 2021 22:44:40 GMT
Server: Flashtalking (AKA)
ETag: W/"3c76e1cbd98a5f4b3661fd7f9da4a550"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
X-Varnish: 327929322 328165195
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 3022
Expires: Wed, 17 Mar 2021 21:53:43 GMT

GET
H/1.1 200
OK WK3_acrobat-conversion-batch_banner_Gdrive_flat-gradient-BG.png
cdn.flashtalking.com/116327/3341835/ Frame EC5C 592 B
1 KB 49ms
43ms Image
image/png 23.59.71.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flashtalking.com/116327/3341835/WK3_acrobat-conversion-batch_banner_Gdrive_flat-gradient-BG.png
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.59.71.163 Munich, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: Flashtalking (AKA) /
Resource Hash: 2998a76a08fcea91aa9bdf58f192f52742d9ab549c4e55eaff7f85c2eea6b6ce

Request headers

Referer: https://cdn.flashtalking.com/116327/3341835/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:43 GMT
Last-Modified: Thu, 28 Jan 2021 22:44:40 GMT
Server: Flashtalking (AKA)
ETag: W/"38655e659e76d8b6ae6c07adb28f759b"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
X-Varnish: 46914528 47497700
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 592
Expires: Wed, 17 Mar 2021 21:53:43 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 41CC 0
23 B 41ms
40ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BjwbItXVSYNH7N_2Ax_APuNeJOAAAAAA4AeAEAg&bg=!ICOlI2fNAAbUo7L91KM7ACkAdvg8WtM6_7aMrXPSj0nZSnBSLk6FY8ndjhYjWj8_yEtabFq3tAVRMAIAAADEUgAAAG5oAQcKAMAkb4U7tQl0dxPjzWjrB27q8hyY2HL5JIII6LeGYKG42CQ7-CTefOnvtUzHwXw8ZO95rV5cwNO9tPNhDm_WfQd-sO5seAp85zvKxb_JQf3aJeEgxO7KlLGWUs3Y3YW-Kwlv89MIxLk583mE1rQxY9MENOprGnkVc3REq-2H4Bm2DuthVe5lhrR_XvUL0V4JBcivdmu-0-iGjiA0TlWf71Z7Z6ay1pB7J-EMP8Q5N060uQ0JmGygZIV5zo3BRbDk7VOZAokZHc_WOzxeEAnw2Rt2YgP_XKW8gZnYIQSzUOJtY6YAriz_y9Y0kb5XrPTY9XZiOXfsLYj0Xq_YD8S4yNal0s5_y7rIJsH4dolx4OHj9j8DRIDwCYKcUugNvVI_MlhaGtqBw6oAyac3LSfvCkR_OSwr8Qff1GK6Z3fVQsTXp3kaHJiDrGuKVrcAfs84KbstyC7gRmkgseaBZOjr76G1VPp5yntR5PT4tFcDadIAZo35S9-GLO8KO2YeG_60lAU3n5nkV-PdDMuA091tFzjjn_EeChptFVk1_Th_osS9Oa4F8AuedbKyr8YAp_xMTk70Bbe5dlgkyY99OhDj4ybH4ucZeZ_5E3a4KFIfSsWLGx37TSthue-_nCpvyj1MWlBl16qzQXubbDN-tkSn2mnC540thE9Lf5mNfHmCwNXxPmOGZoe2uW8JMVpdAC5QfvihcUzE-7H-nrdMFLPa-11NWEsbiReVmdVhzh9SlxQzr8-5f4j2lrdFqu9I90FkZzJGi7yVpYSMMRQONgk7flzRBDIYHCjprcrZaPfwERp9TB2ZvgXCgidwB5lZ1Xy5REqgPSl91s-zGY1S1EMUh3OkkzrOluhef5ypkmn2hrsxOME7oKsZUft22aoertSSgV3S6gMthguRaEKy-kZIo8wgu1QBBipygfRIMH0GsmKt4rbzAS6eRrcivfvqDm1gLv0Maq5uy7NnWqNb3MirbFoqw3xPflhDqyJlN2aEdbBQ8F6iud_aUrs60Jx8B2M7at7HzBO1mbD2GsUTta84yEJmOvWLFztV3Q4ssqZVvCn0eulp87B_d4YJrd3AlEQtKi7zLd594FEonDlmBQfC5WYbt-XTUOr9o6tf7Iis

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200 img.png
d9.flashtalking.com/img/ Frame 2B5C 70 B
332 B 48ms
48ms Image
image/png 34.251.104.84
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d9.flashtalking.com/img/img.png?cnx=ffe2574ea4148c942f536d4f0647c870
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.251.104.84 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-104-84.eu-west-1.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) OpenSSL/1.0.2k-fips /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 17 Mar 2021 21:33:42 GMT
Access-Control-Allow-Credentials: true
Server: Apache/2.4.41 (Amazon) OpenSSL/1.0.2k-fips
Connection: keep-alive
Content-Length: 70
Access-Control-Allow-Methods: GET,POST,SERVER
Content-Type: image/png

GET
H/1.1 200
OK /
servedby.flashtalking.com/state/4171841;3341835;0;401;E97D5CC5-F0DD-7E65-D420-74CAFC035653/ Frame 2B5C 42 B
539 B 24ms
24ms Image
image/gif 205.185.216.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servedby.flashtalking.com/state/4171841;3341835;0;401;E97D5CC5-F0DD-7E65-D420-74CAFC035653/?ft_data=d9:6d3c2a2a9bf14af0a2bc87128a85ac69;d9s:6d3c2a2a9bf14af0a2bc87128a85ac69&cachebuster=550179564
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.216.10 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: prod-xre-app10.frk11 /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: prod-xre-app10.frk11
X-HW: 1616016822.dop041.pa1.t,1616016822.cds219.pa1.shn,1616016822.dop041.pa1.t,1616016822.cds022.pa1.sc,1616016822.cds022.pa1.p
P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Cache-Control: no-cache, no-store
Connection: Keep-Alive
Content-Type: image/gif
Content-Length: 42
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
123 B 16ms
16ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
123 B 15ms
15ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
9 KB 196ms
196ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3971796041233386&correlator=4430728584751291&output=ldjh&impl=fifs&eid=21068031%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C420x330%7C310x340&ris=1&rcs=4&prev_scp=a%3D%257C6%257C%26iid14%3D1342929%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1342929%26eb_br%3Df09d4fef38161a27d028cff6eebf43aa%2C33dd523f8e4dda158f0aa99686dda7f2%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D6%26br2%3D300%26ezoic%3D1%26nmau%3D4%26mau%3D3%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C19%2C20%2C17%2C19%2C20%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D14%26reqt%3D1616016822938&eri=1&cookie=ID%3Dd24887b9dae7ce82%3AT%3D1616016820%3AS%3DALNI_MY23LV3q1DT-QweOlMk2xYhFG1Y4w&bc=31&abxe=1&lmt=1616016822&dt=1616016822946&dlt=1616016816533&idt=451&frm=20&biw=1600&bih=1200&oid=3&adxs=348&adys=962&adks=1838216046&ucis=l&ifi=21&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&ga_vid=973125957.1616016817&ga_sid=1616016817&ga_hid=865683303&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

1412aa6597653444c97790eb60de89f62d343a9a5c28798867b2686422ba40b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9494
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
servedby.flashtalking.com/state/4229316;2787248;0;401;21EC7720-0A50-546F-9FA1-5791BD6ADB83/ Frame 3FEC 42 B
538 B 26ms
26ms Image
image/gif 205.185.216.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servedby.flashtalking.com/state/4229316;2787248;0;401;21EC7720-0A50-546F-9FA1-5791BD6ADB83/?ft_data=d9:6d3c2a2a9bf14af0a2bc87128a85ac69;d9s:6d3c2a2a9bf14af0a2bc87128a85ac69&cachebuster=371548030
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.216.10 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: prod-xre-app6.frk11 /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: prod-xre-app6.frk11
X-HW: 1616016822.dop041.pa1.t,1616016822.cds219.pa1.shn,1616016822.dop041.pa1.t,1616016822.cds022.pa1.sc,1616016822.cds022.pa1.p
P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Cache-Control: no-cache, no-store
Connection: Keep-Alive
Content-Type: image/gif
Content-Length: 42
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
332 B 19ms
19ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MTUsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4eb150000dfbf36be5000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4HA9uiIC6zRyhWBZ3QmCHJewFWjuluLV%2BqoOp1JblTFzCUhTxBo9GIG%2BnhrJXc5mxHdmEkujK58cJSy2hZtkfHnPYPkthwnkNxMnaSsPo4TwAAkH35TTTqJJcNT4mgQPcgd5eqS%2F86m6Qg%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957582fe7dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:43 UTC

GET
H3-Q050 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2B5C 42 B
479 B 71ms
56ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssGgjbQpuG5eWAvA5_6m5-9HadOOTWAwVUN2Wz-hBa4-1zSTUPee4iYt95tj7FSDTuFMfTNDpITdj7wnyoWF1QSV8pNyvSrs7QaioV87TsXiEk0nbq7NZyi9anRZQ&sai=AMfl-YTqoglEfvfBNZutpehkyKm_U3DAfSoupSOGl39r38tkj3B00Yu-Y61wCrrIoXZcWQ5bnw2DQ8GFNccdFjsGdIfdvVLzCs1ipp0DvEwlkaiDuBcX59ZtQl0pbPzR&sig=Cg0ArKJSzHHGW6AiJXIKEAE&cid=CAASEuRoHcGIhjZjXONbzAywBA06UQ&id=osdim&mcvt=1003&p=1074,315,1164,1043&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20210317&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1981148090&rs=4&met=ce&la=0&cr=0&osd=1&vs=4&rst=1616016821739&dlt=99&rpt=398&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 container.html Show response
be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 6248 6 KB
3 KB 7ms
6ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e86479d6e54449d1085c2149e190a615c6bead407b20bacbcf5852b5d65f1fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reisekostenabrechnung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.reisekostenabrechnung.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2973
date: Wed, 17 Mar 2021 21:33:37 GMT
expires: Thu, 17 Mar 2022 21:33:37 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 6
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
282 B 38ms
36ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8zIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDI5MjkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMyIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6ImYwOWQ0ZmVmMzgxNjFhMjdkMDI4Y2ZmNmVlYmY0M2FhLDMzZGQ1MjNmOGU0ZGRhMTU4ZjBhYTk5Njg2ZGRhN2YyIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQyOTI5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzMiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MC4wMDAwNiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDA2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDAxNCwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8zIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgyNDExMjM1MTcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDI5MjkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMyIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiNDk3NDkwMjgzMiJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4eb800000dfbf86ac3000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=oEc1fMskMDdGfHr2JzElcP8WCzTKNPNmNpuYnSsK4JhwQv0A4O3lNEFgs2gBQdLjONRWDkMXOC3WgvpQW1ZlzvPSJl9a2m43fyevgGFFpfWH%2BQ2LwsYbZrfS1soyjHsd4Jm5VbfCBGBn6A%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 63195758c89fdfbf-FRA
expires: Tue, 16 Mar 2021 21:33:42 UTC

GET
H2 200 4974902832 Show response
g.ezoic.net/dac/ 0
40 B 26ms
24ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/4974902832
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/porpoiseant/banger.js?cb=192-2&bv=13&v=46&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 17 Mar 2021 21:33:43 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
357 B 23ms
22ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8zIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wMy0xNyJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIyIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjMifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTYwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4eb810000dfbf6e37e000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=tGM72M0LPrvwiimZ36egRcbUK4Yb0bamWu4iXWD35ZN7bEhQxifV0b3Wf027z5Xe9R7oMS1rf8ZEzxTW6zyIfrQuRUVaTbRsHicAGadWBAcLuY%2BGmHv7wuaX8ktdbPT8z1kWxPGW5ZgHDA%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 63195758c8a1dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:43 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
399 B 19ms
18ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8zIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYXVjdGlvbl9lcG9jaCI6MTYxNjAxNjgyMywiYWRfcG9zaXRpb24iOjExMDMsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJiaWRfZmxvb3JfaW5pdGlhbCI6ODAsImJpZF9mbG9vcl9wcmV2IjoxNCwiYmlkX2Zsb29yX2ZpbGxlZCI6NiwiYXVjdGlvbl9jb3VudCI6NSwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6MjEwLCJtdWx0aV9hZF91bml0IjozLCJtdWx0aV9hZF9jb3VudCI6NCwibmV0d29ya19jb2RlIjoyMTczMjExODkxNCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4eb810000dfbfa22d7000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=68xP8LlMtRZAnc1OX2npdEcUxsRB7pcDzgjSQaGNTRtqFh4B%2FODK8Sls%2BkLT19uVyn4cP7nndlhH%2FaTWVS79rpVBi1uDFS4yS4vVacCjI%2BEbr%2BWaprzsrgQuJWd6CHFyr5wei9k%2FLXKM5g%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 63195758c8a2dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:43 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
316 B 18ms
17ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQwODkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MTYwMTY4MTUsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwNTI3MSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4eb850000dfbfb68b1000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4QY%2FJLS9O0%2BlvM0I50Y9ncaCtAbL1YoryzKUQ8xykmlzF%2BjX1JywxU6in0yO0%2BFvGSGTFGP3%2B%2BVxZXPfkAKUPiASEXYp1M59AAna1S0qz0JeH0buyn7jJh74OJDw9D2lhqXVk%2BS7%2BCM6Zw%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 63195758d8acdfbf-FRA
expires: Tue, 16 Mar 2021 21:33:43 UTC

GET
H3-Q050 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 669E 660 B
325 B 36ms
36ms Document
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhjKicqeATAB&v=APEucNW-VYboarAD95RDHGRb_dlNk9n_IM2mYfF7_j6UWpCeOwIRO3FZmyeAaMTUEodIbaYw_HHsSDd3fcWqkL1q9gvp7KrhonG5CNjRnqFzdbTgn_1inP4Kj6N180G6kusf01rKZUs-WZUnoRnivKRi_KsdFKY223ypxPCMXyFBjchh8L6Hju6NO76LiwW-qcHIVRJfoX5cWts_jzo9qyOPAWhksvLQMMCuRu7OYEBg-9cempBCPxI

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

858feaa3c94465f06504749a0f581469156cc61f03b5c53d0124f6cb049b3ed7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CNyuyAIQpovKAhjKicqeATAB&v=APEucNW-VYboarAD95RDHGRb_dlNk9n_IM2mYfF7_j6UWpCeOwIRO3FZmyeAaMTUEodIbaYw_HHsSDd3fcWqkL1q9gvp7KrhonG5CNjRnqFzdbTgn_1inP4Kj6N180G6kusf01rKZUs-WZUnoRnivKRi_KsdFKY223ypxPCMXyFBjchh8L6Hju6NO76LiwW-qcHIVRJfoX5cWts_jzo9qyOPAWhksvLQMMCuRu7OYEBg-9cempBCPxI
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl-bXIGMJ45jSICbpEAsfl3M2XbQ3afWFCc2ep4Vcwse419QXHDrCN6dwpUmkM
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 17 Mar 2021 21:33:43 GMT
server: cafe
cache-control: private
content-length: 300
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6248 23 KB
11 KB 71ms
71ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CTORHJ1EQ-GrTHkoHgvFW_BIjZ55Y6oB38q7n3CTVXycoA2brfjYfzd2JGeF32cCLI6VU95gHzc4bSd2pzmRzGii9v_7sE4cgI1CwtzBcAVSE2jaFL-sssJmcuSwk8Lo7KCTYlSVBLEgBLK0QrA9UjLS6GgA&dbm_d=AKAmf-DMkOl6B7avui3W7Oob94gPM-b5cEZ8ULtmUNuMdq29UnO73dbKWr84qxJw3qJYlJi__UgRcTqmoEGYN-qOluDWex8xFLfFZqCwt3h5j6HwuwuJNbXmJWm6q0X-YAC-T5XC_2F3nQ9-cUQDnATi1bWT_yBIFM7bk7zXQSMY9LtnsnhMKm2ZfaX5BVYy-ahdoFbs0oLfhW_GWmdueFoNfYlIalzHCarfjds4DcglIs0_Pmo4NWlqgEn6Qz_ZcwlkJTMBchZ15finS-o3su1RwcXSsIF0LmO4k_yOCqnpkb8d5Aw2koJs4A3EZn1rixTmR7Ei7m0JdODU2JMDYp6adU-_rPkJ5uz_838sL3j_Tr7ubzsIiGRRWdRi1vc_EHmBy_dm_p2N5xq36G9NriLueHOliYigPklZBVIXU34durMVQAmQhTz3hbfxboKzElIg5EXCcofBYXjyh9pa3jnro7RbnApdg-_k7QzkaWjTPICsbyD4VMjbgH9s6E_IDzCvYCDiQZmrV-rrxddZrt6dD4cX2dnePWc0Jm9jrCGvYQ7n8l6CstFjNCt2xOu-n5T1gwgkHMpQZRtNrF7k3AIe01TCVYMIrOTOxJJJpwNIt63LPkQuAN6JwEj8VfshL20NIhX0TSnGwgtpbMfpTH6fBrksBLEL7zKoRHDyleNxi1t2CKuLno7ZMzMq3W1S1ZkphMeQanhEEd5aKbRMphQFSCtc9gi8WrTjDLinIOzlD9Dljj_6PlbIwh4os1LRrXWjkDzB0xNmF1_plTH9p12L_J5wvNx5wYMKSbj84xusnhqSUbQ25I8PVMJqgtDGnxeYGelaUCSImEbsGpjaEispUSrgLIQw2RjWQr_QzMaKRlAyss4k2pF-Yz6XaBGkwXW6kaoZUNMuoeh4tS3A8kRMkh-ZTEMi_wycJpq-bEGKNRmgiRjnYgpT-OlUfj2FhYzCNv4SEJKFshoeAvvSNjBaf3ygWKdT64ktddYVe-uwlhRy6B7r3tWbjuT2UI6WGE64hBYXr8-g7hwywwGtIiVh-fljiUlt16m4WN-KFSkteA08CosFw6QkBDceUEIIXZCq47lghFMEjPKryy5Af0uJ0rMdmf0c8KBek_8k4Tg59CDXMvBl736Om5cK00vRoF9jEs_in24PbNziMTnJjDRceJ9y0zvpUttoMG0AfysB7Uw1bLOAFv-PsqRpeI_-MAahnWylG1jEeTDjW_qBvp7Mn7-Rv8RT2gr1Dmn-AoFoHdxOXewkSrKiJ__WDlgRrmyw4Ykwlb4BdWkXYLh1sLw6vZiB2TdtWpoH1QtlLf0fSfIeHjpc3_YGp-gA0IidfRjNZfYpOqLVGteiqwLdpXstQtmGwFZAIIPm5kx0TgYXuARnuHFgGCMXX4AHMB5yNtmRQCmSWpil_Ot5yxu_YjV9DBqsC1n7Q3u2KI_TNKedO3ntJlyAIcOnIV4oIJKXhjmy5WC7lClsuLtauLH5g0egiil10nn877DIJ8OjTdryrl37QdMYt4Yw0tYNs_j18xJWbAm2ij-l--DwWic1EoCoVC-u5sEvjMMQAkkFKfwt0QUWIgowDahFtmjU_nHMDhGjcKtONpFMHPk743xx-MKKxmu51q6LBFTd-ste3PFZ4n_VUHecw6BmktxGfZrQr2E0o9ZVnQH-wdZ_dWL0kVREjpKBWcWkOc1RqGDnaMEFN5yzSJaJtpw-75tFTG6VWlMqa-fDHcuzQfDUswKT6-6_wvJ8YY1vrps7U7PJxIshpyd4rlTx4XmzQciL3LQfj0AFV-Hn-QZBJ4OW3vMxnGXLTZLfdwPjmhs4RdQNQmaXiGM5IddLOfPk4urLzeOz7KsmJRKXX9yYKVK9-8GuzJOgcUOwBLtX9fL-nH18RMberCjq3fvySJnpk_DNOBy2B4BOqzdwoeotCsfga0kca2eAwcTM7Zq_QUVIwjtKRSZ2FjjEdajzt-5LD5Cc9RNVMrt54uLwz1vnkDN86kKvbKyrpHJmrlX_bfc6ne5kt7kzAPT8ErVO_0XOx21W19MfFXNhqeGiz78087Nv7CLfXrLBGzUsE-uQCCPAHxVFAqCzEKA3AYWvuocs02GekU6CF8cieGUDU2NWSkAeT672kPE5BqTTC__qCj0er5MiV39NBFGqbwSy7IrqpMoWT6O5VVbYWOgcqm1u9thY3KbrehjKlKQHn15o7sAgC4KS65Ahp8MlHa51JrkoPdMsn0dWEnKhFuCCd2FTlaC-nEl69UiQeHbwOVJ2BrK2fEX9fPJdDk3SL0DyyaQrL19GIjaVPlxtPBGjSWmCb2ENMX_NBvwov0ugVnADpUwwTDryVwIhcA6jdwNzg9CvJlh8-aoG4uy6ZSiYTKS2UCuMaTFGb86y7otZD3ZsK80mX59bjTtunp4iTrji4pA-f4jD6V9YjE91sLXTwIEQERplKxqpH6XlMEaL-l79Bnvjit5aq95Olq-zyjaRz9zrfg4mxz2cWNz31EdqQqo8-zhtWva597wZ_CIcvKRU2OFWGnfpOonDoNy_pzjHssqZd85zT-FHgZZfbJ33E4hdMd5YjA1uAeKFbJXZvm3qnSn-rEVMB8KOTPtVxuk8B64enkwydaz8QElT7pjHoac0c-DBKzvd7ts0UrBtNfUTtOeJH-9hUZaX8GScFrin-7beA93e4A_jLnuAAl9KNfCwjkQHDJOHFRZprWSwxAgHFh-twmJ18cTQBxYTR7xQC4xO88HlT-5XEKdutj1waK4lIT2D2bkGF90Z71VxoxC7YighrvQyBgtUk4GC4EA_uvW55IWmOVSzkjYVm5eZku4g34KP1SAWX__mtE-QwFLyx_xyWKXicqKMP_VHlO7Onmske2hX0gIOo1rnqOtk0VQwZFNK0tuZ05Ad7fzwHPY6owsxVw6KpWFZd5mopTkzn2nxpR3icm1Zip-UBjSqUY0QR-zt3YLemCi78kQ2n01pH6FZrJuiKLCb-pyS6hIav4U1BmDosff80WOkA-w4Xj_bfkI4lILWFc31MeltopRI-I5iJaQJAmcSCDaGvTizMEC--mWYVFvxAs4ti4wd9_QCGF5ZCrK74S1c2XKnPB9QMiSQCVRrZgYFc3c0iwivz8v23MQB3cYtHmYMbFIKSikvQlEXJ5BnQ1bpPbSCrkziCxfkFlcPkYI-5V7oVF2_leVOZJ5hvMbgFfAlI1l5Ex2u2QLk6F9P_2etEwQUN1MGDWxwrdhfHwiZbQMijHTdpirrmSEQPxrmv5I0ghTI7LdW&cid=CAASEuRoZOTKP-XSJ0MaUM5pOM4H2A&rfl=1%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

146815967beef8f2507cdb6330e10040cdb2dd123048f4b4a8308c804e56c159

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11466
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6248 42 B
91 B 40ms
38ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Bdfa3eAYh3mAIowPYOZc857JadY_hJMviCc_Rdnel0XeKDVMqInt5ESFw61YOOM2RRTxdmdyFEC3XSWRigPTewwSB7tae93R7mEIL_dOCXegk6f48

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 clk Show response
ad.doubleclick.net/ddm/adj/N1246177.3716415IGNITIONONE/B25408918.296831033;gdpr=;gdpr_consent=;sz=300x250;click=https://googleads.g.doubleclick.net/dbm/ Frame 6248 39 KB
17 KB 110ms
53ms Script
text/javascript 142.250.74.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1246177.3716415IGNITIONONE/B25408918.296831033;gdpr=;gdpr_consent=;sz=300x250;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CsDvltnVSYIaxPMuNrAT1g6CgCpGMv9RhyeH1m_0M2tkeEAEgpczXamD7gYCAiAqgAeLd28sCyAEJqQKMAU63JPizPqgDAaoEigJP0FB0e6VYaCvKIBO-JDLVOs4xT-n_zVgURUFH71CTHWBk7zpYxJ9u0WDiwNlBQLmYxTtWtQ5UcLFxJw0QzuhnuDnufeLbsR8afJIe3T_ZWw1ar4Sw7px2gcKAuzWcsGg_KwM1-OrzVcTTsBTcNe3U96hglM1hH3qLQbWBZbw2e6uPF-BmeaM1UimhaeRReI1aS_hXigzhkJ5TOT76imtP3Ws6kPS_iOGwuWp1CAW873lepTi_aPE8sqF-Z1Hj9x9xmtIQhkP-ZrxwzcgexyfRhhVXi9E_M4SAH_iOiVALSsPNt7cik_B3eSy_bfZc4pTvF82XkcAdBoPT7Yxd_5YBQIMA54CFViYs_cAE-saBibYD4AQDkAYBoAZNgAeGoqS0AagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDQzNjcyNzA5Njk2NjU1OYAKA5gLAcgLAYAMAbAT-tvyCtATANgTA9gUAQ&ae=1&num=1&cid=CAASEuRoZOTKP-XSJ0MaUM5pOM4H2A&sig=AOD64_1aawL0WZcVeJDSmEoQO-q2gd8peQ&client=ca-pub-5902083285302779&dbm_c=AKAmf-C5NWot-E82mKZfvwp7w-Rn35Dc7t5DcH5HNtNNCvkWCtyXV46tYoDwsN1XS7EKr92a1o8zoSOW26-7EdZedAykhnKeygbYPDUNlQAOVUC5YSecTWsE0q6v9m9FGZEvmiTiK7ad4r5_jBwXtMikaEDXKRkHAw&dbm_d=AKAmf-BCLWIQYg-_7_r5uBfpI0UzwCr5hBXZdrXXd28ROgad2X-_Nfo_84wCdSlvuxYcSgbDvj0uaX_UvYG85hMJZ5DE981I8E1d5qL2PfxgP0O1yjTJPqX1un7tpR1q5GcA3hszTEI3gxYyKZy9NUyYIFFVTsBjqPLz10ThFfB3QGtM1OninoyDZxBJ6ekKzLtxzr1bM_Vf_46DpYhFp7Swkmov3kIVc101685OxyZlAD-aS4gz4TzqVM7pJAR-mQ7YrKRI030LmxpsXec7E6s473HtEzR638MG6TSXBGwef12jjGZeO_feieE5ULzOKQtuwpwhJMYn4pkYVuDxAqNqv7P9aeIikBjWqpaKJz9jMRv-pMvVi724Vt6CR-i0niACTJzxHFGzAzV7tfnASORh0PF9dqNEDl2XoewKf0CZjzMyDEs3hBqLdWGM-klG311KLTtIntX3MEs9GsC4rEv4aX11DzxMNw&adurl=;ord=1616016822989318;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f6.1e100.net

Software

cafe /

Resource Hash

0f4aed26045bbad87e590f94abfaeb8135b1081584c9283d2be2a28bf1c356df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17363
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 6248 2 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/window_focus_fy2019.js

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:31:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 157
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:31:06 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6248 117 KB
36 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

941c260356b6aa75782a27384179a63581c9e41b42155774982f36b0d84cde9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615980836519751"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36389
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:43 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 6248 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

570c04b30a5c8fa6ceaff96ea6d3a0dfabd85dee3edae40e38b0344a7278f254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5991
x-xss-protection: 0
server: cafe
etag: 8832118191516519848
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:45 GMT

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame 6248 0
0 15ms
14ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRHI-OvDOcvNP4FJanVcw3ilCuL1PWr8Xu9ps5Qsgnet4pcq3byEfSnY7QCl9CxKTPQr2rUNCilM6xRvhr4E3unBwuBWA
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
287 B 19ms
18ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8yIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDI5MjkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQyOTI5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiODMifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4eba20000dfbf7903a000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=L0uI%2Ft9%2Bncn6Jt8y1OtZm82cu3FQKKMQqIrdkWmb0N0ZNCIvuJq7lozRlmNIpAgPJBbgSq62xcF%2FWHkvmT7jJS4FaKyvUJbMRmeyrIAaPrdGRjun51oN8wIlJbwe%2BtFPFgxRGHutfN0x%2BA%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319575908e1dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:43 UTC

GET
H3-Q050 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3FEC 42 B
66 B 44ms
44ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstU89pDanBBJupk-NJrvqFxA7jdVEulIxlABw4rLQlvlMwchUKgjCcP03lbXuiWcN8sdDE0P8DtsPQOsKYpIobpzPxSYUNsYgoOP6TKu6v5_4PawsjbQi1IgBMyoA&sai=AMfl-YS681Uzg27T9bAJwzkaT4k1WxOmEFXsHRgvrckWUkxNPzx_Hl_MScMHn8BucX8LGB2eH1hVFtNLcCeIu9Ojzs6_rrP0cXorsEuO0kc87X8sf0QsKTZ0WVAT9-1F&sig=Cg0ArKJSzHU-XkGV26X3EAE&cid=CAASEuRozjSN79n9dIGzGp2Jn8JycQ&id=osdim&mcvt=1003&p=140,348,390,648&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20210317&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2284364264&rs=4&met=ce&la=0&cr=0&osd=1&vs=4&rst=1616016821796&dlt=72&rpt=66&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 669E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBtUYYUjEF6qEWMDERCK1bw&google_cver=1
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEBtUYYUjEF6qEWMDERCK1bw&google_cver=1

43 B
180 B

22ms
21ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEBtUYYUjEF6qEWMDERCK1bw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhjKicqeATAB&v=APEucNW-VYboarAD95RDHGRb_dlNk9n_IM2mYfF7_j6UWpCeOwIRO3FZmyeAaMTUEodIbaYw_HHsSDd3fcWqkL1q9gvp7KrhonG5CNjRnqFzdbTgn_1inP4Kj6N180G6kusf01rKZUs-WZUnoRnivKRi_KsdFKY223ypxPCMXyFBjchh8L6Hju6NO76LiwW-qcHIVRJfoX5cWts_jzo9qyOPAWhksvLQMMCuRu7OYEBg-9cempBCPxI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.203.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
via: 1.1 google
server: OXGW/16.203.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEBtUYYUjEF6qEWMDERCK1bw&google_cver=1
date: Wed, 17 Mar 2021 21:33:43 GMT
via: 1.1 google
server: OXGW/16.203.0
alt-svc: clear
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 669E
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTc1Yjc5NmEtYjdiNS0yYWJjLWM1OTgtZDgyNGYxODM4OTFj

170 B
190 B

33ms
33ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTc1Yjc5NmEtYjdiNS0yYWJjLWM1OTgtZDgyNGYxODM4OTFj

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhjKicqeATAB&v=APEucNW-VYboarAD95RDHGRb_dlNk9n_IM2mYfF7_j6UWpCeOwIRO3FZmyeAaMTUEodIbaYw_HHsSDd3fcWqkL1q9gvp7KrhonG5CNjRnqFzdbTgn_1inP4Kj6N180G6kusf01rKZUs-WZUnoRnivKRi_KsdFKY223ypxPCMXyFBjchh8L6Hju6NO76LiwW-qcHIVRJfoX5cWts_jzo9qyOPAWhksvLQMMCuRu7OYEBg-9cempBCPxI

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: gzip
server: OXGW/16.203.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTc1Yjc5NmEtYjdiNS0yYWJjLWM1OTgtZDgyNGYxODM4OTFj
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame 669E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_sc&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEAOwzymzzIb88OkdPwAGLIU&google_cver=1

23 B
172 B

95ms
67ms

Image
image/gif

104.109.66.25
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEAOwzymzzIb88OkdPwAGLIU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhjKicqeATAB&v=APEucNW-VYboarAD95RDHGRb_dlNk9n_IM2mYfF7_j6UWpCeOwIRO3FZmyeAaMTUEodIbaYw_HHsSDd3fcWqkL1q9gvp7KrhonG5CNjRnqFzdbTgn_1inP4Kj6N180G6kusf01rKZUs-WZUnoRnivKRi_KsdFKY223ypxPCMXyFBjchh8L6Hju6NO76LiwW-qcHIVRJfoX5cWts_jzo9qyOPAWhksvLQMMCuRu7OYEBg-9cempBCPxI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.66.25 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-109-66-25.deploy.static.akamaitechnologies.com
Software: akka-http/10.1.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
cache-control: max-age=0, no-cache, no-store
expires: Wed, 17 Mar 2021 21:33:43 GMT
server: akka-http/10.1.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEAOwzymzzIb88OkdPwAGLIU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 669E
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YzhjNjVhZWMtMGM2YS00MDNiLWI0NjEtOTBkN2Y0MzlmODg4

170 B
190 B

33ms
33ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YzhjNjVhZWMtMGM2YS00MDNiLWI0NjEtOTBkN2Y0MzlmODg4

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
server: akka-http/10.1.9
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YzhjNjVhZWMtMGM2YS00MDNiLWI0NjEtOTBkN2Y0MzlmODg4
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Wed, 17 Mar 2021 21:33:43 GMT

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
372 B 24ms
24ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQwODkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwNTI3MSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzk3MCw5MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE0MDg5MjkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDUyNzEsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQwODkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwNTI3MSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4ebca0000dfbfa695b000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=QsQRpFGSDWWtvZoHYjHff%2FJFSPH8TaImV7WPueNYFZlpaBOoMhcd4FRdBmN80avk%2BSrhpN%2FnE6Bv8RYQrEi%2B2LFVHsjPrRfY7k%2FoO73w2LfqeNKcz0pVoIg8M6SmVNtXYwJgLzbi0fG1jQ%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957594923dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:42 UTC

GET
H3-Q050 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/ Frame 6248 21 KB
8 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CTORHJ1EQ-GrTHkoHgvFW_BIjZ55Y6oB38q7n3CTVXycoA2brfjYfzd2JGeF32cCLI6VU95gHzc4bSd2pzmRzGii9v_7sE4cgI1CwtzBcAVSE2jaFL-sssJmcuSwk8Lo7KCTYlSVBLEgBLK0QrA9UjLS6GgA&dbm_d=AKAmf-DMkOl6B7avui3W7Oob94gPM-b5cEZ8ULtmUNuMdq29UnO73dbKWr84qxJw3qJYlJi__UgRcTqmoEGYN-qOluDWex8xFLfFZqCwt3h5j6HwuwuJNbXmJWm6q0X-YAC-T5XC_2F3nQ9-cUQDnATi1bWT_yBIFM7bk7zXQSMY9LtnsnhMKm2ZfaX5BVYy-ahdoFbs0oLfhW_GWmdueFoNfYlIalzHCarfjds4DcglIs0_Pmo4NWlqgEn6Qz_ZcwlkJTMBchZ15finS-o3su1RwcXSsIF0LmO4k_yOCqnpkb8d5Aw2koJs4A3EZn1rixTmR7Ei7m0JdODU2JMDYp6adU-_rPkJ5uz_838sL3j_Tr7ubzsIiGRRWdRi1vc_EHmBy_dm_p2N5xq36G9NriLueHOliYigPklZBVIXU34durMVQAmQhTz3hbfxboKzElIg5EXCcofBYXjyh9pa3jnro7RbnApdg-_k7QzkaWjTPICsbyD4VMjbgH9s6E_IDzCvYCDiQZmrV-rrxddZrt6dD4cX2dnePWc0Jm9jrCGvYQ7n8l6CstFjNCt2xOu-n5T1gwgkHMpQZRtNrF7k3AIe01TCVYMIrOTOxJJJpwNIt63LPkQuAN6JwEj8VfshL20NIhX0TSnGwgtpbMfpTH6fBrksBLEL7zKoRHDyleNxi1t2CKuLno7ZMzMq3W1S1ZkphMeQanhEEd5aKbRMphQFSCtc9gi8WrTjDLinIOzlD9Dljj_6PlbIwh4os1LRrXWjkDzB0xNmF1_plTH9p12L_J5wvNx5wYMKSbj84xusnhqSUbQ25I8PVMJqgtDGnxeYGelaUCSImEbsGpjaEispUSrgLIQw2RjWQr_QzMaKRlAyss4k2pF-Yz6XaBGkwXW6kaoZUNMuoeh4tS3A8kRMkh-ZTEMi_wycJpq-bEGKNRmgiRjnYgpT-OlUfj2FhYzCNv4SEJKFshoeAvvSNjBaf3ygWKdT64ktddYVe-uwlhRy6B7r3tWbjuT2UI6WGE64hBYXr8-g7hwywwGtIiVh-fljiUlt16m4WN-KFSkteA08CosFw6QkBDceUEIIXZCq47lghFMEjPKryy5Af0uJ0rMdmf0c8KBek_8k4Tg59CDXMvBl736Om5cK00vRoF9jEs_in24PbNziMTnJjDRceJ9y0zvpUttoMG0AfysB7Uw1bLOAFv-PsqRpeI_-MAahnWylG1jEeTDjW_qBvp7Mn7-Rv8RT2gr1Dmn-AoFoHdxOXewkSrKiJ__WDlgRrmyw4Ykwlb4BdWkXYLh1sLw6vZiB2TdtWpoH1QtlLf0fSfIeHjpc3_YGp-gA0IidfRjNZfYpOqLVGteiqwLdpXstQtmGwFZAIIPm5kx0TgYXuARnuHFgGCMXX4AHMB5yNtmRQCmSWpil_Ot5yxu_YjV9DBqsC1n7Q3u2KI_TNKedO3ntJlyAIcOnIV4oIJKXhjmy5WC7lClsuLtauLH5g0egiil10nn877DIJ8OjTdryrl37QdMYt4Yw0tYNs_j18xJWbAm2ij-l--DwWic1EoCoVC-u5sEvjMMQAkkFKfwt0QUWIgowDahFtmjU_nHMDhGjcKtONpFMHPk743xx-MKKxmu51q6LBFTd-ste3PFZ4n_VUHecw6BmktxGfZrQr2E0o9ZVnQH-wdZ_dWL0kVREjpKBWcWkOc1RqGDnaMEFN5yzSJaJtpw-75tFTG6VWlMqa-fDHcuzQfDUswKT6-6_wvJ8YY1vrps7U7PJxIshpyd4rlTx4XmzQciL3LQfj0AFV-Hn-QZBJ4OW3vMxnGXLTZLfdwPjmhs4RdQNQmaXiGM5IddLOfPk4urLzeOz7KsmJRKXX9yYKVK9-8GuzJOgcUOwBLtX9fL-nH18RMberCjq3fvySJnpk_DNOBy2B4BOqzdwoeotCsfga0kca2eAwcTM7Zq_QUVIwjtKRSZ2FjjEdajzt-5LD5Cc9RNVMrt54uLwz1vnkDN86kKvbKyrpHJmrlX_bfc6ne5kt7kzAPT8ErVO_0XOx21W19MfFXNhqeGiz78087Nv7CLfXrLBGzUsE-uQCCPAHxVFAqCzEKA3AYWvuocs02GekU6CF8cieGUDU2NWSkAeT672kPE5BqTTC__qCj0er5MiV39NBFGqbwSy7IrqpMoWT6O5VVbYWOgcqm1u9thY3KbrehjKlKQHn15o7sAgC4KS65Ahp8MlHa51JrkoPdMsn0dWEnKhFuCCd2FTlaC-nEl69UiQeHbwOVJ2BrK2fEX9fPJdDk3SL0DyyaQrL19GIjaVPlxtPBGjSWmCb2ENMX_NBvwov0ugVnADpUwwTDryVwIhcA6jdwNzg9CvJlh8-aoG4uy6ZSiYTKS2UCuMaTFGb86y7otZD3ZsK80mX59bjTtunp4iTrji4pA-f4jD6V9YjE91sLXTwIEQERplKxqpH6XlMEaL-l79Bnvjit5aq95Olq-zyjaRz9zrfg4mxz2cWNz31EdqQqo8-zhtWva597wZ_CIcvKRU2OFWGnfpOonDoNy_pzjHssqZd85zT-FHgZZfbJ33E4hdMd5YjA1uAeKFbJXZvm3qnSn-rEVMB8KOTPtVxuk8B64enkwydaz8QElT7pjHoac0c-DBKzvd7ts0UrBtNfUTtOeJH-9hUZaX8GScFrin-7beA93e4A_jLnuAAl9KNfCwjkQHDJOHFRZprWSwxAgHFh-twmJ18cTQBxYTR7xQC4xO88HlT-5XEKdutj1waK4lIT2D2bkGF90Z71VxoxC7YighrvQyBgtUk4GC4EA_uvW55IWmOVSzkjYVm5eZku4g34KP1SAWX__mtE-QwFLyx_xyWKXicqKMP_VHlO7Onmske2hX0gIOo1rnqOtk0VQwZFNK0tuZ05Ad7fzwHPY6owsxVw6KpWFZd5mopTkzn2nxpR3icm1Zip-UBjSqUY0QR-zt3YLemCi78kQ2n01pH6FZrJuiKLCb-pyS6hIav4U1BmDosff80WOkA-w4Xj_bfkI4lILWFc31MeltopRI-I5iJaQJAmcSCDaGvTizMEC--mWYVFvxAs4ti4wd9_QCGF5ZCrK74S1c2XKnPB9QMiSQCVRrZgYFc3c0iwivz8v23MQB3cYtHmYMbFIKSikvQlEXJ5BnQ1bpPbSCrkziCxfkFlcPkYI-5V7oVF2_leVOZJ5hvMbgFfAlI1l5Ex2u2QLk6F9P_2etEwQUN1MGDWxwrdhfHwiZbQMijHTdpirrmSEQPxrmv5I0ghTI7LdW&cid=CAASEuRoZOTKP-XSJ0MaUM5pOM4H2A&rfl=1%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

70d82c6075989e0082b4917c6685f5f6bec1e673d0a80160eac61b3f1cdcb1a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8471
x-xss-protection: 0
server: cafe
etag: 753583566593306265
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:49 GMT

GET
H3-Q050 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6248 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 17:30:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187369
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Mar 2022 17:30:54 GMT

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 01F3 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Mar 2021 17:55:06 GMT
expires: Tue, 15 Mar 2022 17:55:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 185917
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js Show response
pagead2.googlesyndication.com/bg/ Frame 01F3 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25c788c3d6b5a5f5931ef45abc5640af29b16f379c2e1634dc32c6c225327f38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 16:25:17 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 104906
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5657
x-xss-protection: 0
expires: Wed, 16 Mar 2022 16:25:17 GMT

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
312 B 22ms
22ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzMwMCwyNTBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQyOTI5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDI5MjkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiODMifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4ec0e0000dfbfbebc4000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=0DHppUedM8K4NT0p0ljZWZY3bUybuSJfThvPFn%2BHjHqhQ5KF%2BJZjNZTK0q7BnJeh8NcPLyp4ZeG8bYJAC8DrUQ74GD4xYyJuVVPpjvhcH0I0CcBs3K%2Btz0f8sEZlmIAtcLqM8sOE3qs%2F%2Fw%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 63195759a9a0dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:42 UTC

GET
H3-Q050 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 6248 111 KB
39 KB 33ms
20ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 13:10:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30210
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:10:13 GMT

GET
H3-Q050 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/elements/html/ Frame 6248 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1246177.3716415IGNITIONONE/B25408918.296831033;gdpr=;gdpr_consent=;sz=300x250;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CsDvltnVSYIaxPMuNrAT1g6CgCpGMv9RhyeH1m_0M2tkeEAEgpczXamD7gYCAiAqgAeLd28sCyAEJqQKMAU63JPizPqgDAaoEigJP0FB0e6VYaCvKIBO-JDLVOs4xT-n_zVgURUFH71CTHWBk7zpYxJ9u0WDiwNlBQLmYxTtWtQ5UcLFxJw0QzuhnuDnufeLbsR8afJIe3T_ZWw1ar4Sw7px2gcKAuzWcsGg_KwM1-OrzVcTTsBTcNe3U96hglM1hH3qLQbWBZbw2e6uPF-BmeaM1UimhaeRReI1aS_hXigzhkJ5TOT76imtP3Ws6kPS_iOGwuWp1CAW873lepTi_aPE8sqF-Z1Hj9x9xmtIQhkP-ZrxwzcgexyfRhhVXi9E_M4SAH_iOiVALSsPNt7cik_B3eSy_bfZc4pTvF82XkcAdBoPT7Yxd_5YBQIMA54CFViYs_cAE-saBibYD4AQDkAYBoAZNgAeGoqS0AagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDQzNjcyNzA5Njk2NjU1OYAKA5gLAcgLAYAMAbAT-tvyCtATANgTA9gUAQ&ae=1&num=1&cid=CAASEuRoZOTKP-XSJ0MaUM5pOM4H2A&sig=AOD64_1aawL0WZcVeJDSmEoQO-q2gd8peQ&client=ca-pub-5902083285302779&dbm_c=AKAmf-C5NWot-E82mKZfvwp7w-Rn35Dc7t5DcH5HNtNNCvkWCtyXV46tYoDwsN1XS7EKr92a1o8zoSOW26-7EdZedAykhnKeygbYPDUNlQAOVUC5YSecTWsE0q6v9m9FGZEvmiTiK7ad4r5_jBwXtMikaEDXKRkHAw&dbm_d=AKAmf-BCLWIQYg-_7_r5uBfpI0UzwCr5hBXZdrXXd28ROgad2X-_Nfo_84wCdSlvuxYcSgbDvj0uaX_UvYG85hMJZ5DE981I8E1d5qL2PfxgP0O1yjTJPqX1un7tpR1q5GcA3hszTEI3gxYyKZy9NUyYIFFVTsBjqPLz10ThFfB3QGtM1OninoyDZxBJ6ekKzLtxzr1bM_Vf_46DpYhFp7Swkmov3kIVc101685OxyZlAD-aS4gz4TzqVM7pJAR-mQ7YrKRI030LmxpsXec7E6s473HtEzR638MG6TSXBGwef12jjGZeO_feieE5ULzOKQtuwpwhJMYn4pkYVuDxAqNqv7P9aeIikBjWqpaKJz9jMRv-pMvVi724Vt6CR-i0niACTJzxHFGzAzV7tfnASORh0PF9dqNEDl2XoewKf0CZjzMyDEs3hBqLdWGM-klG311KLTtIntX3MEs9GsC4rEv4aX11DzxMNw&adurl=;ord=1616016822989318;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:28:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 322
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:28:21 GMT

GET
H3-Q050 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6248 41 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 17:30:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187369
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Mar 2022 17:30:54 GMT

GET
H3-Q050 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 962D 1 KB
755 B 6ms
6ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 17 Mar 2021 03:14:09 GMT
expires: Thu, 18 Mar 2021 03:14:09 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 65974
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 6248 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 099e70d4b931c8545f4cb8f559abe42da76a28831152d7632c4f0df087e0b203

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
329 B 23ms
22ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8xIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDI5MjkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQyOTI5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzEiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiODQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4ec3f0000dfbf9c3b6000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=EfAD8wijgpDUvqTulCtwNYow5TjJeTrd53VO4CNy%2BJPLPFfaFJEausrAhAL737a2lsxB5IMQbtZcpUe3sMAbNbB7W30UdNflo45eagfopei%2BlaLq1z1PJPSSLALOAoHXcrCN5xZ%2F7mPB4g%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 63195759fa1edfbf-FRA
expires: Tue, 16 Mar 2021 21:33:43 UTC

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame EA27 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Mar 2021 17:55:06 GMT
expires: Tue, 15 Mar 2022 17:55:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 185917
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 index.html Show response
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 28A1 4 KB
2 KB 7ms
6ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f37e108a103ae6d6ed4ca9047d415434b8a1edefa81ddb7d4314ecb21587010

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 1491
date: Wed, 17 Mar 2021 16:35:33 GMT
expires: Thu, 18 Mar 2021 16:35:33 GMT
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 17890
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-Q050 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6248 0
50 B 59ms
59ms Other
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvI71T2GET3LZemXhyxqFQzdvcKGYTkN5eU1gIGwQPKXMP_9R7i7-ZAjiVVg6Ww-WWExql97oaAty-3_BGDOFuIxVkTGlezUW3CQvjerr142Zyzg0zYvoDxSEjCXCLWvcjCDywcPg8FMA83dyS8CR_hPnJ23P7rMuMvw6xbVAkV-a7KclZ2mclgZ9DI4cL_mQssm6bopFgqDcgiww&sig=Cg0ArKJSzCChAO8SAPbXEAE&urlfix=1&omid=0&rm=1&ctpt=88&cbvp=1&cstd=85&cisv=r20210316.76197&adurl=

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:43 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 962D
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1&google_push=AQvitUKcFE8GiIdPElLGhf3PnFJ2qMrO4aG6zv98mKlxYKLnO2bOYNhnVQl54jDTMsaaIzq6ycxYHrehK6lOyPvPMNuYgNecpt8P
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzQ5Njk5OTg3MjY4MzA1OTMyNw==
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1

43 B
407 B

27ms
26ms

Image
image/gif

46.228.164.11
TURN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1
Requested by: Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.228.164.11 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEHgHcfgmu0JS24z7gE6LAc0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 962D
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEGrbieRq_6tOzV0mUDDvWHk&google_cver=1&google_push=AQvitULh3pO3e2c7GWJKsHXQ9bemM4Pj9odwvbUE3n28e_yFsVPtLQLOFf...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AQvitULh3pO3e2c7GWJKsHXQ9bemM4Pj9odwvbUE3n28e_yFsVPtLQLOFfm1H5hbQPItGtddwgu8D_pJjtlATZS3XvFLjaCiOlU&google_hm=D6K3-ip...

170 B
190 B

34ms
33ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AQvitULh3pO3e2c7GWJKsHXQ9bemM4Pj9odwvbUE3n28e_yFsVPtLQLOFfm1H5hbQPItGtddwgu8D_pJjtlATZS3XvFLjaCiOlU&google_hm=D6K3-ipeowN5PqE5rDQ-gA

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AQvitULh3pO3e2c7GWJKsHXQ9bemM4Pj9odwvbUE3n28e_yFsVPtLQLOFfm1H5hbQPItGtddwgu8D_pJjtlATZS3XvFLjaCiOlU&google_hm=D6K3-ipeowN5PqE5rDQ-gA
pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 962D
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitULN1ERVspYVQyldMZZgGmtF0Jn1G8LZrHNTCwLpxYV...

170 B
190 B

35ms
34ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitULN1ERVspYVQyldMZZgGmtF0Jn1G8LZrHNTCwLpxYVzMVC5TkRfbVWPcqXZb_1yo5ap-KvtpWZ5qVBYIyP5o0s5DP_gApzR

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:42 GMT
Server: PingMatch/v2.0.30-619-g1028223#rel-ec2-master i-0047f8acf6307f30d@eu-central-1a@dxedge-app-eu-central-1-prod-asg
P3P: policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=clgzeVVpMGExTG1ETnM1&google_gid=CAESEAW2eNI3OIK3jKew8S92LOg&google_cver=1&google_push=AQvitULN1ERVspYVQyldMZZgGmtF0Jn1G8LZrHNTCwLpxYVzMVC5TkRfbVWPcqXZb_1yo5ap-KvtpWZ5qVBYIyP5o0s5DP_gApzR
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 962D
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEDeuKqu6wPNHWf8gYwfMw80&google_cver=1&google_push=AQvitUIBElLN4tTcykedrwVPQ52AV-i5aC6uGhT9_u8a8NU6QblvPfcfFLSGSuwXyi8ISmA4kYocQoOjnPX...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUIBElLN4tTcykedrwVPQ52AV-i5aC6uGhT9_u8a8NU6QblvPfcfFLSGSuwXyi8ISmA4kYocQoOjnPX4nkY9LEi5BblJgfyB&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw

170 B
190 B

34ms
34ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUIBElLN4tTcykedrwVPQ52AV-i5aC6uGhT9_u8a8NU6QblvPfcfFLSGSuwXyi8ISmA4kYocQoOjnPX4nkY9LEi5BblJgfyB&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:42 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUIBElLN4tTcykedrwVPQ52AV-i5aC6uGhT9_u8a8NU6QblvPfcfFLSGSuwXyi8ISmA4kYocQoOjnPX4nkY9LEi5BblJgfyB&google_hm=6FzS7ZGrTymAgXrW8ew_Pbw
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: clear
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 962D
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGyTJw_NwO-27VhLNDQC5kI&google_cver=1&google_push=AQvitUJQNONfHzZQYLGgZ0OnDq8V66h155Zv4HEpbAHWNWZ75rvHvGU2W5SgIzZ1N2GcKfxZc_KT6ZlA...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDc4MTM5NTg4NzM0Njg3ODc5NA&google_push=AQvitUJQNONfHzZQYLGgZ0OnDq8V66h155Zv4HEpbAHWNWZ75rvHvGU2W5SgIzZ1N2GcKfxZc_KT6Z...

170 B
190 B

34ms
33ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDc4MTM5NTg4NzM0Njg3ODc5NA&google_push=AQvitUJQNONfHzZQYLGgZ0OnDq8V66h155Zv4HEpbAHWNWZ75rvHvGU2W5SgIzZ1N2GcKfxZc_KT6ZlA9fzkVzxjrn69kGrDQeSq

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDc4MTM5NTg4NzM0Njg3ODc5NA&google_push=AQvitUJQNONfHzZQYLGgZ0OnDq8V66h155Zv4HEpbAHWNWZ75rvHvGU2W5SgIzZ1N2GcKfxZc_KT6ZlA9fzkVzxjrn69kGrDQeSq
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
expires: -1

GET
H3-Q050 204 attr
cm.g.doubleclick.net/pixel/ Frame 962D 0
16 B 33ms
31ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KDv5ILWtiAoUY_EjAgt8mOe7FRM2HWMo6BWx7fTBfsgZziP7F8UDkvBOs

Requested by

Host: be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
URL: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-Q050 200 style.css
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 28A1 1 KB
547 B 8ms
6ms Stylesheet
text/css 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84c65cf6dccd23cbcc0603f73e434c41a4086431756078e8bd2c7a1ff182066f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 17890
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 511
x-xss-protection: 0
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 main.js Show response
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 28A1 1 KB
645 B 8ms
7ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4e3441f0da47965d475c902c09d9c269054457d568226269c23335e0d43d766

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 08:41:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46331
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 563
x-xss-protection: 0
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 18 Mar 2021 08:41:32 GMT

GET
H3-Q050 200 tweenmax_1.19.1_92cf05aba6ca4ea5cbc62b5a7cb924e3_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 28A1 110 KB
37 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_1.19.1_92cf05aba6ca4ea5cbc62b5a7cb924e3_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62b1cff44a5e34b9587ad49f7ca951160f1559c5c545bcf99e13574ccaa5425a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37930
x-xss-protection: 0
last-modified: Tue, 20 Jun 2017 21:14:35 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Mar 2021 21:33:43 GMT

GET
H3-Q050 200 back3.jpg
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 28A1 32 KB
33 KB 9ms
8ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/back3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

24fafa96014bb69b2d14236c4982326ae80293f8d04891dd080dd094084f8320

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17890
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33176
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 text4.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 28A1 1 KB
1 KB 7ms
6ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/text4.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

498e1816875171bad3e7bee172b561231eb2f8aa004e9b872fd5b651f5f84062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17890
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1050
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 text4b.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 28A1 3 KB
3 KB 20ms
20ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/text4b.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

01b91c27c2dd8d42bf4832466bfb4d3f0ab2eff59e855e4ad8446dc626637cc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17890
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3216
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 cta.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 28A1 1 KB
1 KB 37ms
35ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e25fa1dc383dab10261f885d1c39a604525d2cd2ea6ca908e2c2375c07e3884d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 22:45:59 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 82064
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1239
x-xss-protection: 0
expires: Wed, 17 Mar 2021 22:45:59 GMT

GET
H3-Q050 200 nissan_black.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 28A1 1 KB
1 KB 36ms
34ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/nissan_black.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

39e4c6e25be371a3026dc5ea8ae0e23e953d6916518811fcc5c1a1769767ab16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17890
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1420
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 back2.jpg
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 28A1 33 KB
33 KB 31ms
29ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/back2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91b4244ebe9f1ca90ed84b8b5c9fe2f340e35d55df94c668b89f824d57e9010c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 08:19:39 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 47644
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33890
x-xss-protection: 0
expires: Thu, 18 Mar 2021 08:19:39 GMT

GET
H3-Q050 200 text2.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 28A1 1 KB
1 KB 35ms
33ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/text2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4139b3e7ead7268f5e730fb9b32300273ce262da28ed4bdff16508d8d6d7314

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 19:35:11 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 7112
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1354
x-xss-protection: 0
expires: Thu, 18 Mar 2021 19:35:11 GMT

GET
H3-Q050 200 text2b.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 28A1 3 KB
3 KB 35ms
34ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/text2b.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd8cc56d4953209cb0bd10a1198b3726b03857abfe648c987b6dbd4e0f63513a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17890
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2791
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 back1.jpg
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 28A1 34 KB
34 KB 30ms
28ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/back1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a25f4e403cd3009578cf6ca056afac33ed6aae8f47d1ab575756804b52be203a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17890
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35261
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 text1.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 28A1 1 KB
1 KB 30ms
29ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/text1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9d9f49fc378d4322355f7fdf35e213afc7f835ab2542b772a4e25802a5ac5cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17890
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1337
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 logo.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 28A1 5 KB
5 KB 29ms
28ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd5a91913a74d6a43b060f616dd109816717a7cfafa30f62e08890e3986758a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:07 GMT
server: sffe
age: 17890
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4973
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js Show response
pagead2.googlesyndication.com/bg/ Frame EA27 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25c788c3d6b5a5f5931ef45abc5640af29b16f379c2e1634dc32c6c225327f38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 16:25:17 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 104906
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5657
x-xss-protection: 0
expires: Wed, 16 Mar 2022 16:25:17 GMT

POST
H3-Q050 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6248 0
27 B 59ms
59ms Other
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:43 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 01F3 0
23 B 41ms
41ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BBTsXt3VSYMG-DP2Ax_APuNeJOAAAAAA4AeAEAg&bg=!bW6lbirNAAbUo7L91KM7ACkAdvg8WqU3ww2EwavJRyI-xKST6lZOzDsDGZAouMzlD7_UJQZXkOlo6QIAAADGUgAAADRoAQcKAGskxlzz5XTZVdbvsbKNbVvDF11rN3LkzETBCagx8Jh0ngNs7xufDzmzBDfvU9vS0rkdnoOTC8bpzieZUvq5YcSA3dDEMdcUboZnWnEQNnLOeUrFRxfkSmP8R5LbPxqCRYCuuWMnmWrgeyKCLJkCeYh-QqmW3Cw1xKk-f890F44t4YFNHB2PaV95sxJzOWmpj71fAloZlf5OXzec7Mxpitkvn4HbrsAROnvyaNSPjdj8A_Q5R80sBnS_7NA1B7FLIKF616FqEtgY4NjO9R8aFNhxnX0P_kywlC8H9M5E5khGSY54ZcCRSD7eVSjVBpLxpc2Prrn7olmOyugew217NkMkrQNaOuA8m-7M8rd-SDLxbZG6WJGWtU717fHJRokNlGEd-xMN3E3gE5fNxsdfGJsqBljSUS-gBacJmsE1wco9cxxk_t2j3nkfvEPbGWONp7RskyL2rTyRYztpO_vO7JFgwQpWAesLcGXXpjUXruZgMP9CLUP1-3cm-B3NQlfmScvYXeBUjpiwh3SOJMy6rAlCmF0EbfLDokjuDsQ8wxG6RwpJTzARRhECBgMMBPd9TaxFoP9bfeKeGo9QVHjak2as9-yBIuj0Cj9DZVP_ydrZRWad2dNdkSnE50EaxZLS7zjNJCxJ4UCQfM75cyRVhavWwVIrsraq6w-fSvqRR-2-qNJScunaSY4wvKQyxRQm1ZnXrvJD-p9VsGKV_c48l-YKQtSGb29iYQwmOQ1Fs56bpM1apueZFY7LwDsCjspZjiIKVAs7sWaAK4X4AZWfAVOeAKFSN0WbghQAIRehq2O5uDvMajUKTeoHNZOl1TScrkmuuKUyYk5B1bFwmx7yKUZvN3eqoI0-gCedTEfIA85BnNswRai4mX6Jn14ohY2CtRQtOgQNPTA9RCtMfQFPXcNv9bpQLcttkGUhE_lEeOM_Lbp61zyppKzVNfdk3CFXIwg6fQ_pPvzURpe1OH4C9wE8-lAgO2yr2w

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EA27 0
23 B 39ms
39ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BaiyEt3VSYKDOD4O_3gPElLDIBAAAAAA4AeAEAg&bg=!7u2l7anNAAbUo7L91KM7ACkAdvg8WujtJisQhoAJyIxNFCoxUkC5filOAV7cq7JC9YbHbvrMoGm7eAIAAAC0UgAAAAtoAQeZAoeYYuXLrbmG5mLZ0Y5n0LggFDnxR-pD5bh37Kt7GKd509NNHn65BQmzxQ8qYcZ65XuLjoo2W53xSRznBcdQog5LPdfNGWDlG9qYPe-1xDr3AOn5D8VaI26wdBRo_rE947L56--yaCFZfC6AR7wUCNGXVhINxNwZVg7CMTlNL9DV0chpVN5nWAz5xZuGiEeWZZlHcSAe1aZeg2o_hBgJnn3Yqr3BoAtF6M8awB20zcTB2JoiFhqq-eKeE8tdWU7Pzrkjl32ULTy7i3CKbMFIj03CqfwdkZ6sOWh7a0AV0BIuKFhq24WDVBBadvEY4AbyyrSOY9PJb78wK-vgVYFjxnU1-h-80kgHEh0HfZ7S4fYDpY7lSuUgesw41TTpfVE1VwFwRwGZnnCysuQHAcEE6NBjKNH7uo8rEcWdD7osYXlrzRErmdHEoZFABIrePxCEG-RcQ88Lojz5HA3pSU5cKnfrV2_iwrSzN7-S3CwN3PF-79BXT58M4ALalhr7GSBbl9kokP0zDNu-zdyju_1o-USBlnYOgdT_Eez4l0R5_sUlEAwc_wv5_9b0dV6aE6k6I67ba76yuO-s8Vy2vBD9KA7VfCrK-3Y0Auug0lVU0vL4d4NfgFGQ9x5mSfGNfz4qv_1nadJrPs5-FMWqAt1INK8xkXzfS23VlYKkt30j0blb1EXUNUVobpbI_OBieYjl5CpPCw2kYeJx8TQM9f-kBaU_KtR40X9svPKW1x-VkkNwF9YzCb7flhhqBMHq_qjhDsxbnudR3B3Dt-SDBgVLdlRrwbB5Oov2odjtYy0QLVW2M8STlnIYXnAlzW3TTaQwDnC2isHT68orLiQUxoIwmi5mQLn1P2aZiQ

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK bsevent.gif
tps20517.doubleverify.com/ Frame 2B5C 807 B
1 KB 25ms
25ms Image
image/gif 213.254.244.14
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tps20517.doubleverify.com/bsevent.gif?impid=fa166ac2232542388a19452762688465&pltfrm=Linux%20x86_64&cbust=1616016824081724
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.14 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:43 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/gif
Cache-Control: max-age=0
Content-Length: 860
Expires: 3/16/2021 9:33:44 PM

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
441 B 20ms
20ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjMxODAwMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiI1In0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19weCIsInZhbCI6IjQzOTM4MCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfZG9jX2NvdW50IiwidmFsIjoiNSJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfcHgiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJ2aWV3cG9ydF9zaXplIiwidmFsIjoiMTYwMHgxMjAwIn0seyJuYW1lIjoidmlld3BvcnRfcHgiLCJ2YWwiOiIxOTIwMDAwIn0seyJuYW1lIjoiZG9jX3B4IiwidmFsIjoiODkyMzIwMCJ9LHsibmFtZSI6ImRvY19oZWlnaHQiLCJ2YWwiOiI1NTc3In1dfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:44 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4f0560000dfbfa6995000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=nRJZO40GgPfjht9g3XiOuTLm1b2p8pRcfhwxHTVkURZezhJ%2Bb5gIJxuownxqEvKk1fljvHRX4V15UksZ2Eurcp6pbpMabobzXJNVGLXXOinqX9ZcLlfb7bc%2FaOtCENYB%2BL5w8oUbkp0bbw%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319576089d5dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:44 UTC

POST
H/1.1 200
OK event.png
tps20237.doubleverify.com/ Frame 77B4 67 B
514 B 88ms
37ms Other
image/png 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20237.doubleverify.com/event.png?impid=adcf887b1933412a836f04923a8c17f2&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&dvp_t1stMsgD=123&vdur=88&eoid=5&msrjs=1146&pltfrm=Linux%20x86_64&isvelg=1&vit=2&engms=1&engisel=1&cbust=1616016824433361
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:43 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 3/16/2021 9:33:44 PM

POST
H/1.1 200
OK event.png
tps20224.doubleverify.com/ Frame B66C 67 B
514 B 82ms
24ms Other
image/png 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20224.doubleverify.com/event.png?impid=0ab32e372d404c11acc900f9a20c70c0&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&dvp_t1stMsgD=69&vdur=33&eoid=5&msrjs=1146&pltfrm=Linux%20x86_64&isvelg=1&vit=2&engms=1&engisel=1&cbust=1616016824502491
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.0 / ASP.NET
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:44 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 3/16/2021 9:33:44 PM

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
329 B 28ms
28ms XHR
text/plain 2606:4700:3036::6815:3444
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MjkyOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8zIiwidF9lcG9jaCI6MTYxNjAxNjgxNSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiNmUwYWVjNWUtYWYxNi00NjM3LTY1YmQtZTA2YzkwZTlhMDQ4IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDI5MjkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMyIsInRfZXBvY2giOjE2MTYwMTY4MTUsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjZlMGFlYzVlLWFmMTYtNDYzNy02NWJkLWUwNmM5MGU5YTA0OCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQyOTI5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzMiLCJ0X2Vwb2NoIjoxNjE2MDE2ODE1LCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI2ZTBhZWM1ZS1hZjE2LTQ2MzctNjViZC1lMDZjOTBlOWEwNDgiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiODMifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3444 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:44 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4f1560000dfbf2e8d2000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=xPoyjzYWgpw%2BhuzyLLQkaYWHPcWYC38CVsKO0xDs0CB8CX2J65Iz738W3rx%2ByZMLDyBkGhM2UEI6MOhKJ8HhCGLr5sb1o7Q19scsM4Lip14edIW0kASag6xrFioIQqg6V2VrYWffgLL7gA%3D%3D"}]}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957622ba7dfbf-FRA
expires: Tue, 16 Mar 2021 21:33:45 UTC

POST
H/1.1 200
OK event.png
tps20238.doubleverify.com/ Frame 575C 67 B
514 B 77ms
24ms Other
image/png 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20238.doubleverify.com/event.png?impid=19db685199d84009bbb496746aebe85d&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&dvp_t1stMsgD=62&vdur=30&eoid=5&msrjs=1146&pltfrm=Linux%20x86_64&isvelg=1&vit=2&engms=1&engisel=1&cbust=1616016824845607
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:44 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 3/16/2021 9:33:44 PM

POST
H/1.1 200
OK event.png
tps20224.doubleverify.com/ Frame F660 67 B
514 B 25ms
24ms Other
image/png 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20224.doubleverify.com/event.png?impid=afc20bc4e413468ca627253e7761f31e&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&dvp_t1stMsgD=102&vdur=29&eoid=5&msrjs=1146&pltfrm=Linux%20x86_64&isvelg=1&vit=2&engms=1&engisel=1&cbust=1616016824931465
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.0 / ASP.NET
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:44 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 3/16/2021 9:33:44 PM

GET
H3-Q050

200

activity;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;ord=1
adservice.google.com/ddm/fls/z/dc_pre=CM_BueajuO8CFVD57Qodw6QLZg;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;ord=1%7Chttps://ad.doubleclick.net/ Frame 2B5C
Redirect Chain

https://ad.doubleclick.net/activity;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;ord=1%7Chttps://ad.doubleclick.net/activity;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=...
https://ad.doubleclick.net/activity;dc_pre=CM_BueajuO8CFVD57Qodw6QLZg;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;ord=1%7Chttps://ad.doubleclick.net/activity;src=1295336;...
https://adservice.google.com/ddm/fls/z/dc_pre=CM_BueajuO8CFVD57Qodw6QLZg;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;ord=1%7Chttps://ad.doubleclick.net/activity;src=12953...

42 B
65 B

42ms
41ms

Image
image/gif

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CM_BueajuO8CFVD57Qodw6QLZg;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;ord=1%7Chttps://ad.doubleclick.net/activity;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;ord=1?cbust=1616016824946227

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:45 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://adservice.google.com/ddm/fls/z/dc_pre=CM_BueajuO8CFVD57Qodw6QLZg;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;ord=1%7Chttps://ad.doubleclick.net/activity;src=1295336;type=cs;cat=Viewa0;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;ord=1?cbust=1616016824946227
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

src=1295336;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_...
adservice.google.com/ddm/fls/z/src=1295336;dc_pre=CODtueajuO8CFdVUGAod1U4E-w;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_2... Frame 2B5C
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=1295336;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_3...
https://ad.doubleclick.net/ddm/activity/src=1295336;dc_pre=CODtueajuO8CFdVUGAod1U4E-w;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5...
https://adservice.google.com/ddm/fls/z/src=1295336;dc_pre=CODtueajuO8CFdVUGAod1U4E-w;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5B...

42 B
243 B

41ms
41ms

Image
image/gif

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=1295336;dc_pre=CODtueajuO8CFdVUGAod1U4E-w;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_50_59%5D;u9=%5BBUCKET_60_69%5D;u10=%5BBUCKET_70_79%5D;u11=%5BBUCKET_80_89%5D;u12=%5BBUCKET_90_99%5D;u13=%5BBUCKET_100%5D;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;u17=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1%7Chttps://ad.doubleclick.net/ddm/activity/src=1295336;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_50_59%5D;u9=%5BBUCKET_60_69%5D;u10=%5BBUCKET_70_79%5D;u11=%5BBUCKET_80_89%5D;u12=%5BBUCKET_90_99%5D;u13=%5BBUCKET_100%5D;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;u17=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1?cbust=1616016824947945

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:45 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://adservice.google.com/ddm/fls/z/src=1295336;dc_pre=CODtueajuO8CFdVUGAod1U4E-w;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_50_59%5D;u9=%5BBUCKET_60_69%5D;u10=%5BBUCKET_70_79%5D;u11=%5BBUCKET_80_89%5D;u12=%5BBUCKET_90_99%5D;u13=%5BBUCKET_100%5D;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;u17=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1%7Chttps://ad.doubleclick.net/ddm/activity/src=1295336;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_50_59%5D;u9=%5BBUCKET_60_69%5D;u10=%5BBUCKET_70_79%5D;u11=%5BBUCKET_80_89%5D;u12=%5BBUCKET_90_99%5D;u13=%5BBUCKET_100%5D;u14=115750;u15=18330;u16=%5BDVP_ADID%5D;u17=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1?cbust=1616016824947945
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

dc_pre=CL_av-ajuO8CFaeB7QodgfsPgw;src=1295336;type=cs;cat=Viewa0;u14=115845;u15=18330;u16=%5BDVP_ADID%5D;ord=1
adservice.google.com/ddm/fls/z/ Frame 3FEC
Redirect Chain

https://ad.doubleclick.net/activity;src=1295336;type=cs;cat=Viewa0;u14=115845;u15=18330;u16=%5BDVP_ADID%5D;ord=1?&cbust=1616016825032833
https://ad.doubleclick.net/activity;dc_pre=CL_av-ajuO8CFaeB7QodgfsPgw;src=1295336;type=cs;cat=Viewa0;u14=115845;u15=18330;u16=%5BDVP_ADID%5D;ord=1?&cbust=1616016825032833
https://adservice.google.com/ddm/fls/z/dc_pre=CL_av-ajuO8CFaeB7QodgfsPgw;src=1295336;type=cs;cat=Viewa0;u14=115845;u15=18330;u16=%5BDVP_ADID%5D;ord=1?&cbust=1616016825032833

42 B
65 B

41ms
41ms

Image
image/gif

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CL_av-ajuO8CFaeB7QodgfsPgw;src=1295336;type=cs;cat=Viewa0;u14=115845;u15=18330;u16=%5BDVP_ADID%5D;ord=1?&cbust=1616016825032833

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:45 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://adservice.google.com/ddm/fls/z/dc_pre=CL_av-ajuO8CFaeB7QodgfsPgw;src=1295336;type=cs;cat=Viewa0;u14=115845;u15=18330;u16=%5BDVP_ADID%5D;ord=1?&cbust=1616016825032833
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

src=1295336;dc_pre=CMurvOajuO8CFVBDGAodM38ORA;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u...
adservice.google.com/ddm/fls/z/ Frame 3FEC
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=1295336;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_3...
https://ad.doubleclick.net/ddm/activity/src=1295336;dc_pre=CMurvOajuO8CFVBDGAodM38ORA;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5...
https://adservice.google.com/ddm/fls/z/src=1295336;dc_pre=CMurvOajuO8CFVBDGAodM38ORA;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5B...

42 B
65 B

41ms
40ms

Image
image/gif

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=1295336;dc_pre=CMurvOajuO8CFVBDGAodM38ORA;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_50_59%5D;u9=%5BBUCKET_60_69%5D;u10=%5BBUCKET_70_79%5D;u11=%5BBUCKET_80_89%5D;u12=%5BBUCKET_90_99%5D;u13=%5BBUCKET_100%5D;u14=115845;u15=18330;u16=%5BDVP_ADID%5D;u17=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1?%20&cbust=1616016825032392

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:45 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://adservice.google.com/ddm/fls/z/src=1295336;dc_pre=CMurvOajuO8CFVBDGAodM38ORA;type=custom;cat=viewa2;u1=%5BTOTALPAGETIME%5D;u2=%5BBUCKET_0%5D;u3=%5BBUCKET_1_9%5D;u4=%5BBUCKET_10_19%5D;u5=%5BBUCKET_20_29%5D;u6=%5BBUCKET_30_39%5D;u7=%5BBUCKET_40_49%5D;u8=%5BBUCKET_50_59%5D;u9=%5BBUCKET_60_69%5D;u10=%5BBUCKET_70_79%5D;u11=%5BBUCKET_80_89%5D;u12=%5BBUCKET_90_99%5D;u13=%5BBUCKET_100%5D;u14=115845;u15=18330;u16=%5BDVP_ADID%5D;u17=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1?%20&cbust=1616016825032392
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK event.png
tps20237.doubleverify.com/ Frame 77B4 67 B
514 B 25ms
24ms Other
image/png 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20237.doubleverify.com/event.png?impid=adcf887b1933412a836f04923a8c17f2&gdpr=&gdpr_consent=&msrcanlm=904&msrcannum=3&eoid=7&ismms=1038&isumms=1037&isvelg=1&nvr=6&isgmmims=1038&isgmv4mims=1038&isbxdms=2237&b0=100&b11=1232&adhgt=90&adwdth=728&norwdth=728&norhgt=90&engisel=1&vsos=3&dvp_vsosnmr=16&lftb=1332&sftb=1332&msrdp=2&naral=640&vct=512&vphgt=1200&vpwdth=1600&scrhgt=1200&scrwdth=1600&strp=0&advisonl=false&isiabvms=2038&isuiabvms=2038&isgmpims=1145&isgmv4dpims=2038&ispmxpms=2038&engalms=1037&dvp_dpr=1&cbust=1616016825432395
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:44 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 3/16/2021 9:33:45 PM

POST
H/1.1 200
OK event.png
tps20224.doubleverify.com/ Frame B66C 67 B
514 B 26ms
26ms Other
image/png 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20224.doubleverify.com/event.png?impid=0ab32e372d404c11acc900f9a20c70c0&gdpr=&gdpr_consent=&msrcanlm=392&msrcannum=3&eoid=7&ismms=1023&isumms=1022&isvelg=1&nvr=6&isgmmims=1023&isgmv4mims=1023&isbxdms=2222&b0=100&b11=1235&adhgt=250&adwdth=300&norwdth=300&norhgt=250&engisel=1&vsos=4&dvp_vsosnmr=16&lftb=1335&sftb=1335&msrdp=3&naral=128&vct=512&vphgt=1200&vpwdth=1600&scrhgt=1200&scrwdth=1600&strp=0&advisonl=false&isiabvms=2022&isuiabvms=2022&isgmpims=1150&isgmv4dpims=2022&ispmxpms=2022&engalms=1022&dvp_dpr=1&dvp_valpct=2&cbust=1616016825502690
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.0 / ASP.NET
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:44 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 3/16/2021 9:33:45 PM

POST
H/1.1 200
OK event.png
tps20238.doubleverify.com/ Frame 575C 67 B
514 B 26ms
26ms Other
image/png 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20238.doubleverify.com/event.png?impid=19db685199d84009bbb496746aebe85d&gdpr=&gdpr_consent=&msrcanlm=968&msrcannum=4&eoid=7&ismms=15&isumms=14&isvelg=1&nvr=6&isgmmims=15&isgmv4mims=15&isbxdms=2215&b0=100&b11=2309&adhgt=90&adwdth=728&norwdth=728&norhgt=90&engisel=1&vsos=3&dvp_vsosnmr=16&lftb=2409&sftb=2409&msrdp=0&naral=704&vct=512&vphgt=1200&vpwdth=1600&scrhgt=1200&scrwdth=1600&strp=0&advisonl=false&isiabvms=942&isuiabvms=942&isgmpims=161&isgmv4dpims=942&ispmxpms=942&engalms=14&dvp_dpr=1&cbust=1616016825845559
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:45 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 3/16/2021 9:33:45 PM

POST
H/1.1 200
OK event.png
tps20224.doubleverify.com/ Frame F660 67 B
514 B 28ms
28ms Other
image/png 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20224.doubleverify.com/event.png?impid=afc20bc4e413468ca627253e7761f31e&gdpr=&gdpr_consent=&msrcanlm=456&msrcannum=4&eoid=7&ismms=10&isumms=9&isvelg=1&nvr=6&isgmmims=10&isgmv4mims=10&isbxdms=2209&b0=100&b11=2315&adhgt=250&adwdth=300&norwdth=300&norhgt=250&engisel=1&vsos=4&dvp_vsosnmr=16&lftb=2415&sftb=2415&msrdp=1&naral=192&vct=512&vphgt=1200&vpwdth=1600&scrhgt=1200&scrwdth=1600&strp=0&advisonl=false&isiabvms=913&isuiabvms=913&isgmpims=187&isgmv4dpims=913&ispmxpms=913&engalms=9&dvp_dpr=1&dvp_valpct=2&cbust=1616016825931159
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.0 / ASP.NET
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:45 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 3/16/2021 9:33:45 PM

GET
H/1.1 200
OK bsevent.gif
tps20517.doubleverify.com/ Frame 2B5C 807 B
1 KB 25ms
24ms Image
image/gif 213.254.244.14
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tps20517.doubleverify.com/bsevent.gif?impid=fa166ac2232542388a19452762688465&mascid=kmdyow6h8y9rscgmsi2la9flwv7nqhjg&dvp_masver=6&dvp_tisf=2&dvp_t1stMsgB=331&cbust=1616016826994133
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.14 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:46 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/gif
Cache-Control: max-age=0
Content-Length: 860
Expires: 3/16/2021 9:33:47 PM

GET
H/1.1 200
OK bsevent.gif
tps20519.doubleverify.com/ Frame 3FEC 807 B
1 KB 25ms
24ms Image
image/gif 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tps20519.doubleverify.com/bsevent.gif?impid=a02effa0b2de4c8bb903acde135b77db&mascid=kmdyowc7nl339t5jitw2cik7fi0ltjsi&dvp_masver=6&dvp_tisf=2&dvp_t1stMsgB=162&cbust=1616016827199244
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:46 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/gif
Cache-Control: max-age=0
Content-Length: 860
Expires: 3/16/2021 9:33:46 PM

POST
H/1.1 200
OK event.png
tps20237.doubleverify.com/ Frame 77B4 67 B
514 B 26ms
26ms Other
image/png 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20237.doubleverify.com/event.png?impid=adcf887b1933412a836f04923a8c17f2&gdpr=&gdpr_consent=&mascid=kmdyow6h8y9rscgmsi2la9flwv7nqhjg&dvp_masver=1146&eoid=8&cbust=1616016827534932
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:46 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 3/16/2021 9:33:47 PM

POST
H/1.1 200
OK event.png
tps20224.doubleverify.com/ Frame B66C 67 B
514 B 29ms
28ms Other
image/png 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20224.doubleverify.com/event.png?impid=0ab32e372d404c11acc900f9a20c70c0&gdpr=&gdpr_consent=&mascid=kmdyowc7nl339t5jitw2cik7fi0ltjsi&dvp_masver=1146&eoid=8&cbust=1616016827602612
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.0 / ASP.NET
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:47 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 3/16/2021 9:33:47 PM

POST
H/1.1 200
OK event.png
tps20238.doubleverify.com/ Frame 575C 67 B
514 B 24ms
24ms Other
image/png 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20238.doubleverify.com/event.png?impid=19db685199d84009bbb496746aebe85d&gdpr=&gdpr_consent=&mascid=kmdyowpy6pyk8z8vk6vevt513zxetba1&dvp_masver=1146&eoid=8&cbust=1616016827946595
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:47 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 3/16/2021 9:33:47 PM

POST
H/1.1 200
OK event.png
tps20224.doubleverify.com/ Frame F660 67 B
514 B 25ms
24ms Other
image/png 213.254.244.15
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20224.doubleverify.com/event.png?impid=afc20bc4e413468ca627253e7761f31e&gdpr=&gdpr_consent=&mascid=kmdyowrdcloascvkcw98i9z0wcma2pk8&dvp_masver=1146&eoid=8&cbust=1616016828032133
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1146.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.15 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software: Microsoft-IIS/8.0 / ASP.NET
Resource Hash

Request headers

Referer: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:47 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 3/16/2021 9:33:47 PM

Verdicts & Comments Add Verdict or Comment

215 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.reisekostenabrechnung.com/	1970-01-19 16:55:03	Name: _gid Value: GA1.2.973828294.1616016817
.reisekostenabrechnung.com/	1970-01-20 10:24:48	Name: _ga Value: GA1.2.973125957.1616016817
www.reisekostenabrechnung.com/	1970-01-22 06:12:48	Name: ezohw Value: w%3D1600%2Ch%3D1200
www.reisekostenabrechnung.com/	1969-12-31 23:59:59	Name: ezouspva Value: 0
.reisekostenabrechnung.com/	1970-01-20 01:39:12	Name: ezCMPCCS Value: false
.reisekostenabrechnung.com/	1970-01-19 16:53:38	Name: lp_129856 Value: https://www.reisekostenabrechnung.com/
.reisekostenabrechnung.com/	1970-01-19 16:53:38	Name: ezovuuid_129856 Value: f53b81e6-a373-4d85-6edf-8a6d3f365f59
.reisekostenabrechnung.com/	1970-01-19 16:56:29	Name: ezovuuidtime_129856 Value: 1616016816
.reisekostenabrechnung.com/	1970-01-19 16:53:36	Name: _gat_gtag_UA_2827868_10 Value: 1
www.reisekostenabrechnung.com/	1970-01-22 06:12:48	Name: ezds Value: ffid%3D1%2Cw%3D1600%2Ch%3D1200
.reisekostenabrechnung.com/	1970-01-19 16:53:38	Name: ezovid_129856 Value: 982925079
.reisekostenabrechnung.com/	1970-01-19 16:55:03	Name: ezepvv Value: 658
.reisekostenabrechnung.com/	1970-01-19 16:53:38	Name: ezoadgid_129856 Value: -1
.reisekostenabrechnung.com/	1970-01-19 16:53:38	Name: ezopvc_129856 Value: 1
.reisekostenabrechnung.com/	1970-01-19 16:53:44	Name: ezoref_129856 Value:
.reisekostenabrechnung.com/	1970-01-19 16:56:29	Name: active_template::129856 Value: pub_site.1616016815
.reisekostenabrechnung.com/	1970-01-19 16:53:44	Name: ezoab_129856 Value: mod38
www.reisekostenabrechnung.com/	1969-12-31 23:59:59	Name: ezouspvv Value: 0
.reisekostenabrechnung.com/	1970-01-19 17:36:48	Name: __cfduid Value: d2f3cac2017ed715c0c1034c9a6e52ce91616016815

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	info	URL: https://cdn.ampproject.org/rtv/012101070013000/amp4ads-v0.mjs(Line 10) Message: Powered by AMP ⚡ HTML – Version 2101070013000 https://www.reisekostenabrechnung.com/
console-api	log	URL: https://s0.2mdn.net/9080429/1589458486121/index.html(Line 230) Message: TweenLite:: Animation Here

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.atdmt.com
ad.doubleclick.net
ad.turn.com
adservice.google.com
adservice.google.fr
be2044fdfe1f9ca00f9397197034522d.safeframe.googlesyndication.com
c.amazon-adsystem.com
c1.adform.net
cdn-2.reisekostenabrechnung.com
cdn.ampproject.org
cdn.doubleverify.com
cdn.flashtalking.com
cdn3.doubleverify.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
cms.quantserve.com
d9.flashtalking.com
dsum-sec.casalemedia.com
ezodn.com
fonts.googleapis.com
fonts.gstatic.com
g.ezodn.com
g.ezoic.net
gcm.ctnsnet.com
go.ezodn.com
go.ezoic.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
impression.link
pagead2.googlesyndication.com
pm.w55c.net
r.turn.com
rtb0.doubleverify.com
s0.2mdn.net
secure.flashtalking.com
securepubads.g.doubleclick.net
servedby.flashtalking.com
sync.teads.tv
tpc.googlesyndication.com
tps.doubleverify.com
tps20224.doubleverify.com
tps20237.doubleverify.com
tps20238.doubleverify.com
tps20517.doubleverify.com
tps20519.doubleverify.com
us-u.openx.net
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.reisekostenabrechnung.com
104.108.145.8
104.109.66.25
13.226.158.204
142.250.185.162
142.250.186.130
142.250.186.34
142.250.74.198
143.204.202.16
18.159.187.109
2001:678:cb4:bbbb::11
205.185.216.10
213.254.244.14
213.254.244.15
23.59.71.163
2600:9000:2182:1600:2:cb38:840:93a1
2606:4700:3036::6815:3444
2606:4700::6810:125e
2606:4700:e4::ac40:a708
2620:116:800d:21:f916:5049:f87f:108e
2a00:1450:4001:801::2001
2a00:1450:4001:809::2001
2a00:1450:4001:809::2002
2a00:1450:4001:810::2002
2a00:1450:4001:810::2003
2a00:1450:4001:812::2002
2a00:1450:4001:813::2004
2a00:1450:4001:813::2006
2a00:1450:4001:828::2008
2a00:1450:4001:828::200e
2a00:1450:4001:82a::2001
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::200a
2a02:26f0:10c:488::4469
2a02:26f0:10c:49e::4469
2a03:2880:f02d:5:face:b00c:0:8c
3.126.196.163
34.251.104.84
35.186.193.173
35.244.159.8
37.157.4.40
37.252.172.45
46.228.164.11
00c7f681cd8605d131a231554e654a1042ea218ea112b6a0c653001a63bedeac
01b91c27c2dd8d42bf4832466bfb4d3f0ab2eff59e855e4ad8446dc626637cc8
028281c5a4e141790ec249fcdff5c6d222aae0da4084138528f348bc0446f570
02e57aeb229809e992f733b45041bec6d5a6a2344972ea9ced30bb06ab76404d
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0812a00aee80133b732c5cb2e0362ee2a52ae9f50c126d43e73f98163db9711f
08375cebca0d36f2fa3ec9e027a974146af7161553e4319a418d4cee6b38bed7
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
099e70d4b931c8545f4cb8f559abe42da76a28831152d7632c4f0df087e0b203
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c0538855201c28a681611fe4ccc74e127e756e1bd05c047f75f0406f4d602be
0ed81d9ca60ba526fba872f7f3a3464692efeaa5e99c12279bad8111c207c78d
0f087bb8341880a9a60af996272030bf86504927f2f64b62da3a53389211cbfd
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
0f4aed26045bbad87e590f94abfaeb8135b1081584c9283d2be2a28bf1c356df
1170a116f6521465e0d4f0df36d070b1502f257e88dbeb459d31d3e2c3fb861b
11ca2b97c357478751eaf975d488b2bb3fe244e18a570e122ee239f27890aec1
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
12b3c8eae2fe5af1db3154e204d173c247b64919db0a181f05a55e55388944c9
13f86bd1a6d578ee82ca0c54a9a634e03d8d7db09380d72590b158f173f53790
1412aa6597653444c97790eb60de89f62d343a9a5c28798867b2686422ba40b5
146815967beef8f2507cdb6330e10040cdb2dd123048f4b4a8308c804e56c159
15f0626dd31e3e991a1c21d6304f2e370b92b3c91650de3d7ed8a38f1159a457
17dd9204e346e364c9539624fb7f5b547de6cbaf82a805a79fe37dc99edf801b
194a2819816bb760d4c5ba2ba825cf1926b853c821842697c3024ec74a36f66c
1afeffa0c18907dd7e1e9ce9564e6eb8221974664a89c1db0b6adf38b255fa59
1b1c8d2a4407efecded0a09f6926c8b81a55fd09d3f4250d86c1a7032b0c3bf3
1b68431bd479f66f60cca8fef9520547c0f28390680174d8b36c5591085e8393
1c5ad2fd42dffdf04a0f1d757c1cccb4d840218d7ecada79d6cc9db33ca40319
1ea218661f49e28158ba378bd053b70c878adb09953e5ae48cab3768651a4abe
1f37e108a103ae6d6ed4ca9047d415434b8a1edefa81ddb7d4314ecb21587010
22abd45f1c986bcef595abde9c04687cbf9e0aaba50cae7ed74adf43a60e48cd
242a118feb6a1164888c2691992971a307399992845b4cee83295057b2818a34
24fafa96014bb69b2d14236c4982326ae80293f8d04891dd080dd094084f8320
25c788c3d6b5a5f5931ef45abc5640af29b16f379c2e1634dc32c6c225327f38
26b4485584314aa0850427462143a6a28b66c982db28deb42766214fad7744c7
27eec350cab567b43a120b0a93f0a0b70a5af6dbb609e19fb6d9f253fbbbf424
28161d419de84b0fb3c3bb264e0b244f907bb1bf505da450c833c34edf95d3a9
293f573379222c90a2f4b195fd3add80e4642cd9349a609b870cd2116b4cb25b
2974b2232a2d352cf6df3075489663ae71ecb923452ded1df33e69950ca3cdcc
297eec780e6e5d5bec30a668257ae57716d5c2d9223d5314a215691fad59d36e
2998a76a08fcea91aa9bdf58f192f52742d9ab549c4e55eaff7f85c2eea6b6ce
29f21aea7fc613d2618b70a483e0b4bf50ba3f4ce4109fa429ce580ec57ef991
29f6da0a8c21c5681511bb9b08663d3fd2c5d09c9bd8054ec354c563b8c8b7c1
2a8be398cf69c3e6d9b7e567a8736b5f6d9df75c212c0b90b151a6eb88cd3a6b
2f703dab5fd89d7a9063b534991c35445b154575428aa7e2397d819fc8263f7a
322b1e4ed7c507891b57e9f2de050bbf9e13d3b43a32164f81bd74e1cfe41748
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
34ef40de06f89a7924f26fdbafd35352f7fa67a8c5eb8840fdb6eeafb818240e
36e400cbc8956e93b9abeb302f00aab451688c688c49c32e8dbb6cc4761ebf69
37d4ae593a1268d4afce8c38f61ea933982184d2d6055300c2bfdb8ca28c2846
39e4c6e25be371a3026dc5ea8ae0e23e953d6916518811fcc5c1a1769767ab16
3db1f6d45dafa60fafb6408753cef362aae6d7ed8000e1d748da75cdf44eaa6d
3ded49272000064adcec14280964aea6d2253f83ce9ae507f25e24721f3ec8ca
40adb937145b21abf0b1dde7dfa4d0a80be21ce7bf7d4f85ca944022a23c6785
41eb9054d5d5527274926b32631be8eb22dd6254f15a4d9d14cfe2688ea4f538
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
498e1816875171bad3e7bee172b561231eb2f8aa004e9b872fd5b651f5f84062
49c5f156728fa40f3cc8ee749201723059f4c2f52d4a50a39adc7e32833c638c
49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504
4a4fe5147f0ba52feecf256ac0036eb042f12a1691f711df4620b29451be5e84
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b73436f7c44562199d88eacfdaee95d10c34e3cbf03c77756653e4b9447d142
4caa82121ce30bcf487dfc3bd525740de5435be8594f0f5073e9cdeb632bb393
4d3a493f17f2d967adf97e9aa152fbc04bc17adf046197494b835d9bcc507cb2
4d945a036e928a9758246d0fa097939d99b3e8e35c50eb30020ef5614c1c93a4
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4ed9e68daec65b2fde80938f332c6813249b5261d1b158b5703574e2c34a14c3
4fe5c678cf87925228025af1ab82c092bd7bd1af07c563ebec076326f10d07f5
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
5578a62b81f315375d072cfe506fc13813e844f94c910bdb15ce20e1fc3ef50a
570c04b30a5c8fa6ceaff96ea6d3a0dfabd85dee3edae40e38b0344a7278f254
57759546953786ff698ce45fd0324c47238aa59cde9f2bc443c499f719da34dc
5b598f6b8e6244f2ba676cc0f9fa2749ac3e7b9b04ef153df6770145bd593b66
5c7246a30f947138add9e8a4f08af29a2bbe677690075ec238eb87f02ca9fc2f
5e03a7aaf1268afc2377a1c4d36959d7213380c40527ac50ccca39b8c16ce610
62b1cff44a5e34b9587ad49f7ca951160f1559c5c545bcf99e13574ccaa5425a
637fac9268b2df661905ddb54af762320839777e0102c34bf2b66fa76f9a18bb
638eafaa23d3d1f411bff28ebc87ae6aa09d3c110228e93fa6868632a7cd4d36
657df3443b334f17bd33ac827932e2395ddc2d5a28b697c91e21fc8fabebf8e7
68984aa0e0192c05e3385c29a8e60cc4a1c37a9273ce62503006a85e09e92246
69c7140c465fc1a08442f09feb783e9790e4eb675cdda73d3dece608f0bafa3d
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bebfd51b68600bcc3ddf379ce44cd7f5efd700a8918e587be24ff865fdc361d
6ef4f49da52b8f5f17154a5b951f71822b15304ec98e556ba99cb3dc19f1cfdb
70d82c6075989e0082b4917c6685f5f6bec1e673d0a80160eac61b3f1cdcb1a1
731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
75167cabfce676d0e566fc6fc94d259e06564872d233eaee3935185ab9076563
76bcd6777531af5ae5203c6cbaa574c68736d2fa0bb6011d51dd321ea8e18164
773eb27e80f3e8ac73717276433272ae10a470067ea1b4485e783358a9198d38
77a6e7584722f285dd6b3039728b6f1aab3948e60b4c26298600f1a5ee155bbb
7858a7bc511749ce9b0097ac9d6c6464c8f96fc392e69bc857a81b1b80457369
78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
801b78af2ab57cfc67d37f8137feac63f1b722b8812dea418b43759e9baddef8
8154aa9057e3367d9d3e4bb1f85db9645c01fc0690091aadc57dbae849ba3499
8471f381394962167d7d0cbbd9ffbd1f19d3ef6c48a7d9e3209142e674481368
84c65cf6dccd23cbcc0603f73e434c41a4086431756078e8bd2c7a1ff182066f
858feaa3c94465f06504749a0f581469156cc61f03b5c53d0124f6cb049b3ed7
85aef15e15535a3497f55f748129fd2744772229e00a72eff6d2b5aaca4f0fb1
86be5d6a3d661fd3d5d72f254a347dec5c66cad569117f51dad297acba02f558
86cef609c85d2c2ce6a507af54e77a9c150e2fa408043e1454082614c4b0ce2b
893e9e87a8ec52e665a42c3c3854931ef2bb5868006e8a1797d38f84febdead5
894e32f3b7d381eb29be215146a39449a3da919114e8782045ebf06fe5731697
8d6487dc2599772b6ccb8ed3c214aefeddf16e73d868abb94f2223c133af06d0
8ff01c3620edd0df1abcb0745f7ec94bde06d97dde3f152e8a8c5844272475f5
91b4244ebe9f1ca90ed84b8b5c9fe2f340e35d55df94c668b89f824d57e9010c
92fcddd530f832a65860eedc146abbdfae76ac307cde548e7ed8c36d6977b9e2
941c260356b6aa75782a27384179a63581c9e41b42155774982f36b0d84cde9c
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
977e2a7ebfdf57c55274f6a1191eefdf637e4055e05d38386de41281209f993a
97952878d17a7f73936246ad05d0e401e5d6a4eb841f75ecfec366673dfc9e2e
981f6ac4a0eed80f6a40eef39d86ce7876f6e360d8b3a2f57f2617bb12895dc3
99b01d2d01686465c5a11f8ee823ceb4dc563049eff944fe3334f85392b95f72
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2597098b7399a8cfcd439b9af387be361db498438b90fb788b1c07177b28b52
a25f4e403cd3009578cf6ca056afac33ed6aae8f47d1ab575756804b52be203a
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a94187bbe2f8484d353b34a03e40646e2c67605b74289882a20a2752b4e83b74
ab512420f81c4a334d7064d9dbcab398fd69a83f54158a96d8960001b39995c0
aba387bcb56de1503c6196d03295b70469425af39b649cf05b38b6949e8456c2
acaf64465266980ab0ec564d519cef9a9de50bad211281054dcf53e6d9927a33
ada2b7b8e97b28a0c397cf381249d2ba6b7bd3c6f028cb071ef548e6451d31e7
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b4d07892cde715d50bb69c1982df496385d1dfd8f9d1867c31f19a3c8634cfae
b726f640fbd2d80ddcf3c5e283fe701e054526de4ea5a2328e60459d795e498f
b7dabd76ad06582c66fd0838e1e831a74a425bc01f73870eadd2ecc67af87b38
b8b87c1a60107eec4cf6709a8a97371d34bf36e645f9421963f79def462191fb
bab158f2b326e9f2db0ee25f682afbe01ec4835c26564e68950d4170180cd80b
bc4a532d1cc0e0681799df7243d94d96e3949e93d6951765e738c2e455ba5738
c27672b63687b1eb6b73920b3b556f4774199f030787ce9c7507c5bb8b0cec89
c4024d5169b2506f3421052b45f5d66154de796baf2443d9326ac40107ce5cfb
c7fa743da4cd37829cd0e7c02e877f094400036be87c8e1fd9d2c3f5f68a8fa5
c80203c7eae413cecc09a4ed0974e31a8538060cddd5bc1f1a5bfa53db672c9e
ca625f204331905abf3b4d86a89dfb9799c63771723b9b15c5b54c1f9fb2b83c
ca7e2ea27a1cd7ac6f4afa24d3ae3c342b696b7e31f725a84ee227789cac42fe
cc470a93cb0f84356b1f95b20e67560edef307fb653294bdf7f050460b8ffabb
cfa9df33ddcd5997a1bc37ac8938f95811ab466aaf288f04bad9cb28b5f3e3e0
d03755898b05a3d69377bf7da16ccb307e789a0f569b4dbbcb7b29bdecf967c5
d0cadf92e9b065836107866fa40b1d777cf50592d45091c5423c0d192b0a6743
d14179c52c8976762b2a18c43bf2bf151281ea48aaa8b2fd4433ea046cebba64
d17b84f0cbd97c80fcfee28f36b7a4122035195ecbfbaba9ce6d54ba414dbad3
d1e2b75ddf4d29937af3c47d551a10ec90a6e857a555e3998b52509cedd77c2a
d269f9bebbbe631349351d50b4696ff0d94649dbb03889b769687d0290dd12bf
d4541768d977bafc2a0a4215e5dbeeee0b39965aeb2fc8b2a3ac6e7b42a25c26
d74bbc606bda1dd3e58a7ab06db2951eb1e1796f713005c26b953a6ea62ce7fd
d798d8773831f64f1228bc59f6dc361eae9b0811b1cbce20d639a8695b1d118c
d91678cb3cf4723b24515cabb0550878eed5dbd4f6ab8a022f6bceaa146bfb0a
d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39
dab782e34cabcce3f11dc1b6d28be09129b3283a6aeb2c83d9902839ea29b8a3
daf79d666932d07416a4fbc69b64fccfecc59651707cd9a2bc75126d08ccb1ac
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dee7b94da78ae074e389317347107a922ba45c261e5a78bc59fb796d67c1ca92
e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234
e25fa1dc383dab10261f885d1c39a604525d2cd2ea6ca908e2c2375c07e3884d
e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4139b3e7ead7268f5e730fb9b32300273ce262da28ed4bdff16508d8d6d7314
e47a27d91c2487289d6607ee10d7cb7b31944a5ed3ff5ffc86ec8526e9374af0
e86479d6e54449d1085c2149e190a615c6bead407b20bacbcf5852b5d65f1fee
e9591f064ab3cd667a6d281a2566b45b0636e9da33108e0257c53bd3f5cda455
e965b21d6a23293b47f5deb510a49b0675f74ee2eeb6dc86c101c33ff921461c
e9c9d33909759c9d5518a848d0479261502be89380dd8901f2af584091faa901
eba385c1782056501cdda10d5706441ab694be71c08db0a758160c6a16373171
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a
ec8604d4eade6552031ca2e8d3af9b3a1393bdc11b39dcb8176c41f4e5fb678c
ec966c6935469f98fffcc5f54814228ea1733dc59be245a5d7b5f669dfa28751
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2b92530616ddbefbed0e825e094cd914f17ae899b42152f17028a0073f5eb62
f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df
f4e3441f0da47965d475c902c09d9c269054457d568226269c23335e0d43d766
f69dfe383fe0ef66df2c8de098fda546a826801c150ec22e7e09b8020b221dae
f6b6c0dfaa89fe482fd724314eee367973d9d82d8d4181e2d24102ee378b9320
f75ada33b07cb31e16a0a0d3325961a22dc9526edb49bff04c31d7b7611f7025
f9d9f49fc378d4322355f7fdf35e213afc7f835ab2542b772a4e25802a5ac5cf
fa57c3f9d183c672e35364859903c259235517855e530d6707404031c7b3db97
fd5a91913a74d6a43b060f616dd109816717a7cfafa30f62e08890e3986758a5
fd8cc56d4953209cb0bd10a1198b3726b03857abfe648c987b6dbd4e0f63513a
fea355bd50e55e29f7b964c046b880bcf1218c0d9bae25d0c2e222dee6a0c6e9

www.reisekostenabrechnung.com Open in urlscan Pro 2606:4700:3036::6815:3444 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

350 Requests

100 %HTTPS

52 %IPv6

29 Domains

52 Subdomains

39 IPs

5 Countries

2884 kBTransfer

7679 kBSize

19 Cookies

15 Outgoing links

Page URL History

Redirected requests

350 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.reisekostenabrechnung.com Open in urlscan Pro
2606:4700:3036::6815:3444 Public Scan

Screenshot
Live screenshot

Full Image

350
Requests

100 %
HTTPS

52 %
IPv6

29
Domains

52
Subdomains

39
IPs

5
Countries

2884 kB
Transfer

7679 kB
Size

19
Cookies

350 HTTP transactions
6 data transactions