docplayer.net Open in urlscan Pro
138.201.54.145 Public Scan

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"4333212058078080976","debug_reporting":true,"destination":"https://progress.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["960221354"],"4":["09-24"],"6":["true"]},"priority":"500","source_event_id":"6872849345056431409"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 24 Sep 2023 16:55:36 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"4333212058078080976","debug_reporting":true,"destination":"https://progress.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["960221354"],"4":["09-24"],"6":["true"]},"priority":"500","source_event_id":"6872849345056431409"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js Show response
pagead2.googlesyndication.com/bg/ Frame 90F2 37 KB
14 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85de8e1049567f060665a08f4f9784af156edc484723473acd40953eb3bde550

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 07:19:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 380172
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14709
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 07:19:24 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 146ms
55ms Preflight
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 24 Sep 2023 16:55:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame E02F 624 B
242 B 63ms
61ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNX3SWx-xsobFZQJvVQxhG_3hG5EO9s0KngN-VoXTijBCaXfDBzkh97CfAhkES1EhjKZ2RFyzCb16R8iTtI0KTmthRKmg4S4-9R9190UxRrhL1SjijRybW75iK0stVwbir2p3Mf0JZeovrbUTjhkL6azB3I-fR4FH0pb1IGScmEQ7MuQuyA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=10950491&adf=3202966620&pi=t.aa~a.1856536719~rp.2&w=348&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=348x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100&nras=2&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1218&ady=1855&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Jli3MZYwUS&p=http%3A//docplayer.net&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=10950491&adf=3202966620&pi=t.aa~a.1856536719~rp.2&w=348&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=348x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100&nras=2&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1218&ady=1855&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Jli3MZYwUS&p=http%3A//docplayer.net&dtd=12
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 8E22 89 KB
31 KB 145ms
144ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4accbcd793680c2ea0a65714771ef37d5eeb42bdaedba9882dd0d78eae09e00e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31438
x-xss-protection: 0
server: cafe
etag: 13183557946744512263
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 24 Sep 2023 16:55:36 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 8E22 3 KB
1 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:33:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1303
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 16:33:53 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 8E22 20 KB
8 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16148
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:26:28 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 8E22 0
0 29ms
28ms Image
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTrmbxPerY7-lxGR9mFqIus2pwmawulWRS8RaoABzf_ImyrKsaQ3IjO5Pq1nj__ma51kW9s_9shP-ihlLDR4nn4HAAo4A
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=10950491&adf=3202966620&pi=t.aa~a.1856536719~rp.2&w=348&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=348x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100&nras=2&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1218&ady=1855&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Jli3MZYwUS&p=http%3A//docplayer.net&dtd=12
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8E22 182 KB
57 KB 36ms
34ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Sep 2023 16:55:36 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8E22 42 B
63 B 122ms
121ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AQY7g3EWteTYeWEeF-KSTFt56W6_LXR4lhBa_87lUh5IbnXxL1fZXWrrPeEYQorNhrJPJ_xhpnxSw0bCKdhyze7HyE9MyDPTbVSUAja3ADY67av2w

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8E22 0
20 B 123ms
121ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=13835048498425476323&x=1&ct=77

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4408 0
20 B 126ms
125ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=Cg4IByoKd2ViX2Jhbm5lcgoHCAgqA2x0cgoYCAEqFHNreXNjcmFwZXItZWRpdG9yaWFsCgoIAioGc2VydmVyCg0QFCEAAAAAUMrzQDAECg0QFSEAAAAAAAAmQDAECg0QFiEAAAAAAAAQQDAECg0QGCEAAIDMzLySQDAECg0QMiEAAAAAMDPTPzAECg0QMyEAAAAAMDPTPzAECg0QNCEAAAAAMDPTPzAECg0QNSEAAAAAMDPTPzAECg0QNiEAAAAAMDPTPzAECg0QNyEAAAAAMDPTPzAECg0QOCEAAAAAmpnxPzAECg0QOSEAAAAzM2eJQDAECg0QOiEAAAAzM6eJQDAECg0QOyEAAAAAAGqQQDAECg0QPCEAAAAAAGqQQDAECg0QPSEAAIBmZnaQQDAECg0QPiEAAIDMzKKSQDAECg0QPyEAAIDMzKKSQDAECg0QQCEAAAAzM9eSQDAEEhpDUFg1N3E3Ync0RURGWG9wclFZZEROUUM1ZyIRdGV4dC9lZGl0b3JpYWxfdjEoFQ==

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/f378f1a628345b8fc7dfdb57c16922da.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 9219 0
55 B 379ms
173ms Ping
image/gif 2607:f8b0:400a:805::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&puid=3~lmxpatcb&c=5110886411321&slotId=2555443205660.5&qqid=CJj57K7bw4EDFYkVrQYd69QESA&fb=outstream-lima&vast_v=2.0&vmfc=7&vhc=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20230802_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:805::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 9219 41 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20230802_RC00/outstream.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 15:06:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 92939
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 22 Sep 2024 15:06:37 GMT

HEAD
H/1.1

200
OK

file.mp4
r4---sn-4g5lznls.c.2mdn.net/videoplayback/id/b682cd7a5b5d3655/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1727110536/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 9219
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/b682cd7a5b5d3655/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1727110536/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signa...
https://r4---sn-4g5lznls.c.2mdn.net/videoplayback/id/b682cd7a5b5d3655/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1727110536/sparams/acao,ctier,expire,id,ip,ipbits,ita...

0
0

105ms
20ms

Fetch
video/mp4

2a00:1450:4001:26::9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r4---sn-4g5lznls.c.2mdn.net/videoplayback/id/b682cd7a5b5d3655/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1727110536/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/11540A8D856A8B41DC41B320616E458BFDD26CBC.0CB0613C0453D3041B1D5C9C5650088FC05DBD8B/key/cms1/cms_redirect/yes/mh/qX/mip/2001:1b60:1010:3:1011:7779:f350:d070/mm/42/mn/sn-4g5lznls/ms/onc/mt/1695574145/mv/u/mvi/4/pl/29/file/file.mp4

Requested by

Host: docplayer.net
URL: http://docplayer.net/204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:26::9 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:36 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 9011109
Last-Modified: Tue, 08 Aug 2023 11:35:04 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Sun, 24 Sep 2023 16:55:36 GMT

Redirect headers

date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 666
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
location: https://r4---sn-4g5lznls.c.2mdn.net/videoplayback/id/b682cd7a5b5d3655/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1727110536/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/11540A8D856A8B41DC41B320616E458BFDD26CBC.0CB0613C0453D3041B1D5C9C5650088FC05DBD8B/key/cms1/cms_redirect/yes/mh/qX/mip/2001:1b60:1010:3:1011:7779:f350:d070/mm/42/mn/sn-4g5lznls/ms/onc/mt/1695574145/mv/u/mvi/4/pl/29/file/file.mp4
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://googleads.g.doubleclick.net
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame E02F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIprXAbs8yblW6vgK_Vs8BM&google_cver=1

43 B
334 B

37ms
36ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIprXAbs8yblW6vgK_Vs8BM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNX3SWx-xsobFZQJvVQxhG_3hG5EO9s0KngN-VoXTijBCaXfDBzkh97CfAhkES1EhjKZ2RFyzCb16R8iTtI0KTmthRKmg4S4-9R9190UxRrhL1SjijRybW75iK0stVwbir2p3Mf0JZeovrbUTjhkL6azB3I-fR4FH0pb1IGScmEQ7MuQuyA
Protocol: H2
Server: 104.18.26.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eLoSrkUyoQ8UV4g2vFlQ2kgaKQXDDR2Synr6BamqAu9gJZgfyceteJn1sqa%2B40mHlHGBWmcEQFocGCYMBNoiQy1r%2F8LiJSR52Ys9mkZNJWImrNVIOLhTGgDYM1Mdu9UraNLWIm3ktAhs2A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 80bc8e5548102be9-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIprXAbs8yblW6vgK_Vs8BM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame E02F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZRBqCJVOjgVWoDBWPVk3owAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE_8EHdPOW7K-fzXGYkS-QI&google_cver=1

43 B
776 B

38ms
36ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE_8EHdPOW7K-fzXGYkS-QI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNX3SWx-xsobFZQJvVQxhG_3hG5EO9s0KngN-VoXTijBCaXfDBzkh97CfAhkES1EhjKZ2RFyzCb16R8iTtI0KTmthRKmg4S4-9R9190UxRrhL1SjijRybW75iK0stVwbir2p3Mf0JZeovrbUTjhkL6azB3I-fR4FH0pb1IGScmEQ7MuQuyA
Protocol: H3
Server: 104.18.26.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fu3ZpUvuqc5Y2diQhV37dA%2Bg5%2B8Ej9mVVvHW5RJgj%2B%2B%2Fzl6K%2BaXu4a3SQQUYazdAfiJnMfDzf1DQPcs66jkjabzye5WZd0lPKSG7lZ7PGBcM38p2UiPWVgLtNUMpxlLpBXVOFlZ5DwG5yA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 80bc8e55fb189153-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE_8EHdPOW7K-fzXGYkS-QI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame E02F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEK3724Y8f_BV528NdlxJh34&google_cver=1

43 B
842 B

35ms
33ms

Image
image/gif

37.252.171.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEK3724Y8f_BV528NdlxJh34&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNX3SWx-xsobFZQJvVQxhG_3hG5EO9s0KngN-VoXTijBCaXfDBzkh97CfAhkES1EhjKZ2RFyzCb16R8iTtI0KTmthRKmg4S4-9R9190UxRrhL1SjijRybW75iK0stVwbir2p3Mf0JZeovrbUTjhkL6azB3I-fR4FH0pb1IGScmEQ7MuQuyA

Protocol

Server

37.252.171.52 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
an-x-request-uuid: 3a40314b-dcaa-4db7-93d9-45abd30eb8ca
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 217.114.215.133; 217.114.215.133; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEK3724Y8f_BV528NdlxJh34&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame E02F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3ODU0NjMwNzg2MTM4NTMxOQ%3D%3D

170 B
244 B

42ms
34ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3ODU0NjMwNzg2MTM4NTMxOQ%3D%3D

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
an-x-request-uuid: cc74fef4-ca5b-42ff-99ec-c60172bf4e06
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3ODU0NjMwNzg2MTM4NTMxOQ%3D%3D
x-proxy-origin: 217.114.215.133; 217.114.215.133; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame 4EA3 23 KB
8 KB 21ms
21ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 393791
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 7799
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 20 Sep 2023 03:32:25 GMT
expires: Thu, 19 Sep 2024 03:32:25 GMT
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame EEB3 4 KB
655 B 29ms
28ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&slotname=5358168653&adk=2565328533&adf=3262652976&pi=t.ma~as.5358168653&w=1200&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&format=1200x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&rpe=1&resp_fmts=3&wgl=1&dt=1695574534735&bpp=2&bdt=389&idt=287&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=195&ady=227&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=2&uci=a!2&fsb=1&xpc=2pOp7TX9MF&p=http%3A//docplayer.net&dtd=295

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 14:55:54 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 24 Sep 2023 16:55:36 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame EEB3 2 KB
892 B 22ms
21ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:26:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16173
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:26:03 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/ Frame EEB3 23 KB
9 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:29:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15984
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
server: cafe
etag: 9583221549990841032
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:29:12 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame EEB3 3 KB
1 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:33:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1303
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 16:33:53 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame EEB3 20 KB
8 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16148
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:26:28 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EEB3 182 KB
57 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Sep 2023 16:55:36 GMT

GET
H3 200 9041af033b7a690ba70e3134a2c135bf.js Show response
www.gstatic.com/mysidia/ Frame EEB3 36 KB
15 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9041af033b7a690ba70e3134a2c135bf.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f9d88352b286107f60c320c4c088f718c2a3a273818cd61901edb7f235a9339

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 12:26:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 275373
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15189
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 20:01:29 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 20 Dec 2023 12:26:03 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/9697244555934136908/ Frame EEB3 7 KB
7 KB 23ms
22ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9697244555934136908/14763004658117789537?w=600&h=314

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8f19f3572bf66995550c7ace5fbb33774f774f245208b599ed2317a94e400ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 01:25:06 GMT
x-content-type-options: nosniff
age: 142230
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6800
x-xss-protection: 0
last-modified: Thu, 24 Nov 2022 03:57:39 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 22 Sep 2024 01:25:06 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/6695213842642436243/ Frame EEB3 2 KB
2 KB 25ms
24ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6695213842642436243/14763004658117789537?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f81316c3cbda80a570bcfebe9e01e1a06a80f2566fe3015fd9e83e2e35378121

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 07:12:18 GMT
x-content-type-options: nosniff
age: 121398
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2425
x-xss-protection: 0
last-modified: Fri, 24 Jun 2022 15:49:30 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 22 Sep 2024 07:12:18 GMT

GET
H3 200 kgPu8ucFjQWm9sPwItG3xGC9C84b-jPcUt_enD3F6OI.js Show response
pagead2.googlesyndication.com/bg/ Frame 4EA3 38 KB
14 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/kgPu8ucFjQWm9sPwItG3xGC9C84b-jPcUt_enD3F6OI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9203eef2e7058d05a6f6c3f022d1b7c460bd0bce1bfa33dc52dfde9c3dc5e8e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 06:58:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 208630
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14666
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 21 Sep 2024 06:58:26 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8E22 0
20 B 126ms
124ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5511103408843&version=m202309120101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8E22 0
20 B 124ms
123ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5511103408843&version=m202309120101&ct=77&x=1&cor=13835048498425477000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
ad.doubleclick.net/dbm/ Frame 8E22 16 KB
12 KB 136ms
54ms Script
text/javascript 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/dbm/ad?dbm_c=AKAmf-AsAITYQf8ZhEO2xyJIb4tzUD4SASAHkQ3QguXfpGZlmZ1xkj6QweYCinWA-oxA8c3jkkvmb2eLIwq7v9AzmMi4_dt0DOtegnOh_hhCaQga-eJ2EFkzufm7CFWcQkC8a3QXGYvtcp97oL0q46M509T3werjazaMPZ0hkufvABbn8589sdI&cry=1&dbm_d=AKAmf-BH3Jize9LOLg7IZdN39gL7TZBPvYjA99SJrAuiy_QEQzyp_JoMHxRMfSDuwdMR0XBY_S8UWY5vOFGDmpj7fa935wS3dChUdMRJSiPKpu0SDFMmt2thJ8MX-xMexckPxV9v1K8SahaEfwRrUB65XW3prycpvSU-C3L5fEl7yLWBlDMss5BYyKELq2L31355tSzu7VKm45cebfT170PijLtzZQpy72noS-W9HktIlhmf336Esaq7wk9J_Jjmw7vDFdD5zo-X-SD6Dn-o0ocvU1ObdIrhAyxul1C99Sqj-jGmwzxK-1SjNNwker542wsHmrW3Y8nMtV2rlAsYMCQ10VVVV6ebcI120-PaOH03IIiptM4bNX6ZHdfeNhwKI5RBmoeFeloh28f4Kea3D6hCfX7EaYx1rjw5GGbVVvTX21-z_M5RNvghHvQI6qvv8uDrO-pxc2jtMbZNh66C5NlUxmzPOdk40jvCBa0HrnKBOE2q5JmGk-iOUOQG0WmKywacCwu2avYGIkrH_1UhTI1Zd_vw9sYKKTjIDKajjERM7S5pA3PO9FVXXCodRY0m5B2R4ruXUBiwVvr7GfqrorTQNR2KpV_3kuw84adgecdSiFCQ6bmQePrrEWZO_hj7DC07Vlektb3Ify-LnsEwlVcyzp7a3stnUBNOou8AeqWz7hTRuGefxfirFweckjfgZOCNGTESc-WRFjg6sBk3zhkTxiiiZIoCW0B4uKa--StPUDH7LUyDAo988c-31LI5yfBmXbw1Zv4MTxyCNaoUmOfajdsIX_zoJI75GPdrFAZDJvm9LOAfDC96H_nbnaJW6PWxKQZH2CUlthcuT0RJwTooXd4s0CJ6Eo-VmyfKCPRDDwC-DfUlJmNCm68nMKA-lrQljlN4ABdJqtVf65-FcTJoTVViFp7cldxYw3q9SXZ-Awyz2RehlsDgMFkPZ9RNRcvIPsStsa4-t8Oa64OvhvWk5XxIp8RwqJE5JcFBWMpsH8R_2zTBPSPcypz40W_a0MhX5z3tPmrc1fwXt7Zb2zCweS9mK5ockvGDxsEskg7ZxFNONRv7kyDbytm3rOOiCGU5KiiktWFbZa9ucKpixsiBwf49mD2buMKBHFqE52kIgxxE7H-5913yatn6IxpJw3RHpGGpyaGIaW_YoHPIferqUcaeMe3TqQ_UVpiBQtc-Pxv0A34bJkYGMhbklrLjcSuo7gBmmLeqRY08CvrBURsVZl6wVEY1vzxI42MxNkCWSS9ojl7QiRb5u9PMPDWl-BD5prv2U1y_r-jeVZiqqiO5K1kazGYTf2S_AkoQr-yjNU-AQRgC83sJ_eUNKEb5TqRw3uAwDMOwxXh9om-Q7eSxdtLx2SlFPBtOede46geszCMYWJO6fWYExM7k5LlcXj1p7y1Js1Ndn1vJp9bZagMvwzABOHDASmj9oY3HmJ_rpcy85x-MAl8NQKHQ1JSiAFGEGqwxK0Jq2fVzq_RwVZ9cO7k3A_yyumKk2yhLTsdGhLgrgSqDJs8suexTZeulDboPgT4gnoADdrUA6LI-8Rx6H7-p3hpkCdHiGyi3QvJKfwA3UoWMYA9Kzc599Ob09GA5XIiheDe4qRGmU_JcfkYhgflIGA1mtVIDKd0zv1Ei6ij5imlmEyzWNZpsGzkoJdVP5qu_tQOyg-f6sECU0e7IrI1JaO3dhRoBFfAkOQzaNkZqM2B1KdA2GUUSIBz6Sa-dHB2DiqF0k2YmHU67gf3vWA1F16gmSeky5iGbrAci64LZKTzAeFj_uryUPMauNVBUFbbxnoW5Pv9nO1aTNLyZz0GBaowlhETwQX7carYFMBhJFHzgGsiQ8Az557iXasrOman0CB1NaO_uheLkWqXHPMkFVU_t_B9sI7K0Uk-WjJpmzKPN_gAfzGtEhw5Zrrt6yYL14JYt7SQB-5_FgC_fQzXP_uCvTVOgBS2pGWepG5P5V9pNl6ZeQXfb29r4oLhqiUagHCkbSTMYYtQea1X0dt0KKdOGl6RGPbTjv04NtyxnNzEirVVUWJxr1WHICSl2ZziA_MeJyTkxwK_NF4C-vt7KjyUGj19oJjiTG22uN2HBcIYyWSxx2q-aFwodgPfu835Vdk5yNAhUMoimtmWBYt_TSRZPGwi2GWfw8zQggId1984thwoyxsuxkWY72mxVGN0oQBWKzSlJLULYMAwE-BZjH5hSPTIG3cWH6PuOVxl8TxNqh3u6Szf4PrG8MZ4bxi5zvjMgq5Pvbjwu9yWlSiTAZ0KyF3BQ4To7ylcmXBAB0OTmnb8Y4s0Ybww3cV24I4rhJCVfd2LVIstcYyI0AS2FeBEEIG_ANg5IH_njg-DsYcOhqUxOQu-nOFMPfTAzqqp4pBhSmiphcywZ6DMcXx4t-djQz_b06FP04l2iVhajw-ICSeiFtW6GpHGPI6Nc3x6ZWtZNKJWAVS5yNEH70nV0ib20YrPtthuXhFFANnsVw4MzDZ7dlrlVpxAD69wqFb7SeK6AuemZ2MqVNw920OkwpcQE5J9XMx1c34UrFFEpeZxA8Euj8JPlyk3R567nt2MMxkHwd40i_GisNy28oaK4YIWwz2iViAGQSEYKX7FnxnXR3Er3lDs7wgeKspaChogmeyq171v4dXo_oZTUa7m68fvv2Hb8UwT5FDStL99k0e2Xfe5b0Uh7aeDs1yo17WUEdFf3itonPEhrvR87NCAcKS8mzHo5l8nWC00jkKvu9hWJL4tBWCrX6JsGgkm_ilIBrQSNEjS5QtXJStVt2WCKCqRueSuZhJ7wpitHHjS2L4hzbeU9sc_nHIQbVwXOyu_Ue201WxysQBEZaKM-z6M2W_C6QKpjpsN3lgshe0dpOv6kEaYi5P43-Q9BlU3V2B9pzk4I4Exv_O7PTAbdz0LxvsVlaJrtL777LlxmxO6Jw4iPqjyLzYfSv_JPc_1lv31r58PdFJOxxlLH-vRYbvVmZuob-x_CFY17cKWPqMh0h0CMgIHdN0LaLsgVHQa2wZk8yAXTNXFK2ABdONJnPGZDmbtUBULaSOlAGdy5gFHrNT0xnw-FC21pqQd6m1WgNC8VhA_blu4jOmiLVRHRJV3ave7mHmwC1BgqUyh5CDXhXDEtNWZHsaRCwC-QuOSxTqHb_8Kh64O8t-YqXhQ61Cetc6LUVdn2jAhtnQK55p6kwWco_kmTJqi91Xq-xmBo_BvE8QgCT_qPHjEC_S0CoRhVUfLJM8l69nBI2FLc_yPkinVHNDXwvcTXtkVaoJCOxmowbC0NtAuudPCxoK-R0kw5ILHPg9eYRiMYbQDpSgdslqxKSJVwUU535Wv8_7Dh-lNrwupb6g2qzMeLZswumWFimJMF_KA0ZuiVx3KUutd1250iY0laqMaBTmGkPlhDtBYG46Rj-JSwxJ4XOAQehnvxckpnMWkCxLqlHcD8l29XLjsUUDXgI24cVwgxIMlFuSEi4ZpJQxyvMhs7DrI7WkjPgPho-RVDUtw88R_Yf8BYTL1cup2QISr0UQJyiaqk5F6b6Z2Ee8PYojR_OwrVa1alvco4cCFxfdRpUVWZxxuK6U5jsvHFk3aVKPcbM2YG8On2ANH1wFSC1wclDkPhqVpe_0h0C4wKwy6XI1l3cXvrzxbBeouimTtnrxCCvUEYKlCSzV2asjo0kVU0MKBcaBs_K5IgvQw-3sHyvZy9Aj2vdjIDlOUKSgbu88bpsLnbPkvZGXu7AJ5WS01nr-pn4QkM3Fhlm3zxQuUO-VrTdm6g-DOQCPqQqG_WEeNSbm4ZXWqFpicSZPWczXKl68rCjVPocy1C8FRsqHb_NPOypvNCeGURKoUsXPQtGKiJ5RKDzoWI8oiDSowmHq0WBTXo9Iz4x0b6JtY_lCcLNVkkOSfJYDLc9lUuO2HnPldrO6LRPlrI267_D4EMhiUgUZ0M9DwMLJRTV-lHW2Nq2CYOXi9_Izh2ISg&cid=CAQSOwBpAlJW5EgOa6nXPpoT5SBiAnTY9bDFi1Kse5S5ExrWEq65P1klsuqzNO3MonEC-i0SPVEKA75I2QaCGAE&dv3_ver=m202309120101&rfl=http%3A%2F%2Fdocplayer.net%2F&ds=l&xdt=1&iif=1&cor=13835048498425477000&adk=521587874&idt=152&cac=0&dtd=12

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f6.1e100.net

Software

cafe /

Resource Hash

4f27bf429e38e43179f08ab552136ae9f3618a2d69aec702ddc12ba2e2bc8472

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12349
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame EEB3 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 64dfa6bc6bd1d59dbaabb9c16eb6cda42788a2fb8dd7ea598486cd1b2b9ded28

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4D74 624 B
242 B 67ms
65ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNXetO4-cKeWzlaE4qfPudlu_3GQWv3D75BBU4KyTf80ZdJnsQQcRvqAdXhWcGE5pPNVTabkpj1Q1FbSYrSvSCUvbQC1kUXyoA44HRQOUn0CMG-5g42U54cCntiM_--VXhTz4UgfJi9UQMSopIHXxmC_x52igaW6nZ8c98m-67Qgh4qcLSg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=724619058&pi=t.aa~a.1856579592~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280&nras=3&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=2808&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ZE5btzgJdW&p=http%3A//docplayer.net&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=724619058&pi=t.aa~a.1856579592~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280&nras=3&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=2808&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ZE5btzgJdW&p=http%3A//docplayer.net&dtd=17
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame A5D4 89 KB
31 KB 158ms
157ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4accbcd793680c2ea0a65714771ef37d5eeb42bdaedba9882dd0d78eae09e00e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31438
x-xss-protection: 0
server: cafe
etag: 13183557946744512263
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 24 Sep 2023 16:55:36 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame A5D4 3 KB
1 KB 30ms
28ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:33:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1303
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 16:33:53 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame A5D4 20 KB
8 KB 30ms
29ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16148
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:26:28 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame A5D4 0
0 32ms
31ms Image
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRMbOG-jp5L1Hw4e3fI3NngERG2qnFEUJhTN76CLZSp24_OA8MZjSJfY9dysgmtabycPlu_FYPFx_3KVEMumtnjw1FhDQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=724619058&pi=t.aa~a.1856579592~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280&nras=3&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=2808&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ZE5btzgJdW&p=http%3A//docplayer.net&dtd=17
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A5D4 182 KB
57 KB 61ms
60ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Sep 2023 16:55:36 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A5D4 42 B
63 B 124ms
122ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DBlYFXnPBuQaQFNUC8ezF8cExv4J5eIciuJMpsl3fKvwj_0aeWvkAvAJDp9KFvSetMwHUYYm-9YxFeF6a6tuogLo9XLbJZlZMPhHTm3535HtOrPDw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A5D4 0
20 B 124ms
121ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=16600164269326141109&x=1&ct=77

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 7681 640 B
262 B 73ms
72ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNXXsZdgKToYAr9HQuaJF75LNWYmhRlTS7CHB3x-FPeT99Hd9y0Nv0AkT4krtWXO4xhFdwz9l2SAG4YFXzDMT93E_0TDc9QUY2mpl2GHnZFsBau85uKVhL58SS6iLF9Qmo6EQHn1SNGLEXW4zgkt2NLd9RDNXNa42c8rzJ22rcYVM6sCpKM

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame D941 89 KB
31 KB 247ms
247ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4accbcd793680c2ea0a65714771ef37d5eeb42bdaedba9882dd0d78eae09e00e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31438
x-xss-protection: 0
server: cafe
etag: 13183557946744512263
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 24 Sep 2023 16:55:36 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame D941 3 KB
1 KB 32ms
30ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:33:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1303
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 16:33:53 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame D941 20 KB
8 KB 32ms
31ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16148
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:26:28 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame D941 0
0 40ms
38ms Image
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTzw5x-PForX1l4bKnH2V_RyhD6y3-anngHA1czJ-9oGENpJ0Z26uSzqyMstC9_MD76KxiP8EED4YrYII1cGfKqoEmnZg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D941 182 KB
57 KB 61ms
59ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Sep 2023 16:55:36 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D941 42 B
63 B 132ms
130ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Dw8Kt_Fe2_PpoorI6vaJeR_OB9FoUpNOMXEiQSDnncNaJsW4urV7IUmF0d0pnZQK_CtKskrQ36zpxPzXly_2sESUp-FahiErG8VYK3CitqQHMEcT4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D941 0
20 B 132ms
131ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=17820813235555063983&x=1&ct=77

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0D36 624 B
242 B 64ms
63ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNWLWsJBHBjK9VbA2uPCyB9OkCJbvzrsnjh-APPoJkFKS_MWD9HqfUkQEF4Nb1h74Dbg4vEyVfszz4zz5RXm03TSvz8u1cPuB30OsfvHW-OFvUUVtz4p9Ldag16Q_J5TWnvycEmOku56_qls2ojQ2Cb1dU0JW5zEa7DuIeeJxnMjfHcq8RQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=4290548377&pi=t.aa~a.2429977064~rp.2&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280&nras=4&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=810&ady=2988&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=iVZjO70nvz&p=http%3A//docplayer.net&dtd=22

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=4290548377&pi=t.aa~a.2429977064~rp.2&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280&nras=4&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=810&ady=2988&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=iVZjO70nvz&p=http%3A//docplayer.net&dtd=22
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 8AD1 89 KB
31 KB 229ms
229ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4accbcd793680c2ea0a65714771ef37d5eeb42bdaedba9882dd0d78eae09e00e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31438
x-xss-protection: 0
server: cafe
etag: 13183557946744512263
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 24 Sep 2023 16:55:36 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 8AD1 3 KB
1 KB 24ms
22ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:33:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1303
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 16:33:53 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame 8AD1 20 KB
8 KB 27ms
25ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16148
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:26:28 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 8AD1 0
0 43ms
41ms Image
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRHj2mETjk-VS4cnBRUumm45xyR7XSK-upqMriWnWMFxHxa4iu5oHfaNH9TMNGQcGIM2fzAMJkqJAFltPW4Pkw1qFVWww
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=4290548377&pi=t.aa~a.2429977064~rp.2&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280&nras=4&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=810&ady=2988&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=iVZjO70nvz&p=http%3A//docplayer.net&dtd=22
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8AD1 182 KB
57 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Sep 2023 16:55:36 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8AD1 42 B
63 B 122ms
120ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Coz0Ovx5JDZTj7L7D9aVxVbA-FScnqLyShZFB5_17XSuJZIZnSZjCcSUkrkLsm4d25dqutFQbcaZc37Cl_Qo3f89EZImHtfPANBKgkLVC-GvXi6Fs

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8AD1 0
20 B 122ms
121ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=101004284237522386&x=1&ct=77

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame EEB3 16 KB
16 KB 25ms
24ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 02:35:09 GMT
x-content-type-options: nosniff
age: 138027
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 22 Sep 2024 02:35:09 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame EEB3 15 KB
15 KB 27ms
26ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 04:06:52 GMT
x-content-type-options: nosniff
age: 218924
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 04:06:52 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 4D74
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE_8EHdPOW7K-fzXGYkS-QI&google_cver=1

43 B
736 B

52ms
51ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE_8EHdPOW7K-fzXGYkS-QI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNXetO4-cKeWzlaE4qfPudlu_3GQWv3D75BBU4KyTf80ZdJnsQQcRvqAdXhWcGE5pPNVTabkpj1Q1FbSYrSvSCUvbQC1kUXyoA44HRQOUn0CMG-5g42U54cCntiM_--VXhTz4UgfJi9UQMSopIHXxmC_x52igaW6nZ8c98m-67Qgh4qcLSg
Protocol: H3
Server: 104.18.26.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z%2B61WXsDV96p2OZk0OClLRBNSRiPFl8uCU4EnZRpUCdsWZDDM4XadiJlYxxJ798%2FJmBwQsiIHAvSqlr%2BmqyX83C9poc2fix7ARaPlUn3WbQJw3gO35%2FSgiBQvjWIEcTHAOpvrZct41e5bg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 80bc8e565b8e9153-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE_8EHdPOW7K-fzXGYkS-QI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 4D74
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZRBqCJVOjgVWoDBWPVk3owAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE_8EHdPOW7K-fzXGYkS-QI&google_cver=1

43 B
732 B

40ms
39ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE_8EHdPOW7K-fzXGYkS-QI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNXetO4-cKeWzlaE4qfPudlu_3GQWv3D75BBU4KyTf80ZdJnsQQcRvqAdXhWcGE5pPNVTabkpj1Q1FbSYrSvSCUvbQC1kUXyoA44HRQOUn0CMG-5g42U54cCntiM_--VXhTz4UgfJi9UQMSopIHXxmC_x52igaW6nZ8c98m-67Qgh4qcLSg
Protocol: H3
Server: 104.18.26.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GccRHlbn5rKYnb3t8b10E4wfe9XLEgClM6ROHXRXDhdeqSzKgPBdrUXUG57ik2sVSga2AlvWbebvgXeh86EGpVo0KelYgoLn2Lpax2yGKrUEFmW%2Bkgw4RyiRDUseUszVIEQFjD6%2FD2HLbA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 80bc8e56ec869153-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE_8EHdPOW7K-fzXGYkS-QI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 4D74
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEAU0wpY7kUYkTDuNDqsNc_s&google_cver=1

43 B
844 B

39ms
37ms

Image
image/gif

37.252.171.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEAU0wpY7kUYkTDuNDqsNc_s&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNXetO4-cKeWzlaE4qfPudlu_3GQWv3D75BBU4KyTf80ZdJnsQQcRvqAdXhWcGE5pPNVTabkpj1Q1FbSYrSvSCUvbQC1kUXyoA44HRQOUn0CMG-5g42U54cCntiM_--VXhTz4UgfJi9UQMSopIHXxmC_x52igaW6nZ8c98m-67Qgh4qcLSg

Protocol

Server

37.252.171.52 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
an-x-request-uuid: 5405fafa-031b-432f-9104-83a28ef3499f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 217.114.215.133; 217.114.215.133; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEAU0wpY7kUYkTDuNDqsNc_s&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4D74
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3ODU0NjMwNzg2MTM4NTMxOQ%3D%3D

170 B
188 B

35ms
35ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3ODU0NjMwNzg2MTM4NTMxOQ%3D%3D

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
an-x-request-uuid: 944e94f3-2778-4ed6-b407-7e290a6b01a8
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3ODU0NjMwNzg2MTM4NTMxOQ%3D%3D
x-proxy-origin: 217.114.215.133; 217.114.215.133; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 206 file.mp4
r4---sn-4g5lznls.c.2mdn.net/videoplayback/id/b682cd7a5b5d3655/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1727110536/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 9219 337 KB
0 47ms
23ms Media
video/mp4 2a00:1450:4001:26::9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: docplayer.net
URL: http://docplayer.net/204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:26::9 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
Range: bytes=0-

Response headers

expires: Sun, 24 Sep 2023 16:55:36 GMT
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-9011108/9011109
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 9011109
last-modified: Tue, 08 Aug 2023 11:35:04 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://googleads.g.doubleclick.net
client-protocol: quic

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 7681
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFOYCnEfamBEwZIR6S__tH8&google_cver=1

43 B
274 B

155ms
133ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFOYCnEfamBEwZIR6S__tH8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNXXsZdgKToYAr9HQuaJF75LNWYmhRlTS7CHB3x-FPeT99Hd9y0Nv0AkT4krtWXO4xhFdwz9l2SAG4YFXzDMT93E_0TDc9QUY2mpl2GHnZFsBau85uKVhL58SS6iLF9Qmo6EQHn1SNGLEXW4zgkt2NLd9RDNXNa42c8rzJ22rcYVM6sCpKM
Protocol: H2
Server: 34.98.64.218 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFOYCnEfamBEwZIR6S__tH8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 7681 43 B
146 B 191ms
134ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNXXsZdgKToYAr9HQuaJF75LNWYmhRlTS7CHB3x-FPeT99Hd9y0Nv0AkT4krtWXO4xhFdwz9l2SAG4YFXzDMT93E_0TDc9QUY2mpl2GHnZFsBau85uKVhL58SS6iLF9Qmo6EQHn1SNGLEXW4zgkt2NLd9RDNXNa42c8rzJ22rcYVM6sCpKM
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 7681
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEB2I-lq9WInI6njf_Ml6M5Q&google_cver=1

23 B
165 B

90ms
45ms

Image
image/gif

2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEB2I-lq9WInI6njf_Ml6M5Q&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNXXsZdgKToYAr9HQuaJF75LNWYmhRlTS7CHB3x-FPeT99Hd9y0Nv0AkT4krtWXO4xhFdwz9l2SAG4YFXzDMT93E_0TDc9QUY2mpl2GHnZFsBau85uKVhL58SS6iLF9Qmo6EQHn1SNGLEXW4zgkt2NLd9RDNXNa42c8rzJ22rcYVM6sCpKM
Protocol: H2
Server: 2.16.97.41 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

expires: Sun, 24 Sep 2023 16:55:36 GMT
pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEB2I-lq9WInI6njf_Ml6M5Q&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 7681 23 B
165 B 133ms
49ms Image
image/gif 2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNXXsZdgKToYAr9HQuaJF75LNWYmhRlTS7CHB3x-FPeT99Hd9y0Nv0AkT4krtWXO4xhFdwz9l2SAG4YFXzDMT93E_0TDc9QUY2mpl2GHnZFsBau85uKVhL58SS6iLF9Qmo6EQHn1SNGLEXW4zgkt2NLd9RDNXNa42c8rzJ22rcYVM6sCpKM
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.97.41 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

expires: Sun, 24 Sep 2023 16:55:36 GMT
pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 0D36
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE_8EHdPOW7K-fzXGYkS-QI&google_cver=1

43 B
734 B

44ms
43ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE_8EHdPOW7K-fzXGYkS-QI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNWLWsJBHBjK9VbA2uPCyB9OkCJbvzrsnjh-APPoJkFKS_MWD9HqfUkQEF4Nb1h74Dbg4vEyVfszz4zz5RXm03TSvz8u1cPuB30OsfvHW-OFvUUVtz4p9Ldag16Q_J5TWnvycEmOku56_qls2ojQ2Cb1dU0JW5zEa7DuIeeJxnMjfHcq8RQ
Protocol: H3
Server: 104.18.26.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5bwvOISMZXIqiTSIXaw9Z8YRvIaeiWWXnN3aJfeIsOX%2F4nNSvnBS3jpIISEFbTUvrP7PJrcZLMhSPkld3rvEjCEzzqMTwobxUaQ91elpqnevHLnLC2ROJwIkY98J1sverYNInrY13uZIfw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 80bc8e567bb09153-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE_8EHdPOW7K-fzXGYkS-QI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 0D36
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZRBqCJVOjgVWoDBWPVk3owAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE_8EHdPOW7K-fzXGYkS-QI&google_cver=1

43 B
736 B

34ms
34ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE_8EHdPOW7K-fzXGYkS-QI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNWLWsJBHBjK9VbA2uPCyB9OkCJbvzrsnjh-APPoJkFKS_MWD9HqfUkQEF4Nb1h74Dbg4vEyVfszz4zz5RXm03TSvz8u1cPuB30OsfvHW-OFvUUVtz4p9Ldag16Q_J5TWnvycEmOku56_qls2ojQ2Cb1dU0JW5zEa7DuIeeJxnMjfHcq8RQ
Protocol: H3
Server: 104.18.26.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fBQLT3BeECgL4QYxhS7vEuwCRbCJANTnWPYdB7rCngbJ0nPrydcl7CKWf%2BL%2B7cGLHebD%2Ffi9%2B4nLV1Etg2R1gRv7ykzsIPkI48BDvAGlBa091SWc6ihO1RSVoOW6BVNuwDphIs3De4xQ2A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 80bc8e56ec8a9153-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE_8EHdPOW7K-fzXGYkS-QI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 0D36
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEAU0wpY7kUYkTDuNDqsNc_s&google_cver=1

43 B
844 B

33ms
33ms

Image
image/gif

37.252.171.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEAU0wpY7kUYkTDuNDqsNc_s&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNWLWsJBHBjK9VbA2uPCyB9OkCJbvzrsnjh-APPoJkFKS_MWD9HqfUkQEF4Nb1h74Dbg4vEyVfszz4zz5RXm03TSvz8u1cPuB30OsfvHW-OFvUUVtz4p9Ldag16Q_J5TWnvycEmOku56_qls2ojQ2Cb1dU0JW5zEa7DuIeeJxnMjfHcq8RQ

Protocol

Server

37.252.171.52 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
an-x-request-uuid: 500242f5-0421-4bae-8490-1437268564d8
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 217.114.215.133; 217.114.215.133; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEAU0wpY7kUYkTDuNDqsNc_s&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0D36
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3ODU0NjMwNzg2MTM4NTMxOQ%3D%3D

170 B
188 B

35ms
34ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3ODU0NjMwNzg2MTM4NTMxOQ%3D%3D

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
an-x-request-uuid: 3e9bad6f-73a1-4c34-b685-f218bfc983f4
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3ODU0NjMwNzg2MTM4NTMxOQ%3D%3D
x-proxy-origin: 217.114.215.133; 217.114.215.133; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8E22 41 KB
13 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/dbm/ad?dbm_c=AKAmf-AsAITYQf8ZhEO2xyJIb4tzUD4SASAHkQ3QguXfpGZlmZ1xkj6QweYCinWA-oxA8c3jkkvmb2eLIwq7v9AzmMi4_dt0DOtegnOh_hhCaQga-eJ2EFkzufm7CFWcQkC8a3QXGYvtcp97oL0q46M509T3werjazaMPZ0hkufvABbn8589sdI&cry=1&dbm_d=AKAmf-BH3Jize9LOLg7IZdN39gL7TZBPvYjA99SJrAuiy_QEQzyp_JoMHxRMfSDuwdMR0XBY_S8UWY5vOFGDmpj7fa935wS3dChUdMRJSiPKpu0SDFMmt2thJ8MX-xMexckPxV9v1K8SahaEfwRrUB65XW3prycpvSU-C3L5fEl7yLWBlDMss5BYyKELq2L31355tSzu7VKm45cebfT170PijLtzZQpy72noS-W9HktIlhmf336Esaq7wk9J_Jjmw7vDFdD5zo-X-SD6Dn-o0ocvU1ObdIrhAyxul1C99Sqj-jGmwzxK-1SjNNwker542wsHmrW3Y8nMtV2rlAsYMCQ10VVVV6ebcI120-PaOH03IIiptM4bNX6ZHdfeNhwKI5RBmoeFeloh28f4Kea3D6hCfX7EaYx1rjw5GGbVVvTX21-z_M5RNvghHvQI6qvv8uDrO-pxc2jtMbZNh66C5NlUxmzPOdk40jvCBa0HrnKBOE2q5JmGk-iOUOQG0WmKywacCwu2avYGIkrH_1UhTI1Zd_vw9sYKKTjIDKajjERM7S5pA3PO9FVXXCodRY0m5B2R4ruXUBiwVvr7GfqrorTQNR2KpV_3kuw84adgecdSiFCQ6bmQePrrEWZO_hj7DC07Vlektb3Ify-LnsEwlVcyzp7a3stnUBNOou8AeqWz7hTRuGefxfirFweckjfgZOCNGTESc-WRFjg6sBk3zhkTxiiiZIoCW0B4uKa--StPUDH7LUyDAo988c-31LI5yfBmXbw1Zv4MTxyCNaoUmOfajdsIX_zoJI75GPdrFAZDJvm9LOAfDC96H_nbnaJW6PWxKQZH2CUlthcuT0RJwTooXd4s0CJ6Eo-VmyfKCPRDDwC-DfUlJmNCm68nMKA-lrQljlN4ABdJqtVf65-FcTJoTVViFp7cldxYw3q9SXZ-Awyz2RehlsDgMFkPZ9RNRcvIPsStsa4-t8Oa64OvhvWk5XxIp8RwqJE5JcFBWMpsH8R_2zTBPSPcypz40W_a0MhX5z3tPmrc1fwXt7Zb2zCweS9mK5ockvGDxsEskg7ZxFNONRv7kyDbytm3rOOiCGU5KiiktWFbZa9ucKpixsiBwf49mD2buMKBHFqE52kIgxxE7H-5913yatn6IxpJw3RHpGGpyaGIaW_YoHPIferqUcaeMe3TqQ_UVpiBQtc-Pxv0A34bJkYGMhbklrLjcSuo7gBmmLeqRY08CvrBURsVZl6wVEY1vzxI42MxNkCWSS9ojl7QiRb5u9PMPDWl-BD5prv2U1y_r-jeVZiqqiO5K1kazGYTf2S_AkoQr-yjNU-AQRgC83sJ_eUNKEb5TqRw3uAwDMOwxXh9om-Q7eSxdtLx2SlFPBtOede46geszCMYWJO6fWYExM7k5LlcXj1p7y1Js1Ndn1vJp9bZagMvwzABOHDASmj9oY3HmJ_rpcy85x-MAl8NQKHQ1JSiAFGEGqwxK0Jq2fVzq_RwVZ9cO7k3A_yyumKk2yhLTsdGhLgrgSqDJs8suexTZeulDboPgT4gnoADdrUA6LI-8Rx6H7-p3hpkCdHiGyi3QvJKfwA3UoWMYA9Kzc599Ob09GA5XIiheDe4qRGmU_JcfkYhgflIGA1mtVIDKd0zv1Ei6ij5imlmEyzWNZpsGzkoJdVP5qu_tQOyg-f6sECU0e7IrI1JaO3dhRoBFfAkOQzaNkZqM2B1KdA2GUUSIBz6Sa-dHB2DiqF0k2YmHU67gf3vWA1F16gmSeky5iGbrAci64LZKTzAeFj_uryUPMauNVBUFbbxnoW5Pv9nO1aTNLyZz0GBaowlhETwQX7carYFMBhJFHzgGsiQ8Az557iXasrOman0CB1NaO_uheLkWqXHPMkFVU_t_B9sI7K0Uk-WjJpmzKPN_gAfzGtEhw5Zrrt6yYL14JYt7SQB-5_FgC_fQzXP_uCvTVOgBS2pGWepG5P5V9pNl6ZeQXfb29r4oLhqiUagHCkbSTMYYtQea1X0dt0KKdOGl6RGPbTjv04NtyxnNzEirVVUWJxr1WHICSl2ZziA_MeJyTkxwK_NF4C-vt7KjyUGj19oJjiTG22uN2HBcIYyWSxx2q-aFwodgPfu835Vdk5yNAhUMoimtmWBYt_TSRZPGwi2GWfw8zQggId1984thwoyxsuxkWY72mxVGN0oQBWKzSlJLULYMAwE-BZjH5hSPTIG3cWH6PuOVxl8TxNqh3u6Szf4PrG8MZ4bxi5zvjMgq5Pvbjwu9yWlSiTAZ0KyF3BQ4To7ylcmXBAB0OTmnb8Y4s0Ybww3cV24I4rhJCVfd2LVIstcYyI0AS2FeBEEIG_ANg5IH_njg-DsYcOhqUxOQu-nOFMPfTAzqqp4pBhSmiphcywZ6DMcXx4t-djQz_b06FP04l2iVhajw-ICSeiFtW6GpHGPI6Nc3x6ZWtZNKJWAVS5yNEH70nV0ib20YrPtthuXhFFANnsVw4MzDZ7dlrlVpxAD69wqFb7SeK6AuemZ2MqVNw920OkwpcQE5J9XMx1c34UrFFEpeZxA8Euj8JPlyk3R567nt2MMxkHwd40i_GisNy28oaK4YIWwz2iViAGQSEYKX7FnxnXR3Er3lDs7wgeKspaChogmeyq171v4dXo_oZTUa7m68fvv2Hb8UwT5FDStL99k0e2Xfe5b0Uh7aeDs1yo17WUEdFf3itonPEhrvR87NCAcKS8mzHo5l8nWC00jkKvu9hWJL4tBWCrX6JsGgkm_ilIBrQSNEjS5QtXJStVt2WCKCqRueSuZhJ7wpitHHjS2L4hzbeU9sc_nHIQbVwXOyu_Ue201WxysQBEZaKM-z6M2W_C6QKpjpsN3lgshe0dpOv6kEaYi5P43-Q9BlU3V2B9pzk4I4Exv_O7PTAbdz0LxvsVlaJrtL777LlxmxO6Jw4iPqjyLzYfSv_JPc_1lv31r58PdFJOxxlLH-vRYbvVmZuob-x_CFY17cKWPqMh0h0CMgIHdN0LaLsgVHQa2wZk8yAXTNXFK2ABdONJnPGZDmbtUBULaSOlAGdy5gFHrNT0xnw-FC21pqQd6m1WgNC8VhA_blu4jOmiLVRHRJV3ave7mHmwC1BgqUyh5CDXhXDEtNWZHsaRCwC-QuOSxTqHb_8Kh64O8t-YqXhQ61Cetc6LUVdn2jAhtnQK55p6kwWco_kmTJqi91Xq-xmBo_BvE8QgCT_qPHjEC_S0CoRhVUfLJM8l69nBI2FLc_yPkinVHNDXwvcTXtkVaoJCOxmowbC0NtAuudPCxoK-R0kw5ILHPg9eYRiMYbQDpSgdslqxKSJVwUU535Wv8_7Dh-lNrwupb6g2qzMeLZswumWFimJMF_KA0ZuiVx3KUutd1250iY0laqMaBTmGkPlhDtBYG46Rj-JSwxJ4XOAQehnvxckpnMWkCxLqlHcD8l29XLjsUUDXgI24cVwgxIMlFuSEi4ZpJQxyvMhs7DrI7WkjPgPho-RVDUtw88R_Yf8BYTL1cup2QISr0UQJyiaqk5F6b6Z2Ee8PYojR_OwrVa1alvco4cCFxfdRpUVWZxxuK6U5jsvHFk3aVKPcbM2YG8On2ANH1wFSC1wclDkPhqVpe_0h0C4wKwy6XI1l3cXvrzxbBeouimTtnrxCCvUEYKlCSzV2asjo0kVU0MKBcaBs_K5IgvQw-3sHyvZy9Aj2vdjIDlOUKSgbu88bpsLnbPkvZGXu7AJ5WS01nr-pn4QkM3Fhlm3zxQuUO-VrTdm6g-DOQCPqQqG_WEeNSbm4ZXWqFpicSZPWczXKl68rCjVPocy1C8FRsqHb_NPOypvNCeGURKoUsXPQtGKiJ5RKDzoWI8oiDSowmHq0WBTXo9Iz4x0b6JtY_lCcLNVkkOSfJYDLc9lUuO2HnPldrO6LRPlrI267_D4EMhiUgUZ0M9DwMLJRTV-lHW2Nq2CYOXi9_Izh2ISg&cid=CAQSOwBpAlJW5EgOa6nXPpoT5SBiAnTY9bDFi1Kse5S5ExrWEq65P1klsuqzNO3MonEC-i0SPVEKA75I2QaCGAE&dv3_ver=m202309120101&rfl=http%3A%2F%2Fdocplayer.net%2F&ds=l&xdt=1&iif=1&cor=13835048498425477000&adk=521587874&idt=152&cac=0&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 275348
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 20 Sep 2024 12:26:28 GMT

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame 8E22 12 KB
4 KB 87ms
27ms Script
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1695574535848857&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fad.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCkb8zB2oQZdnnM6qH1fAPz7iIkAam5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE4wFP0D66GYnxaZlrzE1bXHeH7agzXa7lqGQ2s6X82CU3o0bgijvxi5xrxmMViY1i85gLdoGLCZqrqJt3iz_jnKO0eEC3G48NnKVvknwEJTVwappp30UGYcMOOP6QwaXiSihn5vq5eCHGRpda6OXpicnIHBuXwsJQWeYEj09daUvbIbbljwcZ2Lg_Rxzzd7mKnJDOzxp1xRWw_ysSxkGjvA_jTa6YpQd6Jyp8kAwBktTks6D5ZcdWZWDB9Pi5C-Kw3zpbMa8b5CrUILV-40sl6tU2zg9a-9aTimq4TlbjneBxR0noLsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMImYeZr9vDgQMVqkMVCB1PHAJiEAEYASAAEgIUB_D_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW5EgOa6nXPpoT5SBiAnTY9bDFi1Kse5S5ExrWEq65P1klsuqzNO3MonEC-i0SPVEKA75I2QaCGAE%26sig%3DAOD64_2epWSa5dEH1g2P6ZuFGFyv9tgs7Q%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-C_YY4bcI84HFniOjTS0xWXFW1psxX47S3Mkk5Af9hONGuRPrYJKrupk4ftSwwJG93k0ldLVo8e9HCQUZwFbsmtOn2IDufizplL4VB0xuPZCknKcsOH0dU_2qcdr2l2pvEE6YNYrvMV-VL_Ce_ucZWCZP_qo5vRsDOwOo7aJ0YPH1DDrfA%26cry%3D1%26dbm_d%3DAKAmf-BqXrz6YkQmQLY42M56ie3HFPm7vB9NHb-RKvdyEkpuTntaDJtE71-JOjBPXJQ62vUWwdfr2LkYRRu-c_wOgBk75syLwJYUIvxBi3TbpQ0RimQ0nBzJ_ygjsqA_lyEekAaVke_3uZepNDGSXgXDmZzcu4TwKq-p1toGdSbxjuIeBkFcmPDnPNZjoti8sb3lHRnO4IT7W2NN5N4cUg063gvlV2-0RoXe9Qh-KpL0JSQS-LEaRHITLqKXuSdBKFSL8BDBkeuEZwQQhdfj7QeJS9AYmr5KRviI_W6UO5QFQlKFYSHs_hMQl4EuSmTbrctca1abOOZq5SN67WlcaqLEvP_j6_dzJU4qKXBEcRBiAczHtnZlze4xZQUsYlL3MUUlMOOBAymapEwaeUQZOQmKjK-guA-vo-61pJh7Ztxwjk9MfSS3ob1vea0IFO02EY2muF1Xy6pm5Yix8sURedOWgpJboMVPPyb8AsEX-3SsW96wq_FbC1R2ENJoz_FbBdyMN9m7vPZ9061xglpfku0nl3ihocdFDqmgk-GMwCQWeTIamaax3hJMVDB0uLTF7gKBU-i4e0cRxKNHzw3Ktz_UHLWBnKlxGu6oN5sao8D9lnMz05DDN40-B7CQos0H3c-XyVQ77wjxeAguTIwbC1v0Iqy71jLma3X8AJnaH9MjBV5Ah_qfBcLrBh3hMdvJ1G488zFBGmpB9O3co2AHAq0swja3FRCf1A%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=10950491&adf=3202966620&pi=t.aa~a.1856536719~rp.2&w=348&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=348x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100&nras=2&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1218&ady=1855&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Jli3MZYwUS&p=http%3A//docplayer.net&dtd=12
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 899863c73f086e15e8358347e45644c0cc205e93b6794d3eb1c2dcef84a4090d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:36 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4315
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame EEB3
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CK_2HB2oQZeeqCJ2_tOUPh5WDSKGViuVvrpLTrv0Qjq7X4pY5EAEg-dvsRmCVgoCAmAegAfixiZgByAEJqQJAf0VVdWOCPqgDAcgDywSqBM4CT9B3N-Q1l7ryIg01Aav_IXll64Rvlacs1Z7...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%228851364977062897750%22,%22debug_reporting%22:true,%22destination%22:%22https://emqx.com%22,%22event_report_window%22:%2225...

0
0

60ms
59ms

Fetch
text/css

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%228851364977062897750%22,%22debug_reporting%22:true,%22destination%22:%22https://emqx.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22318920952%22],%224%22:[%2209-24%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221865650512219168433%22}&andc=true

Requested by

Host: docplayer.net
URL: http://docplayer.net/204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"8851364977062897750","debug_reporting":true,"destination":"https://emqx.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["318920952"],"4":["09-24"],"6":["true"]},"priority":"500","source_event_id":"1865650512219168433"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 24 Sep 2023 16:55:36 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"8851364977062897750","debug_reporting":true,"destination":"https://emqx.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["318920952"],"4":["09-24"],"6":["true"]},"priority":"500","source_event_id":"1865650512219168433"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js Show response
pagead2.googlesyndication.com/bg/ Frame D405 37 KB
14 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85de8e1049567f060665a08f4f9784af156edc484723473acd40953eb3bde550

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 07:19:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 380172
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14709
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 07:19:24 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4170 22 KB
8 KB 33ms
33ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 275348
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 21 Sep 2023 12:26:28 GMT
expires: Fri, 20 Sep 2024 12:26:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 58ms
58ms Preflight
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 24 Sep 2023 16:55:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A5D4 0
20 B 124ms
124ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8756042628703&version=m202309120101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A5D4 0
20 B 124ms
124ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8756042628703&version=m202309120101&ct=77&x=1&cor=16600164269326141000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A5D4 16 KB
12 KB 58ms
56ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AjlXRzCULyc6quB-Ie7_l8rV_hOrb9LWJk9JR15AyX_p99i4B7XYTP74VK4sLnTNVoJhi0kQp0fPUE2BKPo-XFOVsNWJrNelK0FX4snjJOqkDDJwIE9tTUdAU2ZqnewMi6IsHMM1xeQbSnG4HfnXnpmynuBqr3_f1E3cd8bgiujz5-zhc&cry=1&dbm_d=AKAmf-BkZq46Dt9IQBjaLvE1Jhim03ER4O6Xj9nhOqnJFUnH3cRIJ1WIXi-utIE7lrMBT8-GaAxblIusmCXHMdp6vCBaAZqFaUO-Bp48_YvUMxZPSLgDPXY9pgNwAV_7UzjhYeJ72BIqC67GFP86Q9g5q6bhHohLF54AFg3gN41lcox_q3q_IfJ19pnFlKvqrTfW5Md5tAIkN1BCC8rOw522pxjIkHf6AWQmTLexlI4pC8ONqmDHBAumArn6ePRcNKCHZnIFieewcTNBRvAMDfSQiGp5l83L2brs6tXSs5J-vw0PLe4_bo6-Hup3g6sDJtIl-fnpi1kER9IvTA_CGEI4KNGB5musBPUaFAsCx9RS_DS6R1SAZbo_fblyXEu4ej2kEEMLSqTFYRlg3hbGI9sCZFj56tHVqV0fyfYqiB4C100zV62QAOmrUxThB5UnJ67C2Z8GnfjiKo8-ygoifGDtLNivZnl27EW34yDVIN2Pu6wsZM-RG8NifArzE5mBFsQ2sevSPAOy0Gc3gIMQzuhm4I45hMvtKGrafg8Z7glEDXRKFLa9oVPybqCj7qHdqNfk53g8Giq6VWCzH-EV_uTY6i7pBwUL2mf4c9kruUXj5FoviZqv6Nqn1nuyDAWqGxZ7tp9_RvRHU684GCsvoSA_BMV80Oxd6VjwCnOce3xl6-TVOArS18m5eCi1RnpNVV9P4BNuPh9tXsVeqbuC3GToaMM_IGE430hfVrHvst9o6KBNoEsDQSgjG9g3nXBUqjyN0fZtJpnW_a0Ik6RtPnd6OBjoA2SiLCh4Qo3gzJfjeMEHQDorKU_BnT0Ksd5uj0J_3laDu3AgAJDY90HH1Hl67-JIVIqrbIumb_Go_e5lI-CdLskioo-a2DRn0AjN5iaFn7uBUWOHf2aP2qnAViYj-_a68uSKLV1oXRVRcQmQWILxwu4U67mn2k3HUO9ln1EIPRhpJoG0DfdwS9ZzUbdVVslQTXMzbXCaxQG3yHwvuIss4xT220fcUi3NgJGLFAHDrfOZtGJHgcd6eCmRu6yEyz294oYuzz4cCs5XNkYSuhbey5he22jwwQ9sdrkB6Y6L_SR2eojs2PJTlPlScZcg5mmhZzBVhJ1SJztJTH88rGGIIIwQDMKx3oCjylQ4FrWaQxRSNTSyJe2uBBfX4Trt-3QXUhyOSqWWCbbaPs6XvvhmAhV2PWCSQpqGpXsart_ZMZe-wCaIqTxFdj81JBiBhLbPp0Iv7jV4oFZ_9Z1oEPhqeZY6nYIH7n4dn9-IYriMPEItRqZKOaBivfeOVQQ43M5bGbNl_2vbPcfxfhHYNtKA1iTGTWhO91ApyqPVLCJxOYlWmXK_4J31AuRITh1gWF0_HVXKRyPTTD3idOSA8FEWOGP8Zi7h1461Xdi1PJSIAO_vpY0dOVvWB35dvmWQO-P05OxlRNTlPKQdcfMIRKco1mS-JdNoFC6FsxkKIzA0cpRmcMAdbLVFDRQLAoAjUnDDrM16pZ3L1tHyYJDKXSFmbUoK4MVlgShwVJByfhVeiMO4IdgHc2y5EQE3BpCZ30OZWK5NediyFtIw0M05_LticumAfgW5jeAoyD4dTQ9FFnfFLvkvIP6v1LwgjpSnQeZznR4qkf_GhqYQF_i4B4WA0BAlX9v6Q0pTsT42Yq45P1fAYdqPYxGVSDm1z4jr0g2fPCfVA-Yr03UE9a2FwTxBiEuK9qHqpAAjDtBnvhMlPrNrJ7CCxPBoMN_cDGVD7olunK0Rwwy7Azzth_8_ZoBVCKdsz2GuiSYRbJDLqe0AA79Z1CMwX2KYnSfDsQMH5OAnf2Cx_l3wl-XikGc4I3rhvJWIu9qs51Wqg-VtQKfrvPWuR93mO3DROEUyZ_S_UcOuHb98YTg8K6zvljPdxkmLPkr4DSmJX23AJ49gf6Lnsx2pqOKpdAX-svej-Jgqpc-2qQU31Vlq5ZaZktuxDIAW_ZD0lO9OVIReF_Ir6IlKrvPw1FBLn8exNplZjgqztMCL7KyFiO5WY1I0wJegursXSyEbuFW7OAN4X2BV6zW2_oJfdZGPtJ8LQIpElVZlRcL2xuQ6W-rCpNcUWTjLO6ydq_QgOdQ9guEN89PeH86fiMJg9z50KDG5w2Jv9CiBAevAhTb9EOOFH564WDeiwJY7EvMRvJ7oiUKLApk6HG5TO6aal7rpS2alqE8y3FKI1SxsFnyCeqnS5wc9RRy0f_izVg2PgqNMx8BVUGizNEYbiySJPsqYmZEctmEXA8sbO_HTqEJ8sJyGVu9fOG_xHTy3k_sLitW2_h6K6-9gHPQL2jVAJPH5l5y7OccZq6KKrXSIl6EYFP3Gcm_olpHIYN-giXfr-co5NISX5LamQvapNIV0Jlf7j2epdnxYz-JVIFXZjwJ-_GczZj2_tVa7DjloO604Xx_5ZHpzseoRUgijjM78IbLDrm-4l7xpE69NQVKGL2cVhR4cNyE13vAUpuSZxM1WArw6JXU0k3bVkbQXMruDCRAW_cx6IwWNjvyD6OAywLYxU-tl8MNdiwarQN8Hm9LubVuWBAilCbWmCDkomzI3IqItz0D8KyIrSNN4pIFvDkKF615Nkpwt6sW33dQPzOksWRpCuqJyU4In7zK3MX9yijUoVvDAWiJarLkrG5rMsXrDRWToC6Sw6Ame1ezkRvACPqoAOK5Yyuh3Tiz51EVj3-cfX1TPvn8ChVq8M_8fk1y8MDjP-fVq1p84NQ6CyLG1HOKt5w6WWNP-LmJXJijDDORKi-Ays6PLRbAYsQPCdXIyfrqLfiYmICIIOyb1_TX00S3K5V5aCpI8i6vv67-xBK0Q69FReXYoAJ-ZS6Y7BmhlA0AnX_9VN98nrtcVEQwY5hhMSMuBTHhQock6nv9o6jTIz8kcYVK6fxDOnWWI8OZ5P3B-NU8wwyRnvNh-ii3uFrdN-hR1tCUUu1Mo-9fhVkGpLiHozQNBWp6YMY09RD8o48OtolTJ0XSitgFeRS0yS9ZJDD_Z8QTLsMXc2eyiUfMTr4kRh9z1Pvi_4VDfHElLyBTXd-UqmgMHNfrSGW6OSqkhx-WmgzQYIUVr-uybwxHLGmDQDpa1nWHigvIPSulnNmcKDkAGMNkUnIvTMZkufhTldBEL6JIY6IJ9S_MlVyhJ0yaGHRbVgyKZAeJAnnx4nIOZ0lRZb6TuBBiKIzc6bEJgbJwMOaiP6swBHtgPvYtBmedsXy8Ch4b05LIiDFzKHCtUBhBT6s-5z2FE_mCsLSAYgytTpNc1kHQqQHHJ80LSNPu63RhwOd1ewo5GZlQHznUCCLRpOnaaOvnvzZMOHbn_Gp5w899u8RL9AZuNeIzLk_Ue1ZyTaoANHyUWrtqV8mSnMaOOvd9RedJj9LpOqJqbIThTWzIMVyWyW461YFtYn916ZvUslrvsDsREtJQlj93PJG1V06Ro8I6BBbgEDntB9yTLANxFUUKdLiWX-9GPNC-RdQfhr9N28urjHo1zdZkCqkv_jghcysmsdh_oLu6MS9Y7-Vbffg8gzidEYHl5u9RjZsYdSCmIk2EoNtv6RxBZZedV4Vz71v0Oj_BbSXv9BtFGGNcMfc4XHSwR3qOvGAlUgR_Xg47TJ77Kv7uNXdQ5tX4HucvbZQjov8KC70CaKK6zm7pbxs9mYC4c21CjIlOAgb5zGRa3xUINQxYsTw93WcGaCfvfYLvM979i7f9sdsCMRypXHimDHLeWIsJXL4YQybVBWLANSuk2F68EfpuQWFDoU7N79rTLU4xtJClFtTH8YVDrSYoqCdgQEBPatHT27HnVIVcEbRJ4dfoFDm9-JhacTPlXXqKBjgIGTB0BNFlTCdBfNUmnp-HD6b2yZ9Qvz8jZgDucKyOqM68vnGqQsOU8k1RWbhmkNF5rhGOgycoYj09mSsFa2osROSUD3P7Nji3uYFQv3a03YYX1JQ&cid=CAQSOwBpAlJWNr7Lq-steX9dQ184bASuqgBT31VX84gMnCIlcgJz5e9TAe7LgtBmItqcqDcM_XNk6WV5Ax9HGAE&dv3_ver=m202309120101&rfl=http%3A%2F%2Fdocplayer.net%2F&ds=l&xdt=1&iif=1&cor=16600164269326141000&adk=1877897943&idt=202&cac=0&dtd=20

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

152de9aa5a0d0b640578c99a5f859924aff22668c51010374205c5da2dc51a76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=724619058&pi=t.aa~a.1856579592~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280&nras=3&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=2808&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ZE5btzgJdW&p=http%3A//docplayer.net&dtd=17
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12060
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A0C1 624 B
242 B 66ms
63ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNXCimgOJqExviEHHcmZRcGkV6CyhnAPqf-WnPdsJtMtE_CaDuqX1q0xYdekEAfJsnLV7WU-3R3KuMZap_1jRrZz79S3iNfvFyxo3bU-KKORyoVCvz0jYrlXJadNpzcY6E6Bl5I7PkMEAnMumi_JRZ1EpNMCn0J2zkhyh46ZKAYD5PgULhY

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame EDB4 89 KB
31 KB 84ms
82ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4accbcd793680c2ea0a65714771ef37d5eeb42bdaedba9882dd0d78eae09e00e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31438
x-xss-protection: 0
server: cafe
etag: 13183557946744512263
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 24 Sep 2023 16:55:36 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame EDB4 3 KB
1 KB 22ms
20ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:33:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1303
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 16:33:53 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/ Frame EDB4 20 KB
8 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230920/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16148
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Oct 2023 12:26:28 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EDB4 182 KB
57 KB 45ms
43ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a018a841b6975de20578c7c63607d4529281ae923f4c3ba172cb4d1d5e7c5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58105
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695209545430561"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Sep 2023 16:55:36 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame EDB4 42 B
63 B 124ms
121ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Ci3gzD-TboSBkEQWIP6tdkGcIaIY_Kw7Joo2YkVYiS9Bij0YGEvQ4-Bp9NRtMDiswLoJ6gFv5jUzd8MYT6yy8FhmuRPH8hm8RWwp44b1UeHSBANTE

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EDB4 0
20 B 123ms
120ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=12507797150336202854&x=1&ct=77

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

request.php Show response
hal900028.redintelligence.net/ Frame 8E22
Redirect Chain

https://hal900028.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=a85b61c703&subid=&uid=11779aefb9af234c&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900028.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=a85b61c703&subid=&uid=11779aefb9af234c&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

144ms
97ms

Script
application/x-javascript

88.99.165.19
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900028.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=a85b61c703&subid=&uid=11779aefb9af234c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fad.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCkb8zB2oQZdnnM6qH1fAPz7iIkAam5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE4wFP0D66GYnxaZlrzE1bXHeH7agzXa7lqGQ2s6X82CU3o0bgijvxi5xrxmMViY1i85gLdoGLCZqrqJt3iz_jnKO0eEC3G48NnKVvknwEJTVwappp30UGYcMOOP6QwaXiSihn5vq5eCHGRpda6OXpicnIHBuXwsJQWeYEj09daUvbIbbljwcZ2Lg_Rxzzd7mKnJDOzxp1xRWw_ysSxkGjvA_jTa6YpQd6Jyp8kAwBktTks6D5ZcdWZWDB9Pi5C-Kw3zpbMa8b5CrUILV-40sl6tU2zg9a-9aTimq4TlbjneBxR0noLsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMImYeZr9vDgQMVqkMVCB1PHAJiEAEYASAAEgIUB_D_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW5EgOa6nXPpoT5SBiAnTY9bDFi1Kse5S5ExrWEq65P1klsuqzNO3MonEC-i0SPVEKA75I2QaCGAE%26sig%3DAOD64_2epWSa5dEH1g2P6ZuFGFyv9tgs7Q%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-C_YY4bcI84HFniOjTS0xWXFW1psxX47S3Mkk5Af9hONGuRPrYJKrupk4ftSwwJG93k0ldLVo8e9HCQUZwFbsmtOn2IDufizplL4VB0xuPZCknKcsOH0dU_2qcdr2l2pvEE6YNYrvMV-VL_Ce_ucZWCZP_qo5vRsDOwOo7aJ0YPH1DDrfA%26cry%3D1%26dbm_d%3DAKAmf-BqXrz6YkQmQLY42M56ie3HFPm7vB9NHb-RKvdyEkpuTntaDJtE71-JOjBPXJQ62vUWwdfr2LkYRRu-c_wOgBk75syLwJYUIvxBi3TbpQ0RimQ0nBzJ_ygjsqA_lyEekAaVke_3uZepNDGSXgXDmZzcu4TwKq-p1toGdSbxjuIeBkFcmPDnPNZjoti8sb3lHRnO4IT7W2NN5N4cUg063gvlV2-0RoXe9Qh-KpL0JSQS-LEaRHITLqKXuSdBKFSL8BDBkeuEZwQQhdfj7QeJS9AYmr5KRviI_W6UO5QFQlKFYSHs_hMQl4EuSmTbrctca1abOOZq5SN67WlcaqLEvP_j6_dzJU4qKXBEcRBiAczHtnZlze4xZQUsYlL3MUUlMOOBAymapEwaeUQZOQmKjK-guA-vo-61pJh7Ztxwjk9MfSS3ob1vea0IFO02EY2muF1Xy6pm5Yix8sURedOWgpJboMVPPyb8AsEX-3SsW96wq_FbC1R2ENJoz_FbBdyMN9m7vPZ9061xglpfku0nl3ihocdFDqmgk-GMwCQWeTIamaax3hJMVDB0uLTF7gKBU-i4e0cRxKNHzw3Ktz_UHLWBnKlxGu6oN5sao8D9lnMz05DDN40-B7CQos0H3c-XyVQ77wjxeAguTIwbC1v0Iqy71jLma3X8AJnaH9MjBV5Ah_qfBcLrBh3hMdvJ1G488zFBGmpB9O3co2AHAq0swja3FRCf1A%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D10950491%26adf%3D3202966620%26pi%3Dt.aa~a.1856536719~rp.2%26w%3D348%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D348x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%26nras%3D2%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1218%26ady%3D1855%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D5%26uci%3Da!5%26btvi%3D2%26fsb%3D1%26xpc%3DJli3MZYwUS%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D12&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=3846793093027&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=10950491&adf=3202966620&pi=t.aa~a.1856536719~rp.2&w=348&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=348x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100&nras=2&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1218&ady=1855&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Jli3MZYwUS&p=http%3A//docplayer.net&dtd=12
Protocol: HTTP/1.1
Server: 88.99.165.19 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.19.165.99.88.clients.your-server.de
Software: Apache /
Resource Hash: eb298daaccdbf666ae8ef0d2320cbd853c1dd39348827227aca8184e96d00ebe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 53980700112083004444994012457028
Connection: close
Content-Length: 1331
Expires: Sun, 24 Sep 2023 17:55:37 +0200

Redirect headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:37 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=a85b61c703&subid=&uid=11779aefb9af234c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fad.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCkb8zB2oQZdnnM6qH1fAPz7iIkAam5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE4wFP0D66GYnxaZlrzE1bXHeH7agzXa7lqGQ2s6X82CU3o0bgijvxi5xrxmMViY1i85gLdoGLCZqrqJt3iz_jnKO0eEC3G48NnKVvknwEJTVwappp30UGYcMOOP6QwaXiSihn5vq5eCHGRpda6OXpicnIHBuXwsJQWeYEj09daUvbIbbljwcZ2Lg_Rxzzd7mKnJDOzxp1xRWw_ysSxkGjvA_jTa6YpQd6Jyp8kAwBktTks6D5ZcdWZWDB9Pi5C-Kw3zpbMa8b5CrUILV-40sl6tU2zg9a-9aTimq4TlbjneBxR0noLsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMImYeZr9vDgQMVqkMVCB1PHAJiEAEYASAAEgIUB_D_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW5EgOa6nXPpoT5SBiAnTY9bDFi1Kse5S5ExrWEq65P1klsuqzNO3MonEC-i0SPVEKA75I2QaCGAE%26sig%3DAOD64_2epWSa5dEH1g2P6ZuFGFyv9tgs7Q%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-C_YY4bcI84HFniOjTS0xWXFW1psxX47S3Mkk5Af9hONGuRPrYJKrupk4ftSwwJG93k0ldLVo8e9HCQUZwFbsmtOn2IDufizplL4VB0xuPZCknKcsOH0dU_2qcdr2l2pvEE6YNYrvMV-VL_Ce_ucZWCZP_qo5vRsDOwOo7aJ0YPH1DDrfA%26cry%3D1%26dbm_d%3DAKAmf-BqXrz6YkQmQLY42M56ie3HFPm7vB9NHb-RKvdyEkpuTntaDJtE71-JOjBPXJQ62vUWwdfr2LkYRRu-c_wOgBk75syLwJYUIvxBi3TbpQ0RimQ0nBzJ_ygjsqA_lyEekAaVke_3uZepNDGSXgXDmZzcu4TwKq-p1toGdSbxjuIeBkFcmPDnPNZjoti8sb3lHRnO4IT7W2NN5N4cUg063gvlV2-0RoXe9Qh-KpL0JSQS-LEaRHITLqKXuSdBKFSL8BDBkeuEZwQQhdfj7QeJS9AYmr5KRviI_W6UO5QFQlKFYSHs_hMQl4EuSmTbrctca1abOOZq5SN67WlcaqLEvP_j6_dzJU4qKXBEcRBiAczHtnZlze4xZQUsYlL3MUUlMOOBAymapEwaeUQZOQmKjK-guA-vo-61pJh7Ztxwjk9MfSS3ob1vea0IFO02EY2muF1Xy6pm5Yix8sURedOWgpJboMVPPyb8AsEX-3SsW96wq_FbC1R2ENJoz_FbBdyMN9m7vPZ9061xglpfku0nl3ihocdFDqmgk-GMwCQWeTIamaax3hJMVDB0uLTF7gKBU-i4e0cRxKNHzw3Ktz_UHLWBnKlxGu6oN5sao8D9lnMz05DDN40-B7CQos0H3c-XyVQ77wjxeAguTIwbC1v0Iqy71jLma3X8AJnaH9MjBV5Ah_qfBcLrBh3hMdvJ1G488zFBGmpB9O3co2AHAq0swja3FRCf1A%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D10950491%26adf%3D3202966620%26pi%3Dt.aa~a.1856536719~rp.2%26w%3D348%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D348x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%26nras%3D2%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1218%26ady%3D1855%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D5%26uci%3Da!5%26btvi%3D2%26fsb%3D1%26xpc%3DJli3MZYwUS%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D12&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=3846793093027&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Sun, 24 Sep 2023 17:55:37 +0200

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D941 0
20 B 123ms
121ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5179565353031&version=m202309120101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D941 0
20 B 123ms
121ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5179565353031&version=m202309120101&ct=77&x=1&cor=17820813235555064000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D941 16 KB
12 KB 187ms
186ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AmFQhZLb5Zj9tQGFVy7VaoOB3jNwf5q_PN27-nZfjVrO-kV2hfsKQjCpLUFN5nAgNecW3XE7ctdC5xZV8rtQMfmZ7U37JyAA4C-6_rKmEe5ekcO0N-CMyy4pHnzav4oAUm_RPrrPRAH2rjWLrF1cMXLFncaOeoS4mOtUQk3LK8hWs7eHQ&cry=1&dbm_d=AKAmf-DO1kWd43GmUYh_vTcAFGUfiZCW3-pyjfVhb8ICwvciUq1wqb4y0ax_bYOCrgzG6vMSZfw7jphe8-9S1i3x5ubDb0jyFKfeuNBOm8t1CJqaR87b35yqCDNBNdq0758wjs4VMNNxaK9BiaJ5nASo3fxRQeAOm60f54ATxaBPJRsl2mnaABXAuYT7dZDJ2AH0wPKkXPxYmX1GNbhwI_xwEAP5SgPOP782yok8hO1TuiwL1B2DiUO9bVPePBv8WWA9_Wk4Qg-qS9-dvtpu4rgbWMP9MbvKvjUUiUTr-otm434bwSKPrzHbMZem3oWRjcHcbPlh-8mZgiCvKvCzzdX5wKiAi1EEyxKz8jHTs358niR6mFyMykYfJRmBId8IKTdWoTnfLzV72BYWIUaVGRopmt-q90gkvfKQjvAPH980WBlQTqijUJo1UyvlWvFURoZgfKKzlYgbLnX1LWpONKJEErIl694x2cO4R-e9Fk5CpvysfL7buXChj9aufPEQ7HHs6b2F8Fch1FOrtG9Bv56WyoI-a4f96b9wFx1UoS4T_31Gm4zCScUR1kKTbRGf3vpvUuVAMFV_z6TWh6ECIE5AIvSdYSYiaKkxFxyC0AaZOLdg4DsrgQSGKUEXchcJt4XH_EDQyPLdGzJsGRYOaLZRK6lW9br0ubZVlZOZQmX4Li6F6ehS90U1k-yqsZkThF3DCMe9hAOuR-AcD6Wbw8JbSZpAMlP4w-s2trWMNPxHIwu_13UQtWcc-YCYkJ4rvDVIxPe_dJSDKKbatBCVPw9A4QPyBUcWVFeWxwyooM8InjqRCY8VtR27K7qmP3aejNviqi1rufjTlFLhJUFTnWiin9mZf3xQsE6ghfKQXU_4UZnDtNiOzrcuNxhRkM-Lg0prb5VvIJ6BmX3aYPQ7Bf0Qjyv4ff2QUCr3hXQ_0d1zPhxqMUpels8gxiF8fh7aVNJjdUH_iMIYqPmohW-fC_IBbtMpbJThhgngCBeEQGu5LgYAGNLKXOphCMYVnncQFpHKvDe1-uOs56Dc5E1i5pKJ8Czx8qkB07-4o7cMSkrJJXHpm7wb4j1mBdQ5uw7ywDEEn1RwjUGLQclAmfPQpK56Zhc4IMe-NCqvUyDt_hIb1nVNK7rT4KQxae7PoSTtQol9lo_mz7fzybM4xGakhaElqDQCfiD6mNapvFpDe3s8KjDJjVUP8dmlI91Rc6ZYma7h0ki23fAZakfw6IWzPbebp_IWEHbQh0wiu086lvftwa1VvI5vCIueuu48WcpP5eU4u2WT--MevN6X26N9B27vsvzMqDozG8xW5E-PBuTDXDtHJoft4Wg67Vm70mXi_mriiWxJ_aClmOQiVaetuI148W76PwjpYX9JSygC7XxHZBwWxgByvhO95L_FNantv41d8CvcL6kykZ2-0KgnwL9M5s2o-5GzegmBCeY3-N6izfnb4tKg7cdSHOpiR17D0Vq4nGEWHCjlroNDHNBii7yDSnZboS5Oxi1NesZgOohc80aKZmTAw_19gYKphlKN1rLAiJyu8AuQJyYbg8grU3PSLA6ubKUWeNvF51TdumpJY1BtX29M4Huj2Nzmf6ujpmvlU6N5P4OX-tTi0GL5bcRArPk4_Y_E7AbbTxn8pA9aOO9ywVtXcCF_qh_7KEzAvAVYesigVvuAbCInIBFBdXruXeTRUQyht8wv95rc3sU2-c7eJvQw-QZfehy4qZUPRoEZqSN0K7xzlFjEMfIvFgOnXZbG9UQKDgMlsj7l5rw-lWPx_uYqi9YDWE5ViGdD4VMzA6SgzqEoZpaDK8mPsFxUz9lzinRbEWTuJQyZSh6299DRaMVxe4tJEKrA-avRFUeHJXkLipqdsiuZvIx7c43KuRZiGLdnYKlejcONP4FZT2fvAA2X3JvI8NspYMavlNIBfyGXv_GI-lDael6zMmEr7Q5D3JN6pob8eYykPJpsI_vGO_w14_ij8lQ0eJaBE9IWBSNfnMjiBoiQ1T526oe4yOzmyfs1KhGJsCMaBrldO03IUvdzvS-ILSvDX4lvmhTnMm8f73uggQx5NUkXVmuLoSlkjosapd8gWK0FHeK0CLFoiR7_d-XyAMMcV4s_M78DKz7FopWvx6gV6OgWom-pOlUn7Rj3s9-JbGD-VdhRZpq_JV5OEFwKkT_a2s9HGcNwNnYkNjNS_paN4giWOCjOZQKt-ysdA4TX8PwObU-6GvwkqMDPGQxGGYMOffGUPD7m8fMmgsF_ES8Qe-F_wwcbcluSnaZBuNdhFp2WShnMUP7TEbkR1MthD2soQ-3gNfIfvSTj_guRPZXwE-iLjRuh6aPCwn4fz7wahKOcVnKMk3zf6Tj9c5W3Fw_95qalCAAtpyyLpkVYkmDrQRjXyNpMXo9i3tQ-NlDmRQq5MxCPgHIT2hlL4bcCcblTMGjlcVEfRR96mPw3y5r1L8wAijovgkXoo8V6tw6-xJvyhxKATjArjJhNzvB02GOlxJz-nmzY9SQYRkh9FANVw9LOjCEoDWDRejgCvC7TL3tlR9_vkADT6honJAVBShCuctkwau57wthbX50sAkkehvpWiXITdvWJwK3aJ7ydrQt9_sVOWcYWcxJ57XvBlhCUpbOpj_f7cZOWuoaKCATjoJryg5WhLRvSrC-verCYzcI68gzHJVkHpVJIp81Gb-acpc5Si82punuMFX2ZZ0x_A7iVMtgOYd_E7u9AFSnBheZK66z96tppchDDcK0JgYQ8gtExlM4UDpeiPNYKX32s0QxKoXHtp4KJy4UiYQP3JBpGZ_vf2Gb68HSi3JDLfAJqqZjcA12FxWEFNbRo6L2VgJydojBn90etxCbEn-Oj586zDZ8s5jPEs5nf07trpHKDFzH4d63a9CbkfYxkj25k9KCkPArKu14Wj6IzJ_IF0_QvMDPw7Aaof8NgermiO_59wp0bJl20TZorB98PuIRTEo3fzAgIneLw-7GiRauY78KhELSHWcSj6A7oolyQAoPMmTZhJjjUqrqIpPHdLCj4rBLQ5i-6u2cgHkdDdcpEISy7olclIrp0v7AW-ql30oNI5p-it63Pg1KHNkYy5wgWHtP-Me4vjFEm_8ZD_2pilxDuaJBnF8CgzQnSx8J8oEc7H-C7dbPt2LQai-YyY4dskRLOzz3MSPlp01yWauR7_uIHsQqB4RSwl2hmD3OAU9AzAg1EUeOrvTp6m0cCrv-lbWPyjxhUTcM6hCrQh9OEdSX9yrDXj9sOfVIUB5oKV_VH09XBprCBxj1fBtq925dd3aOQOVKZTOngFsnrSoeQMNRFMIOfH_QtxVrzfjyvaV1chdwwnldIjU13iikXgLV1MkI009ZVAVjm3oKSP_rJcLUSqDVaqMNWgwwqUjy3H2WmjfRwCMWoZFMQ4f31hCookwURT4-xcbVtHNSg4yxf5jTXgrcTpC-iVeUmCWITxuWbD_5SK2mL0ZjSRkasJilqDmJoerpnD5XhbhuehLrZjraMlWgVSn3iv0VKkKHlp2_Jz8Sms6br2Cis1hTuUXtoBuvdHbsjNPIPy_AixmG1PAyXQUQde7lMIP6leaToSRGBlKNL3pty6kPaTzBUnBYbzywbKWm-026c9qqiMtTnpsCF1tQhuPD9dDngDdqeMNKw4rVRNZH-Qj_kH_I0cF9IXMPo__p48e52XdoV7nlTJHJEJb_nRMJKiQ-SqXl5WVbZtjYkJ4Cnme28n4ZJm_YG7BxIjrthNJT4YVzr_gx5wXS-AarMU4vO2VanzF7Zzj4aDu_YONbAO-VmbfXiuMQ4PMEf9brXRcxvvG3w2eL7QRpVKFcA_QnrIoHPZryTjcvoi0GM53nAWTy4HJIJdGLfjn7TX-mS2UcvEQRuO6uWhaYBmzxfwM5VCnj4avGjE1qDbLEJ4KInb7_Vqd-EfqEx_7GVQgQcasNFEKZH1g&cid=CAQSOwDICaaNK7cDtYM2eQkkvSB_2qqYmG9TSTsDqoGLdpVO_8ZWi2Iz4okgXdK6f3KMiQr4PdRvFsm45JuDGAE&dv3_ver=m202309120101&rfl=http%3A%2F%2Fdocplayer.net%2F&ds=l&xdt=1&iif=1&cor=17820813235555064000&adk=2988274607&idt=254&cac=0&dtd=9

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0c02d90437f37f3b2012185bbd76a6bd5f075ee4b6ec84c860f923cdddef7848

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12457
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8AD1 0
20 B 121ms
121ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7344199783998&version=m202309120101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8AD1 0
20 B 121ms
121ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7344199783998&version=m202309120101&ct=77&x=1&cor=101004284237522380

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 8AD1 16 KB
12 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BhKSjtX-jVZ0CuyFAdi_n1_NMflY7kHenP-Rk331Ra94Tzx_QDXs-uVko2oAL1HvfUNBxBSvf_F1JKUSPva9gcM_ySOf4QhJMnsVtb0H2BaaTM41yIwrEBO1udJzuhbUceCAPFv2cmbHh_IFrFOIr6eJU8xNG3h6VsXm3_xE2XWb_Zp3g&cry=1&dbm_d=AKAmf-CjT3Tw-KDXv9W4siLQz5myOEqS0_xHQU3xUkLPQ0jr2m6OrjcFcKcDntTL1bSGI2R4KbzgfrUFmVF4LaxMXgNY-82q3xUI1vrdTEAJBq1Ohlu5wpOPLY32LOcH4s40TLHmoOyUCdIENBKVUfswlxjGN9E18iWqoT_tuvZSYfxFi6VgXJZ1jDkSE--EDIdd4pBUzR1_E-vnSl6O8suExhH56PbejxWb0t9GOolXUmR3rOW_fWl1o1E48I9T-JirbzzB920qUfWidcSWsmOZ-lBtV3gqxh-OWlQDkRFZawkWoUzUzPoKGXhbngRitPkiIpRt9e7R9NAl6cKhOwKwaZpjnThmnRrab8kO4lA6DwEgXy_c0fRLxz3gNpNkW53E5cBF9mKulXZc6ywCnIDnm5yueN0vtlFI6KWCDnAwTXkt74WEgCAsrMrnXiKlBb_Vxyg0RDCCPUSr20CgKYoGb-_S-CjzN4ecvQ-cTVGfGgoXlr5ou4ExUUF1tkNVx3V6cKuvLsgFYmcsydxkqB5VzFhbzfD0RuWrK9kfvwwxag6_g8nKqGlhwpGwcQYVf4JuojzPPNYZc-F25j8XGhT7UQx0Km3TjzsKBmOFA_iSxj0R1OXprQca8KtPPbvngc34-yLDhtEkCpE0GGzw8tJPgFMVy3TQelNrA2gtt-nE-1fiQvoNcNkM1iLuSryaPAx5H_PdgJyHvlK3UQfXE8oS-2HlgqYE_g0uQ-VZKsOsZflMuSC4p1Fn_Qi2eMBib0GcYzl8CXOUNnqOViOLuKhJj9nwtpSdId6cPrHpP96e1EIL5q1fCeM3p-D6Js-oV98S0bSqvo3INGWoFtKmDezoMrgypvaOcUwPjOdREvu90zaaEzz30cE-MPT6cPkQCpWM6A4h6l1Y22UuDM-j2_rZReKEW-2N9co__WPm2fLjAKbBr-RRaxXyc9Te0bVvKdyvDpX2tRPXpSddX493_UII4OUzuT_vXUtuB4YDNlU-IoF81n0VaKjf6sqduWIXmWfLA7uQyEOxQMHpoxYvHOtuNaVHECYR_K7B_C5DS7fn2-Wz6U466P9ev4uINkvF7dqz50xZwGSC8aB6pM8026a3KWMvyyjj6sxrSoIwLhfpRQg5KPzXVl3K-TXMK-KyWnwHuYRRegDpHvvsDJTFeuz5JGrEuFATb-AdzpbtUUz2QWvQLx3EmE-a8CwIvJdhdWKTj6rGkni2IVT2spMHYpExkJNV3pcwB9-P7SvOgp2B8u_CDPzyhZlUGO64ow-JThMqRryq3O0C6E-2rgXCdvxNvL_4__k6CPuEcM757oj736tul_LwQFZKQFxhmMemid67bE6_EwxnwzOiW-EVLmc4hZR6cg5uo2S1lSLel425JczDulI_3joYZOb3_4oQrXlKClS-620dTlQPvPJWa-ldI4e7vki55LBeer3gClr--lhfDczVBLebfKWHe-y9kF05qAXz4EIlfcBwLSEKBXsHOSy41PY8QQTVhGvfH57XQvhH7lhvztsrKoAVDYYMtL28jUZwRVjqUWPhxwiqkbIPcdhn6WaocGb8IaRE5mFesnJdO3EHSXfCtSSp1PtKdNad-ln96AgPb81xkX3ywiCVgeL_XkH74x6k96_03LhOSG8V6uGIB8d1eARycPqphHRmi4FkrMeumlMNmn4tX2Oy-uZtt3IjJVSdV9IjnvFQKt7QBUS2Q7RUfyhvzg5Ec7nlTTF4oTPS6N0Ue7PznxArg0biACRPSqqQ5iFVfZNqUKNWwcocb7CbLXRivyGmEoC09R9BXGWfxbDafhu5U0f2YI8es6TPJ1aOo8L9dq67IslGvj3M5mYhSfjVhehRuhbsI2lhHn1HZCHxE4Hi5PTkZan4pmzocPwOD_pxhc7jSeI7DV01nXlwQYMO3Qth4Kvhcbr-PTbcJi0PlQ_YBvQ61uTt6g5rSYdjhTv2lkfdQqk0-0vXuOGPrnYqdDufzLiNPV0MeNK2kSCbc41FCTiRbJ6vJd6gsT4558MEh5iJWzfYgPcZFsK9qcdHw_m2AtgOl1b8TuLAN78v2_OAacHBbGdpxeEJpuatMoWnmnFLO-YFAa6OLJPbVx_G6nQQCIL67EOGu0eslTnq0f82O093Cds-rOGgvOuNBzfv30yi3v2u2et5VoIGd-ukNW1haTrhaLfSHg3h56UW_AOA1URvFGvrZkxvXXZRCpeUk9A2RYdX-ohnwTU2eWWUUKFSPKoN8bQIzDbhILjG6OEZB5phG8JES4Bu_UlRXa1Hhjy8aRpAXWGKkzax8mrfpmxiFwpeaNx6AXM24xyl4aVmghk3vAcKQ_645hHEpsge-qJ-JKVyOOSnF_gW-vy4WXaGqQqjtsFyw08M2703u55gEvs8_CoEdsr0jYgmzYvs1sh-WHkdowJPMMUIBaojCrMWfvu4LGZKLzawVB8Kf4tT1IjJi8JQo89ukvLE5f-teeRTKXRFK0fwpqmOOxAgcSukKVyiGAjA3YHXii9wSnpzO9IiZhCG9fsXva16uYJmBaeJy2Wwil6WKITFDp7UfVmxXo32aGu1AO4yg256-0rJerXjOs-nzmLXtUmXgsotoUXAWaCb5vcK6EIzkjCmVY_QRvoqsC8Q-OnH0xljudL4rq00LpGO4yRwMQvmgaGXt3OmSCaQv2HuwzKBfzmnvx_WmRui--B2LHzcwzJmXuRnXwZlBhAgwCKz-EJZqJ80v-h_ZOQw7mVgNOcpGMrbRaSxZLgVmOvUUynWQ5FtK_4M35p5NLS2v-f_LupCIYYxlUss0ClYjvvTklzrRuauv09S9wqS2l5xkuYecPBALc3sBiFFVqv7HtulB4524ChbXwQTCATm2dqSsl_R3J2GO2SLot3twjA2FGWPPRKZmm8ip7DvmzBHEqttiSZtu1Y0ASvP5mmI7pTg1nTRn2i2QM5GIW8Ait8OL8TX7mBOlxhwH8CEULCnHXrPvXT8lmpaSimkfr6rbGdgKpcnEpGCxmiRXBS2BqwJnUywtYkUt7ruWiESjLG1rYJtxc3sT_tsp6fj6ouSYdAet7m6r0cpcDi7WxWKQ1JU5TMUiUqBYWO_RxxKj7GqbBW1uXvi0CnsEC-v4Cs44oOF5IvQ8jmcxtsJ4bqI6D-EMED6-ykCx2mWwOWsCKyhZLUc5gLzDNVZG-K7HFEcJmjxo5Jp0nVF-tSh7NnVBxFJqVdWNyhqtRoOESiN8u58302mAcU6aSAw3qtmxALsWr631Edhv9Z043pbZ9nASc5Z2dobKF9LKqbkzbfDNOkztOLAgN7mydkSo7z5ax1JNSGRtTuzfJzkK_V_UGN8DUJql79Bmh6yJlw6OlH0qtsqSUTysk73VzOlCg98nVmWlfE9lRmkn7xN47IkOqjSEIU4BklKxeBpew9ABDbBIJB5fZ5WLUbVA03ZxTFSKR-OtEOTN-xME4SEY_St_ZUioapCkZQ_AYZypsd4ltCZpkqrCMm-nX4ZLnrennI2onOPWMG35xl9MU-F6DNpFPagop-IOZbFqJXhyngfZsSBfhVDUNt9XkqYGgvmF0CL7y4PiP0tXye72pysjlUFG69nlkOs12JWkgvz--wwFVNu4lm8S-AENbJawh-OaUi8YFvxZDL-gDdeHU2u0htaApqfYtbEB_fNdqGpAauPVh6X6VjOaUhF8ou9oRTE2dp2VC_rKM5-G1qw7tJJ0b_NdNQ3UqwIgFAVinGq71dDjnbzSsCHsHZuI0eH2oEqf2EmolIVWOJJSWJwDvG4KSFJgpTELM5Mvb6V0BUzDBXCkoI_c1c05gh00lmGJIh3oYzFoRtF0-InOpbcNWG8FMqMGnehLjkaCRO661FstkULTI29Qk1aCszvQaaIr15tshjmdCqqyo8lmyCiXISk9_4eyGP14Rcl2jOdlwF2sJHs13gUqoxPNzTcTw&cid=CAQSOwBpAlJWzja5vjlphRiTk1OcK_bRt4hNr1WLPRAPuQ-zRQIMwQUtVhW_B6rYDYqZLX4SJVDjXTxrAru9GAE&dv3_ver=m202309120101&rfl=http%3A%2F%2Fdocplayer.net%2F&ds=l&xdt=1&iif=1&cor=101004284237522380&adk=929882891&idt=237&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0a398297c4be24053643024c65cd05f8277ae65243d0bf9b0b16855479ffce72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=4290548377&pi=t.aa~a.2429977064~rp.2&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280&nras=4&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=810&ady=2988&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=iVZjO70nvz&p=http%3A//docplayer.net&dtd=22
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12217
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 tGcDLxZnxcZjneq6ZTfMhLSKmVRaNAcBIKHxIKG0fIc.js Show response
pagead2.googlesyndication.com/bg/ Frame 4170 37 KB
14 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/tGcDLxZnxcZjneq6ZTfMhLSKmVRaNAcBIKHxIKG0fIc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b467032f1667c5c6639deaba6537cc84b48a99545a34070120a1f120a1b47c87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:32:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1403
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14772
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 23 Sep 2024 16:32:13 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A5D4 41 KB
13 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AjlXRzCULyc6quB-Ie7_l8rV_hOrb9LWJk9JR15AyX_p99i4B7XYTP74VK4sLnTNVoJhi0kQp0fPUE2BKPo-XFOVsNWJrNelK0FX4snjJOqkDDJwIE9tTUdAU2ZqnewMi6IsHMM1xeQbSnG4HfnXnpmynuBqr3_f1E3cd8bgiujz5-zhc&cry=1&dbm_d=AKAmf-BkZq46Dt9IQBjaLvE1Jhim03ER4O6Xj9nhOqnJFUnH3cRIJ1WIXi-utIE7lrMBT8-GaAxblIusmCXHMdp6vCBaAZqFaUO-Bp48_YvUMxZPSLgDPXY9pgNwAV_7UzjhYeJ72BIqC67GFP86Q9g5q6bhHohLF54AFg3gN41lcox_q3q_IfJ19pnFlKvqrTfW5Md5tAIkN1BCC8rOw522pxjIkHf6AWQmTLexlI4pC8ONqmDHBAumArn6ePRcNKCHZnIFieewcTNBRvAMDfSQiGp5l83L2brs6tXSs5J-vw0PLe4_bo6-Hup3g6sDJtIl-fnpi1kER9IvTA_CGEI4KNGB5musBPUaFAsCx9RS_DS6R1SAZbo_fblyXEu4ej2kEEMLSqTFYRlg3hbGI9sCZFj56tHVqV0fyfYqiB4C100zV62QAOmrUxThB5UnJ67C2Z8GnfjiKo8-ygoifGDtLNivZnl27EW34yDVIN2Pu6wsZM-RG8NifArzE5mBFsQ2sevSPAOy0Gc3gIMQzuhm4I45hMvtKGrafg8Z7glEDXRKFLa9oVPybqCj7qHdqNfk53g8Giq6VWCzH-EV_uTY6i7pBwUL2mf4c9kruUXj5FoviZqv6Nqn1nuyDAWqGxZ7tp9_RvRHU684GCsvoSA_BMV80Oxd6VjwCnOce3xl6-TVOArS18m5eCi1RnpNVV9P4BNuPh9tXsVeqbuC3GToaMM_IGE430hfVrHvst9o6KBNoEsDQSgjG9g3nXBUqjyN0fZtJpnW_a0Ik6RtPnd6OBjoA2SiLCh4Qo3gzJfjeMEHQDorKU_BnT0Ksd5uj0J_3laDu3AgAJDY90HH1Hl67-JIVIqrbIumb_Go_e5lI-CdLskioo-a2DRn0AjN5iaFn7uBUWOHf2aP2qnAViYj-_a68uSKLV1oXRVRcQmQWILxwu4U67mn2k3HUO9ln1EIPRhpJoG0DfdwS9ZzUbdVVslQTXMzbXCaxQG3yHwvuIss4xT220fcUi3NgJGLFAHDrfOZtGJHgcd6eCmRu6yEyz294oYuzz4cCs5XNkYSuhbey5he22jwwQ9sdrkB6Y6L_SR2eojs2PJTlPlScZcg5mmhZzBVhJ1SJztJTH88rGGIIIwQDMKx3oCjylQ4FrWaQxRSNTSyJe2uBBfX4Trt-3QXUhyOSqWWCbbaPs6XvvhmAhV2PWCSQpqGpXsart_ZMZe-wCaIqTxFdj81JBiBhLbPp0Iv7jV4oFZ_9Z1oEPhqeZY6nYIH7n4dn9-IYriMPEItRqZKOaBivfeOVQQ43M5bGbNl_2vbPcfxfhHYNtKA1iTGTWhO91ApyqPVLCJxOYlWmXK_4J31AuRITh1gWF0_HVXKRyPTTD3idOSA8FEWOGP8Zi7h1461Xdi1PJSIAO_vpY0dOVvWB35dvmWQO-P05OxlRNTlPKQdcfMIRKco1mS-JdNoFC6FsxkKIzA0cpRmcMAdbLVFDRQLAoAjUnDDrM16pZ3L1tHyYJDKXSFmbUoK4MVlgShwVJByfhVeiMO4IdgHc2y5EQE3BpCZ30OZWK5NediyFtIw0M05_LticumAfgW5jeAoyD4dTQ9FFnfFLvkvIP6v1LwgjpSnQeZznR4qkf_GhqYQF_i4B4WA0BAlX9v6Q0pTsT42Yq45P1fAYdqPYxGVSDm1z4jr0g2fPCfVA-Yr03UE9a2FwTxBiEuK9qHqpAAjDtBnvhMlPrNrJ7CCxPBoMN_cDGVD7olunK0Rwwy7Azzth_8_ZoBVCKdsz2GuiSYRbJDLqe0AA79Z1CMwX2KYnSfDsQMH5OAnf2Cx_l3wl-XikGc4I3rhvJWIu9qs51Wqg-VtQKfrvPWuR93mO3DROEUyZ_S_UcOuHb98YTg8K6zvljPdxkmLPkr4DSmJX23AJ49gf6Lnsx2pqOKpdAX-svej-Jgqpc-2qQU31Vlq5ZaZktuxDIAW_ZD0lO9OVIReF_Ir6IlKrvPw1FBLn8exNplZjgqztMCL7KyFiO5WY1I0wJegursXSyEbuFW7OAN4X2BV6zW2_oJfdZGPtJ8LQIpElVZlRcL2xuQ6W-rCpNcUWTjLO6ydq_QgOdQ9guEN89PeH86fiMJg9z50KDG5w2Jv9CiBAevAhTb9EOOFH564WDeiwJY7EvMRvJ7oiUKLApk6HG5TO6aal7rpS2alqE8y3FKI1SxsFnyCeqnS5wc9RRy0f_izVg2PgqNMx8BVUGizNEYbiySJPsqYmZEctmEXA8sbO_HTqEJ8sJyGVu9fOG_xHTy3k_sLitW2_h6K6-9gHPQL2jVAJPH5l5y7OccZq6KKrXSIl6EYFP3Gcm_olpHIYN-giXfr-co5NISX5LamQvapNIV0Jlf7j2epdnxYz-JVIFXZjwJ-_GczZj2_tVa7DjloO604Xx_5ZHpzseoRUgijjM78IbLDrm-4l7xpE69NQVKGL2cVhR4cNyE13vAUpuSZxM1WArw6JXU0k3bVkbQXMruDCRAW_cx6IwWNjvyD6OAywLYxU-tl8MNdiwarQN8Hm9LubVuWBAilCbWmCDkomzI3IqItz0D8KyIrSNN4pIFvDkKF615Nkpwt6sW33dQPzOksWRpCuqJyU4In7zK3MX9yijUoVvDAWiJarLkrG5rMsXrDRWToC6Sw6Ame1ezkRvACPqoAOK5Yyuh3Tiz51EVj3-cfX1TPvn8ChVq8M_8fk1y8MDjP-fVq1p84NQ6CyLG1HOKt5w6WWNP-LmJXJijDDORKi-Ays6PLRbAYsQPCdXIyfrqLfiYmICIIOyb1_TX00S3K5V5aCpI8i6vv67-xBK0Q69FReXYoAJ-ZS6Y7BmhlA0AnX_9VN98nrtcVEQwY5hhMSMuBTHhQock6nv9o6jTIz8kcYVK6fxDOnWWI8OZ5P3B-NU8wwyRnvNh-ii3uFrdN-hR1tCUUu1Mo-9fhVkGpLiHozQNBWp6YMY09RD8o48OtolTJ0XSitgFeRS0yS9ZJDD_Z8QTLsMXc2eyiUfMTr4kRh9z1Pvi_4VDfHElLyBTXd-UqmgMHNfrSGW6OSqkhx-WmgzQYIUVr-uybwxHLGmDQDpa1nWHigvIPSulnNmcKDkAGMNkUnIvTMZkufhTldBEL6JIY6IJ9S_MlVyhJ0yaGHRbVgyKZAeJAnnx4nIOZ0lRZb6TuBBiKIzc6bEJgbJwMOaiP6swBHtgPvYtBmedsXy8Ch4b05LIiDFzKHCtUBhBT6s-5z2FE_mCsLSAYgytTpNc1kHQqQHHJ80LSNPu63RhwOd1ewo5GZlQHznUCCLRpOnaaOvnvzZMOHbn_Gp5w899u8RL9AZuNeIzLk_Ue1ZyTaoANHyUWrtqV8mSnMaOOvd9RedJj9LpOqJqbIThTWzIMVyWyW461YFtYn916ZvUslrvsDsREtJQlj93PJG1V06Ro8I6BBbgEDntB9yTLANxFUUKdLiWX-9GPNC-RdQfhr9N28urjHo1zdZkCqkv_jghcysmsdh_oLu6MS9Y7-Vbffg8gzidEYHl5u9RjZsYdSCmIk2EoNtv6RxBZZedV4Vz71v0Oj_BbSXv9BtFGGNcMfc4XHSwR3qOvGAlUgR_Xg47TJ77Kv7uNXdQ5tX4HucvbZQjov8KC70CaKK6zm7pbxs9mYC4c21CjIlOAgb5zGRa3xUINQxYsTw93WcGaCfvfYLvM979i7f9sdsCMRypXHimDHLeWIsJXL4YQybVBWLANSuk2F68EfpuQWFDoU7N79rTLU4xtJClFtTH8YVDrSYoqCdgQEBPatHT27HnVIVcEbRJ4dfoFDm9-JhacTPlXXqKBjgIGTB0BNFlTCdBfNUmnp-HD6b2yZ9Qvz8jZgDucKyOqM68vnGqQsOU8k1RWbhmkNF5rhGOgycoYj09mSsFa2osROSUD3P7Nji3uYFQv3a03YYX1JQ&cid=CAQSOwBpAlJWNr7Lq-steX9dQ184bASuqgBT31VX84gMnCIlcgJz5e9TAe7LgtBmItqcqDcM_XNk6WV5Ax9HGAE&dv3_ver=m202309120101&rfl=http%3A%2F%2Fdocplayer.net%2F&ds=l&xdt=1&iif=1&cor=16600164269326141000&adk=1877897943&idt=202&cac=0&dtd=20

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 275348
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 20 Sep 2024 12:26:28 GMT

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame A5D4 12 KB
4 KB 81ms
26ms Script
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1695574535930714&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC14quB2oQZZrnOIWV9AOK-aCIBKblvaBpvZOcp8kP8C4QASD52-xGYJWCgICYB8gBCakCYTFGH3HfsT6oAwHIA5sEqgTtAU_QUPJyh-48wh0deqfoq1zlQuKvbfBRnSGR5OW1EiRwY6sq7FpGnSuKkvI_kooH9MjkCF36K6jBaygQSgoVHbNxNG8fiy12fy3l_ye14Y7LeC3hskAqF5-O3THgWpC1xl8Q0r24-b9PWB37BPvQnRbJKf_86dmAlo2BS_1j4uJaproE_a1KcrrXDxW2p1wKKNdWXvXkjW5zKj_rqwmsX7OzDZFvgim6Meku5YsZIHygc7Qfa_2_SeXcO0TGrO3BTo0bxOsC9K6CXK4bKwXPWlh9vdMYuPh0v-k7VS4duYAqk0cv3yPl8HlfZh_JvsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMI2oaer9vDgQMVhQp9Ch2KPAhBEAEYASAAEgL6DvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJWNr7Lq-steX9dQ184bASuqgBT31VX84gMnCIlcgJz5e9TAe7LgtBmItqcqDcM_XNk6WV5Ax9HGAE%26sig%3DAOD64_0A3rVdtBLk2CzCN0KMgT09X4bdsQ%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-BYnBvTXDrgorqf0CaXqB191iBQOGXUHDnafJdI3JlxpSebHCPG3hElXbGkXdkrFzR5V8ScyVHM_Y3KiLrhejCUqEtHdvoVJf3j4u-bWa0LVedJJNdV0DZfJKuxiVwelhx6NQwNfn1Y_MzLLR0DWtUVyFZBl8hGu8ZVHyRCEfUUeauW1n8%26cry%3D1%26dbm_d%3DAKAmf-BV3GIrPH5nFbrmP9-zAVL2HpG4SSyh8RWN6N16nc6MP8eiHc4A1SVUT8J3qYOw6lcMVmwxim6w3X7b8VOvF09uBhYkJNtqvXm8GjKeb4WNOiDfG8Ivk_2YWsU8f9jGmMwt5ZGo6a1FouVMaqJ7vig3H48BbGO-TBJep9zeEx9GYoebMBOCN3pACyvyXVnnvNcPaEFlp2g9DKSs-Ll8SkZ9A27ZzwWcWpCM17cl3MxTdka9EMAn4nFfN1ybqlTCm7Ngq6Xp6E8kKOI7QfC2D4fDYW35jPx4BiyqfjOmIGSamrmsScaS4kTmh5y7BqrJopKIIf3rh5Xc3Vy9mFP4jQI4hV1FE5OaYt4LyQ0HkY5xaPtZKwJUDHd7SQOEKArh1f_zBMLPqPANC5ap9PMnG4jUehz5-t-0mpPkeLzS2XnSKLYW7YQ8EZ_L29R-aiWfhxMxbz_txLX1w5qV__DfE0puuXpP7qKvO2czOQVV65NO47yatnMB6IGfRRkQOhM2a8VL1KiTt4vvb_3dWd38NMCr5Aex2IPUt4v0AUMSpzpSCurnvgZHKKNrIhr5eibLurhjJXd8F0ToM7ejT3uezXhQ75UUCzZF0erpN6j3ONk0bgh7F2Zz_rSjAQy2bQHsKB7QOVsSXkwlcbawPhvIr3fT4SC3geXeb341OcsTxRCy5_SoNSGK3UT-k7U7qu5wlcqR6IcFdmwV-l06x2VOpik-XZWCjg%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=724619058&pi=t.aa~a.1856579592~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280&nras=3&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=2808&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ZE5btzgJdW&p=http%3A//docplayer.net&dtd=17
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 5c587d45815d17fb1d91994426e49a78300e3c0eda49e2de2022c3db9733e388

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:36 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4320
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4EA3 0
20 B 127ms
126ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=ByzIYCGoQZfP9E9KJhcIPkcueoAEAAAAAOAHgBAI&bg=!BQalBknNAAbbC4-Z-ws7ADQBe5WfONxrd5LDO-CuYJ6V4bf3Odw1JaOo3HqBiAmdt0maUJAu91hobDuyjmE3w9MJ0mP9AgAAASBSAAAAB2gBB5kDCL6zAT7Qu0xOmkZr3cNZUkJBuBAIgwXVH2rDHw32bh6sauzlfh38wa_yZiNwb3fDYiJDw8cIG3OVF7Qj8h4GgapYj2VwSOE77hQZHfsohsxXDDo-7SHngrZT4Y_kdcJXq-RasolBpasCwrtNO0AvZXtiQnXLzVarpO6jOTZFu98JtS1Y--TpjI6_d8GCtkcsWpC2aY7PmmtmaiDL2Yf-KGPLXtZCAVCGN1xFg9lDCX7Pha8-yIatJFBXsptbbA5kwuJ6uUtujh55-DZaERSG3QrXixnTTg89CD1plEY1u6je2g5TgDSGcG5zHUGfQ_hSsMIxh21NRuVF5oBCu8SzCwd7JTiqxq-_4iMSwaqH7V2QCEFlt1btv4HRLhMxbwCRpfjwuDioiOPOHv-VBrZx2r6Vm2E2ZfCwuOCprdPNkQ4Mrpw7j-dwLz1TUxbNZwYnRZNCSeAZ2KTmwmEvU8ulj-4MtIujymcxs4aIkbvM9ITDxmMv1hGdafz4AF-t9oa_g7RZ9EhKO7O9BDuWhmeECRMyKnJkfO4298Fj3_2H8vf4blM6_Nl491FWmLuuQleEFtyF5sQcmkT1mXUQK1h6e87Sbggj_2-d6yor0eDHr6mr-zdGoQD5DlRiEw5DkYBMfMpd9JpUk09KyctL-RKhahei-yVui_W64nJLUJKBsUJAl15gyw4V-QJk14Cfxm37uAkVm4-akXoutVqsfnC3JN6Sn2Xf982j9VQ4G4rwSXkEX9jcROjE5oKZzTRlk2-TrOM4eiqCmAfPOsSViQ0tTfjl6o9H8u2_uvDCLHK6USAKhBrdA5qQvlNPx6B-xME_xb9ue7eyWD6JuzonDrNcTZf1UGgPUc2gsP_RQXKEfXI650zWBaPcCGD1Zo-Z7YaT_mBrbjlwz7ApMEhvxY0-u1n2YRj21U-4WMjJ5qkvt5Jvttbm0CKHS22i1KzH3PK47NWO0DMJl7xCNIg-HecvF7y_5fJJUgoi2a-rAmmsd7MHXkNH4BUNJ1IhnfQyWI3hWTJErSYmb5O_

Requested by

Host: docplayer.net
URL: http://docplayer.net/204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame A0C1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBlN23IxzWXhvV39riZZtsQ&google_cver=1

43 B
735 B

45ms
45ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBlN23IxzWXhvV39riZZtsQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNXCimgOJqExviEHHcmZRcGkV6CyhnAPqf-WnPdsJtMtE_CaDuqX1q0xYdekEAfJsnLV7WU-3R3KuMZap_1jRrZz79S3iNfvFyxo3bU-KKORyoVCvz0jYrlXJadNpzcY6E6Bl5I7PkMEAnMumi_JRZ1EpNMCn0J2zkhyh46ZKAYD5PgULhY
Protocol: H3
Server: 104.18.26.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=epdyJOU5oi64pWXyGnCeSQwgpKzTfFQ%2FEJFc11ycdpwlddBBvEhm5K39FyyUD8LpZSidVd8UqmDc%2Fvh2M9BBd3rB6pcrrlUxd0Ux3lQmbVqBnGY6%2BIOpeHrEUPVItzkQkZKr1RZ3UwdpAw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 80bc8e57fd8a9153-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBlN23IxzWXhvV39riZZtsQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame A0C1
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZRBqCJVOjgVWoDBWPVk3owAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBlN23IxzWXhvV39riZZtsQ&google_cver=1

43 B
736 B

52ms
52ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBlN23IxzWXhvV39riZZtsQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNXCimgOJqExviEHHcmZRcGkV6CyhnAPqf-WnPdsJtMtE_CaDuqX1q0xYdekEAfJsnLV7WU-3R3KuMZap_1jRrZz79S3iNfvFyxo3bU-KKORyoVCvz0jYrlXJadNpzcY6E6Bl5I7PkMEAnMumi_JRZ1EpNMCn0J2zkhyh46ZKAYD5PgULhY
Protocol: H3
Server: 104.18.26.193 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UQm8WNTtcrzCJyl0%2Bd1SXGuagidGitPsc60yZ%2Bmnvg9%2Fo7bDWAlWBTtzWjEBRbN2GvyhIMa4dJ6Ah1Ki8eh3YZ1xwrF1yu4TLEIYn5ffGXfkev7eQC%2FQ3W5OUmAReqHV9YSaCHUFiCqZWA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 80bc8e583df89153-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBlN23IxzWXhvV39riZZtsQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame A0C1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEBjYyJSbq2l27iCJldzzngQ&google_cver=1

43 B
843 B

33ms
33ms

Image
image/gif

37.252.171.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEBjYyJSbq2l27iCJldzzngQ&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNXCimgOJqExviEHHcmZRcGkV6CyhnAPqf-WnPdsJtMtE_CaDuqX1q0xYdekEAfJsnLV7WU-3R3KuMZap_1jRrZz79S3iNfvFyxo3bU-KKORyoVCvz0jYrlXJadNpzcY6E6Bl5I7PkMEAnMumi_JRZ1EpNMCn0J2zkhyh46ZKAYD5PgULhY

Protocol

Server

37.252.171.52 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
an-x-request-uuid: b10970b0-bac8-48f5-bbcf-db9b759c5f35
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 217.114.215.133; 217.114.215.133; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEBjYyJSbq2l27iCJldzzngQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A0C1
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3ODU0NjMwNzg2MTM4NTMxOQ%3D%3D

170 B
188 B

32ms
31ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3ODU0NjMwNzg2MTM4NTMxOQ%3D%3D

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
an-x-request-uuid: 797fcc08-6497-4bf8-bf71-4e62de7e960f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjM3ODU0NjMwNzg2MTM4NTMxOQ%3D%3D
x-proxy-origin: 217.114.215.133; 217.114.215.133; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8AD1 41 KB
13 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BhKSjtX-jVZ0CuyFAdi_n1_NMflY7kHenP-Rk331Ra94Tzx_QDXs-uVko2oAL1HvfUNBxBSvf_F1JKUSPva9gcM_ySOf4QhJMnsVtb0H2BaaTM41yIwrEBO1udJzuhbUceCAPFv2cmbHh_IFrFOIr6eJU8xNG3h6VsXm3_xE2XWb_Zp3g&cry=1&dbm_d=AKAmf-CjT3Tw-KDXv9W4siLQz5myOEqS0_xHQU3xUkLPQ0jr2m6OrjcFcKcDntTL1bSGI2R4KbzgfrUFmVF4LaxMXgNY-82q3xUI1vrdTEAJBq1Ohlu5wpOPLY32LOcH4s40TLHmoOyUCdIENBKVUfswlxjGN9E18iWqoT_tuvZSYfxFi6VgXJZ1jDkSE--EDIdd4pBUzR1_E-vnSl6O8suExhH56PbejxWb0t9GOolXUmR3rOW_fWl1o1E48I9T-JirbzzB920qUfWidcSWsmOZ-lBtV3gqxh-OWlQDkRFZawkWoUzUzPoKGXhbngRitPkiIpRt9e7R9NAl6cKhOwKwaZpjnThmnRrab8kO4lA6DwEgXy_c0fRLxz3gNpNkW53E5cBF9mKulXZc6ywCnIDnm5yueN0vtlFI6KWCDnAwTXkt74WEgCAsrMrnXiKlBb_Vxyg0RDCCPUSr20CgKYoGb-_S-CjzN4ecvQ-cTVGfGgoXlr5ou4ExUUF1tkNVx3V6cKuvLsgFYmcsydxkqB5VzFhbzfD0RuWrK9kfvwwxag6_g8nKqGlhwpGwcQYVf4JuojzPPNYZc-F25j8XGhT7UQx0Km3TjzsKBmOFA_iSxj0R1OXprQca8KtPPbvngc34-yLDhtEkCpE0GGzw8tJPgFMVy3TQelNrA2gtt-nE-1fiQvoNcNkM1iLuSryaPAx5H_PdgJyHvlK3UQfXE8oS-2HlgqYE_g0uQ-VZKsOsZflMuSC4p1Fn_Qi2eMBib0GcYzl8CXOUNnqOViOLuKhJj9nwtpSdId6cPrHpP96e1EIL5q1fCeM3p-D6Js-oV98S0bSqvo3INGWoFtKmDezoMrgypvaOcUwPjOdREvu90zaaEzz30cE-MPT6cPkQCpWM6A4h6l1Y22UuDM-j2_rZReKEW-2N9co__WPm2fLjAKbBr-RRaxXyc9Te0bVvKdyvDpX2tRPXpSddX493_UII4OUzuT_vXUtuB4YDNlU-IoF81n0VaKjf6sqduWIXmWfLA7uQyEOxQMHpoxYvHOtuNaVHECYR_K7B_C5DS7fn2-Wz6U466P9ev4uINkvF7dqz50xZwGSC8aB6pM8026a3KWMvyyjj6sxrSoIwLhfpRQg5KPzXVl3K-TXMK-KyWnwHuYRRegDpHvvsDJTFeuz5JGrEuFATb-AdzpbtUUz2QWvQLx3EmE-a8CwIvJdhdWKTj6rGkni2IVT2spMHYpExkJNV3pcwB9-P7SvOgp2B8u_CDPzyhZlUGO64ow-JThMqRryq3O0C6E-2rgXCdvxNvL_4__k6CPuEcM757oj736tul_LwQFZKQFxhmMemid67bE6_EwxnwzOiW-EVLmc4hZR6cg5uo2S1lSLel425JczDulI_3joYZOb3_4oQrXlKClS-620dTlQPvPJWa-ldI4e7vki55LBeer3gClr--lhfDczVBLebfKWHe-y9kF05qAXz4EIlfcBwLSEKBXsHOSy41PY8QQTVhGvfH57XQvhH7lhvztsrKoAVDYYMtL28jUZwRVjqUWPhxwiqkbIPcdhn6WaocGb8IaRE5mFesnJdO3EHSXfCtSSp1PtKdNad-ln96AgPb81xkX3ywiCVgeL_XkH74x6k96_03LhOSG8V6uGIB8d1eARycPqphHRmi4FkrMeumlMNmn4tX2Oy-uZtt3IjJVSdV9IjnvFQKt7QBUS2Q7RUfyhvzg5Ec7nlTTF4oTPS6N0Ue7PznxArg0biACRPSqqQ5iFVfZNqUKNWwcocb7CbLXRivyGmEoC09R9BXGWfxbDafhu5U0f2YI8es6TPJ1aOo8L9dq67IslGvj3M5mYhSfjVhehRuhbsI2lhHn1HZCHxE4Hi5PTkZan4pmzocPwOD_pxhc7jSeI7DV01nXlwQYMO3Qth4Kvhcbr-PTbcJi0PlQ_YBvQ61uTt6g5rSYdjhTv2lkfdQqk0-0vXuOGPrnYqdDufzLiNPV0MeNK2kSCbc41FCTiRbJ6vJd6gsT4558MEh5iJWzfYgPcZFsK9qcdHw_m2AtgOl1b8TuLAN78v2_OAacHBbGdpxeEJpuatMoWnmnFLO-YFAa6OLJPbVx_G6nQQCIL67EOGu0eslTnq0f82O093Cds-rOGgvOuNBzfv30yi3v2u2et5VoIGd-ukNW1haTrhaLfSHg3h56UW_AOA1URvFGvrZkxvXXZRCpeUk9A2RYdX-ohnwTU2eWWUUKFSPKoN8bQIzDbhILjG6OEZB5phG8JES4Bu_UlRXa1Hhjy8aRpAXWGKkzax8mrfpmxiFwpeaNx6AXM24xyl4aVmghk3vAcKQ_645hHEpsge-qJ-JKVyOOSnF_gW-vy4WXaGqQqjtsFyw08M2703u55gEvs8_CoEdsr0jYgmzYvs1sh-WHkdowJPMMUIBaojCrMWfvu4LGZKLzawVB8Kf4tT1IjJi8JQo89ukvLE5f-teeRTKXRFK0fwpqmOOxAgcSukKVyiGAjA3YHXii9wSnpzO9IiZhCG9fsXva16uYJmBaeJy2Wwil6WKITFDp7UfVmxXo32aGu1AO4yg256-0rJerXjOs-nzmLXtUmXgsotoUXAWaCb5vcK6EIzkjCmVY_QRvoqsC8Q-OnH0xljudL4rq00LpGO4yRwMQvmgaGXt3OmSCaQv2HuwzKBfzmnvx_WmRui--B2LHzcwzJmXuRnXwZlBhAgwCKz-EJZqJ80v-h_ZOQw7mVgNOcpGMrbRaSxZLgVmOvUUynWQ5FtK_4M35p5NLS2v-f_LupCIYYxlUss0ClYjvvTklzrRuauv09S9wqS2l5xkuYecPBALc3sBiFFVqv7HtulB4524ChbXwQTCATm2dqSsl_R3J2GO2SLot3twjA2FGWPPRKZmm8ip7DvmzBHEqttiSZtu1Y0ASvP5mmI7pTg1nTRn2i2QM5GIW8Ait8OL8TX7mBOlxhwH8CEULCnHXrPvXT8lmpaSimkfr6rbGdgKpcnEpGCxmiRXBS2BqwJnUywtYkUt7ruWiESjLG1rYJtxc3sT_tsp6fj6ouSYdAet7m6r0cpcDi7WxWKQ1JU5TMUiUqBYWO_RxxKj7GqbBW1uXvi0CnsEC-v4Cs44oOF5IvQ8jmcxtsJ4bqI6D-EMED6-ykCx2mWwOWsCKyhZLUc5gLzDNVZG-K7HFEcJmjxo5Jp0nVF-tSh7NnVBxFJqVdWNyhqtRoOESiN8u58302mAcU6aSAw3qtmxALsWr631Edhv9Z043pbZ9nASc5Z2dobKF9LKqbkzbfDNOkztOLAgN7mydkSo7z5ax1JNSGRtTuzfJzkK_V_UGN8DUJql79Bmh6yJlw6OlH0qtsqSUTysk73VzOlCg98nVmWlfE9lRmkn7xN47IkOqjSEIU4BklKxeBpew9ABDbBIJB5fZ5WLUbVA03ZxTFSKR-OtEOTN-xME4SEY_St_ZUioapCkZQ_AYZypsd4ltCZpkqrCMm-nX4ZLnrennI2onOPWMG35xl9MU-F6DNpFPagop-IOZbFqJXhyngfZsSBfhVDUNt9XkqYGgvmF0CL7y4PiP0tXye72pysjlUFG69nlkOs12JWkgvz--wwFVNu4lm8S-AENbJawh-OaUi8YFvxZDL-gDdeHU2u0htaApqfYtbEB_fNdqGpAauPVh6X6VjOaUhF8ou9oRTE2dp2VC_rKM5-G1qw7tJJ0b_NdNQ3UqwIgFAVinGq71dDjnbzSsCHsHZuI0eH2oEqf2EmolIVWOJJSWJwDvG4KSFJgpTELM5Mvb6V0BUzDBXCkoI_c1c05gh00lmGJIh3oYzFoRtF0-InOpbcNWG8FMqMGnehLjkaCRO661FstkULTI29Qk1aCszvQaaIr15tshjmdCqqyo8lmyCiXISk9_4eyGP14Rcl2jOdlwF2sJHs13gUqoxPNzTcTw&cid=CAQSOwBpAlJWzja5vjlphRiTk1OcK_bRt4hNr1WLPRAPuQ-zRQIMwQUtVhW_B6rYDYqZLX4SJVDjXTxrAru9GAE&dv3_ver=m202309120101&rfl=http%3A%2F%2Fdocplayer.net%2F&ds=l&xdt=1&iif=1&cor=101004284237522380&adk=929882891&idt=237&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 275348
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 20 Sep 2024 12:26:28 GMT

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame 8AD1 12 KB
4 KB 78ms
26ms Script
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1695574535941347&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCD0rhB2oQZaO6OYGWtOUPhea4qA-m5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0HOE-rUuk54Q_33_el6ArlJwGuWwP-WvB03pIYEILtyZucP6V0M7bO8oq8Nbk05bXepYs5G8UVI6yn5MOHIKW0-74Q70d3SfRp8z0yPlxDtgoNPLn5z9QAeSE9be9BH-KZztuy092Y2em00c29Kgv7LxkC_RKQeys0llSw7c0khP9TSBsIHR_nwD0o2Jz-NLcxyD-u4oPfdc8SEoLT4LGwpKaBpW8zJ8N0g62e4T0j6Vv15Ejl7oxFo8SWl3mT9spwEqfHVCsFz5Zsv_b67gwdMxbh_0HbavMS51zVDk1J3Ex9wIGIMw48tBU0bABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMI49mer9vDgQMVAQutBh0FMw71EAEYASAAEgJz9PD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJWzja5vjlphRiTk1OcK_bRt4hNr1WLPRAPuQ-zRQIMwQUtVhW_B6rYDYqZLX4SJVDjXTxrAru9GAE%26sig%3DAOD64_3d81Yc-OLsKe-wOgT03yBiGW5kaA%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-BcD55aY-78ow02SmBQzf9bOzfmT_sxyM9SW8vZkklsAM6vSM-wOOLqxhsIo7ap6_tIVczvfb0Bpi6Cnziai-Xg1bdbcdxrMMBsgFiMQWcJyC26DA_a8XdL0mJo7bcLCda0naMTsKR7w77GPAvTogUOjU-r-8KkyZvHwPHe9Tjb2hiHhdc%26cry%3D1%26dbm_d%3DAKAmf-CCihGrMlYmY86yXIlUrmX2ApuqlEImZoP3RDO1v8iGNJIZ2BnDR0S3lnsudpY48JvHvSoDOARQ6oxdZXQMEqWMNoyJK5hvpoLufCcQLwxSmPtC5naaL1jCFlkHuRRFAti0Z3pBYw7yg5li7624H5KIvXJD-TIB6O2DdLA1omews7wMrjMgnQ3QbhtvZLB4xoxryPGS4gMYkmQyQcXRCZuRU8ioAc_E7eE6amDk1ZXrPlkTxlGHFjLQQnWx-Rt9fkNJWmWSuwD_E89YLcVRguFoIFxTKyH-GK_q2PPku0a6iBUKFk-0_Iw30OxLtujSuPndQl339hKk9EITsQPYo-_lyle3KU_XUbNnGoFMHBv6MDiu6HaOu9PE4dYa5zcBceBgoPzV6JKQz_LaJ2llvMbAktkb01_1dl2cRu-McLIvmUOWEf21NB5eu7Xf2xE-4nKnOUGscV-OCVm1L_iPTvKXGOiB-KLsBy5ur2-98JSFTicQdRR3KcjaJIc3IEALoO73zcZjjDJLJ0pK8Xo6N-B22ly-GifFJSvZyVfOn_v6PBzligpbebpJAP1rbp9pzmh8j-QAdlIJtFg_BqC8if3dpRheK__j_GiMjw2pI6QLYEukMpy23kZuO-uDDC2s0Jx8dvmT7esLGS7kAvEbHuai72VCQIUyND1Gwl5Km7SPrxFK7c9RTQ6p7yEQTY7dPiWRwnWB9cdeEUP21qlqoXPjugDEKw%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=4290548377&pi=t.aa~a.2429977064~rp.2&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280&nras=4&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=810&ady=2988&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=iVZjO70nvz&p=http%3A//docplayer.net&dtd=22
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 26d679f298008e073b4a0dd7ff0bfdc35019912525ab3a0af1838828248b4418

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4322
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EDB4 0
20 B 121ms
120ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5149882147414&version=m202309120101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EDB4 0
20 B 120ms
120ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5149882147414&version=m202309120101&ct=77&x=1&cor=12507797150336203000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame EDB4 16 KB
12 KB 61ms
60ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AQ49ALAPWDbgaNDP8Nd8OPXXqG_cVCGk_-tQRvGOcRbqikRAVGjnZJCKV8BN6kGW3dRzzrNl1TZZmes6veAXLoyVwnMZnh84z1Qsgt_hcj4Wy7UyDXxXEtxlTwyxzMn6XbJ8B2NvRpcPfxfLrfydkXZ71u2tCfKbzMZpOoVX39sBdX7yA&cry=1&dbm_d=AKAmf-DsZpR8F9toIX6uDts1EpnXuc_l76mhc_4NjxxNyKaCNwj7dFoPXJyY3-0r1w0jKA95gekbTzsJi9DOu32H1cVNgVyscOhmrdZoqKdVeSCyudI34iO55XDiGBuwGBeZ-LQ65Ik0vBrTvUUx8NuooIwmoddBOmRAcFGAY4fd3pXShde-DqKG3umsP4fLraZXcpxXUStLAXMXHiL_lQPU_NOZUqM94IJK_RZk8RycKBzCfllLrjTzw7pIO-_TfEBnBEupBXcoOK3eQ4kE2UpEy4kPYwY1D5GFtHmWxyIwXX2IabzFi_D07HhYUaYUCq-0boMg_MkvlJX5uPstqJJsAtso0qjs4z9pBU_WKZZSO9AISv8tWMEPGdXw9r7beDQSS7ZJ1D5hcjm9vgiDk165Q7JBcAz5zljuUa-9jDGP96FjFkBmyJ9qaRALcl8VKYgQ7-woEuCaJS0VeQ_buQ_ReXO7ImRybOqt0NHr_-JfmD_TYqDGE8O2paeQOXJJGC2Z4FSzccWbvF4TX5n0GaGQ81wTmmyyB4mU3NOyexUyq2UdAS8U2EZ2vB8e6f7JwjUp2bcYDDBgGVz1-y_6256sbkqdWbjbR0IUmxXD1-5-79GFgqY6G-xrVpM2wY-4ZWbxLQg6F66jR8-Ss3EVYDl4NK267MQR-Bg_PhoBq0y32Any2bThNA-yn9LO6lfKU7TqOf93zoOjDXeELvrLePlTKJmkNuFnjHaZU9Q2vdNVCcWtcXpyvcLdQN_nMDhsVz5wov4POLU_iN6noywRgyk4kUHrYYMybi_8Nva1g5nomw8lB7e2z0xXA_7Q8CCI31bIT6uGby2xpTSmvvDuObaNZUGYV9BCxy7PwkMSeYeF8i603sEPdZdpwVLF2JTHM3u32MvujoSVGk-3muQ7qK2wUwyUdmHX26T_38gk7rnoEsQFKooC3_2mbpivj4MmbaSJprxVjRloIYwz9NQmx4mEoQxlCCx47_BgAcGjlENzSPaNW0Dp6UkCUSjXZlxI7M5bcTNjC26GgQ__DOQX_FxzpdAfIHJtF4BM8j1TLEFGDOKrkPfwn22OiMgeJfDBFpqKLArSzhbRdFhfP9eRlN4fsIiGjEzaEFXaIGjQguOeKur_9qghegBOEYlKUXkaHvRMjFjVZPb9G3YLSAw9sXe8R0rJgH2wiGsUwhlBrIkqFzzH1f0ZLHFb1Q0wkWbO2HGiPwFzI3v8FBLbPqI_xU3prB-608LODVUBbL2GFMYbYdZDcwc3PLt5SNq8lSWU4hjVFy9p5kdNxqZddqxz2vPthlY2FvvrODonC0TvZscboArR25SY5BLo1FBZqAZFo-Jya2HcTxe6siqq93HB0z-GiGIsVdM9ZaajNxMyBnd7kct6ptVUw5wBpv_zUV8ZWQT3jKCUvIBz3t8Bi4u4qFPvWd37Ah4mKEA569QMDzrqpXpKYvqBY7nRAUHGPzG4cffxb2BpO74ZNde9V7rQWD0V5R6yTP1Yw97ZDKdzAB9TdqDduOAC855Rjj_7_gHP1IxWI-VhFo2uhvy3XhxnXaOevlP1NQOZlCGMs9mD-q2geTmoifoK4FmsbUJqTLzwabsMDcFqnpjj9HhuUrBZuXFPCpO_EMmUu7XWYHOvva4n4M9LOmyEiAE19-C_l4TiHUF7TzJAtFe_15frDi1xZBza6D5ETbmq6Wj127NMDg-ayj30iOO0UtdeLW2g6ORDpkg35VWHLaNc9RYaih2FvjBsdb_yC5tEW2FHNiAkDyob35h-bK5eahbPEHyZj5uUx0pBkjYG4I601Gmb5ogrSiKNeF1M_Bang7zC05-HxgSZfwIcG7eF5-j1Rb5XVGJyqfRkzdrwONML7KNTDI09tcaWCpB9JXaXdBTt5Z9W23Wg94Wuab-3hLM6fEXCgmKEXODUYLvUcEEQETm_vHV3DcLVyueVXBdQhpXnsuIuFKZxJta7onXs6XnzhnjBlE8phupn5uUNqZXPnsWxHYH3ySjx6Z3KyRpJzNRrFooK4CqCbntD0c2e2-KfJdnFXPHoCGeinySutrCyt2652-BLrM5hJuxd1G8OlKL6vhhEWfjQuC_yIn9azYE74aFAdBH2DhtkNDD9ndqQ-XKc1sF30xc-h0Bc-0IVyrHeEM81Xs2iWhq8EuPRNE_dEQWUDFgFqXE_BvoUsouZsh-otOlljRmPH_Rarv8QxuWJWRdbE2TFSZ0d-h95qDYjNSDkAUAd_wAslXgn5jiEjhLun7kX2GqJiNRVpOndW73H6CKEbmKbCQbqSEl1iWQGoCa9Mp7U8OnoVQmKwyX1A60JE4CnU3eoK5VeDfbk_P06lcwPUfOaoRPU-orEceHhmuWDewhLDlNWjvV5hOPrJZKNgpisFfjw364U18XQgk9-Rs9N66BbK3Q8nrIO_PKE8Y8isIkDtZPiCdAGNJr1Z34ocY63KEXbZquhUq5pfZyn6RNzLVgmhN3IwJDMHGGas6TKd0qVhlpFAoOzovt1YnC1p9AIMet6VLE0uqiFQjxSv4D2fmuRQinsywmsXZF49X_6y67rAtGnl9vsREjCKOOy2D9WfjhybWsVEDbOcG6pvXvpCR7d8tGyNEHZZqs8ax2fo8CiKp8I-98YHV6KecdzJtPlcTJTo1UTcTO8ErGqmICtZ0K7Ou0z1_81Oh1jeoQVYOvLFTI74mlmKXiF92oImnZ-nPDXVG3Noln90-th_LfMzptyuxQ5N23JCJzItWI7NeFz8fxzqZr_IQQt-DrpTsJcEQJM9JR1cdkNBMgHu2g_BecDMF5qQofqbk6foy96Ytch5PW_tSFn62gFWTqqPntjW9fJIon0Heb6LiMil1MF9Wx1Q04qqMtkQYTuZfm2u5L6rC7o0R0ceiOj2u45MIsLrOft4krEqipxcvkHR3m0BWtK0e6uXYP4SVVxrae5VIHvWDgee_sQrlsmeCSfHuCqkxBggoAOTrIsXq5v37TIGw2wonJVK4HhWOiVekOjKdL19ek-we2_z_lvZZdTSrb-P1D_91brH0XbS4KmzTzHFZTlMrGKK4LRTfKQtS2YlviZWCDWWcdakPEM-QQphf4xRiaKkcc1DDw4AG16jBg2E4YhA9FDOHwFDX5JKUJtNaeJaCtR8YNOyRbHj1swXqDYNQhFDzQZ-nh-_lQp6iAM2rPXvOkunB7Wz7c7-Toob18fKiz_Gjq-uEl7xwCkwWdp76Tz6f4lBsc13-4FSeSY01OL0DdCkwxMia0RxeGMaGQ258OxdAs5O4vh-QwCYoT5Y0RbOJ4zzfe3VtY309UERUtuPMryylaql1IDpaumdNr_jYWLYkF-tHE81fMNhNSfvSFnrxeEZPqnq3xfhGa_NJ3HTXTLBQjIg7hG1gwki2Ua9m1XzEoIdEm7SV2rzjBWwNQMSB5MQv8x3XSwdiPpHBM61wf3XPdurrKfHKxzYmqFe-dqZy19sElQoHO7dlS4CZzy1Q2zRaf4M0QEydrnwJ6baFMUFHEsFIEF_b-bCx1xG4Nk1mlSSAso5o21kbOMNEapx9npGZJgeelNcuqZWZHSiVIOhF1ldcm3ZVNDnHRda_Qd66T833wE6TeAXdhPguavO3nHF4G6khdPUuCSoKUv5CB7JNSOHyWiRweEhqfgA6iI8z6Z_jjVnkcps73KO7l5X6D-762zNciWFWGH7Z9YlcQO2nlLOCO-U9NaZaVDAqciPeUinPZsBgUjrlmW9xhBIrGyHTEZWAmYVBRF0nMrptK6VZEQu-KZ3GfasZt5rMS1Rpx6wOFS1T1mKVy246TE-jH2g9F1DiGEXBqrB1e06HxZMYUuob-i8wtUAQaibpWL4gPkkOhP-K2rR3kxa7THgendrTYYMKDI1d-Apz4193khYDvtgWFjJz-RlDtKGOMEz0DATpIVwjh3Hm0SsYPk30_Pc5AOEg&cid=CAQSOwDICaaNNKdirMATOjldqJn4SqzEIMwXt0RjxOEWzU1dPcImwNJ_2CW_VO5yAiiZjnfRwY48pV7U_9ufGAE&dv3_ver=m202309120101&rfl=http%3A%2F%2Fdocplayer.net%2F&ds=l&xdt=1&iif=1&cor=12507797150336203000&adk=2935317967&idt=93&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b8440918f37f60f8f4087915d6fac8fd14152f2d7e4c0fbba1315b20ff8c6a64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12157
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3090 22 KB
8 KB 20ms
20ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 275348
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 21 Sep 2023 12:26:28 GMT
expires: Fri, 20 Sep 2024 12:26:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

request.php Show response
hal900026.redintelligence.net/ Frame A5D4
Redirect Chain

https://hal900026.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=af919057b9&subid=&uid=3e9eb985345dba0a&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900026.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=af919057b9&subid=&uid=3e9eb985345dba0a&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

163ms
117ms

Script
application/x-javascript

138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900026.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=af919057b9&subid=&uid=3e9eb985345dba0a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC14quB2oQZZrnOIWV9AOK-aCIBKblvaBpvZOcp8kP8C4QASD52-xGYJWCgICYB8gBCakCYTFGH3HfsT6oAwHIA5sEqgTtAU_QUPJyh-48wh0deqfoq1zlQuKvbfBRnSGR5OW1EiRwY6sq7FpGnSuKkvI_kooH9MjkCF36K6jBaygQSgoVHbNxNG8fiy12fy3l_ye14Y7LeC3hskAqF5-O3THgWpC1xl8Q0r24-b9PWB37BPvQnRbJKf_86dmAlo2BS_1j4uJaproE_a1KcrrXDxW2p1wKKNdWXvXkjW5zKj_rqwmsX7OzDZFvgim6Meku5YsZIHygc7Qfa_2_SeXcO0TGrO3BTo0bxOsC9K6CXK4bKwXPWlh9vdMYuPh0v-k7VS4duYAqk0cv3yPl8HlfZh_JvsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMI2oaer9vDgQMVhQp9Ch2KPAhBEAEYASAAEgL6DvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJWNr7Lq-steX9dQ184bASuqgBT31VX84gMnCIlcgJz5e9TAe7LgtBmItqcqDcM_XNk6WV5Ax9HGAE%26sig%3DAOD64_0A3rVdtBLk2CzCN0KMgT09X4bdsQ%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-BYnBvTXDrgorqf0CaXqB191iBQOGXUHDnafJdI3JlxpSebHCPG3hElXbGkXdkrFzR5V8ScyVHM_Y3KiLrhejCUqEtHdvoVJf3j4u-bWa0LVedJJNdV0DZfJKuxiVwelhx6NQwNfn1Y_MzLLR0DWtUVyFZBl8hGu8ZVHyRCEfUUeauW1n8%26cry%3D1%26dbm_d%3DAKAmf-BV3GIrPH5nFbrmP9-zAVL2HpG4SSyh8RWN6N16nc6MP8eiHc4A1SVUT8J3qYOw6lcMVmwxim6w3X7b8VOvF09uBhYkJNtqvXm8GjKeb4WNOiDfG8Ivk_2YWsU8f9jGmMwt5ZGo6a1FouVMaqJ7vig3H48BbGO-TBJep9zeEx9GYoebMBOCN3pACyvyXVnnvNcPaEFlp2g9DKSs-Ll8SkZ9A27ZzwWcWpCM17cl3MxTdka9EMAn4nFfN1ybqlTCm7Ngq6Xp6E8kKOI7QfC2D4fDYW35jPx4BiyqfjOmIGSamrmsScaS4kTmh5y7BqrJopKIIf3rh5Xc3Vy9mFP4jQI4hV1FE5OaYt4LyQ0HkY5xaPtZKwJUDHd7SQOEKArh1f_zBMLPqPANC5ap9PMnG4jUehz5-t-0mpPkeLzS2XnSKLYW7YQ8EZ_L29R-aiWfhxMxbz_txLX1w5qV__DfE0puuXpP7qKvO2czOQVV65NO47yatnMB6IGfRRkQOhM2a8VL1KiTt4vvb_3dWd38NMCr5Aex2IPUt4v0AUMSpzpSCurnvgZHKKNrIhr5eibLurhjJXd8F0ToM7ejT3uezXhQ75UUCzZF0erpN6j3ONk0bgh7F2Zz_rSjAQy2bQHsKB7QOVsSXkwlcbawPhvIr3fT4SC3geXeb341OcsTxRCy5_SoNSGK3UT-k7U7qu5wlcqR6IcFdmwV-l06x2VOpik-XZWCjg%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D1567995846%26adf%3D724619058%26pi%3Dt.aa~a.1856579592~rp.4%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%26nras%3D3%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1208%26ady%3D2808%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D6%26uci%3Da!6%26btvi%3D3%26fsb%3D1%26xpc%3DZE5btzgJdW%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D17&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=6556199831092&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=724619058&pi=t.aa~a.1856579592~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280&nras=3&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=2808&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ZE5btzgJdW&p=http%3A//docplayer.net&dtd=17
Protocol: HTTP/1.1
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: b07559949f74d8ac227b519fffb0066752d0194d25c22bb6c8c449faf12c618c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 35726500116043204444994012457026
Connection: close
Content-Length: 1326
Expires: Sun, 24 Sep 2023 17:55:37 +0200

Redirect headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:37 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=af919057b9&subid=&uid=3e9eb985345dba0a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC14quB2oQZZrnOIWV9AOK-aCIBKblvaBpvZOcp8kP8C4QASD52-xGYJWCgICYB8gBCakCYTFGH3HfsT6oAwHIA5sEqgTtAU_QUPJyh-48wh0deqfoq1zlQuKvbfBRnSGR5OW1EiRwY6sq7FpGnSuKkvI_kooH9MjkCF36K6jBaygQSgoVHbNxNG8fiy12fy3l_ye14Y7LeC3hskAqF5-O3THgWpC1xl8Q0r24-b9PWB37BPvQnRbJKf_86dmAlo2BS_1j4uJaproE_a1KcrrXDxW2p1wKKNdWXvXkjW5zKj_rqwmsX7OzDZFvgim6Meku5YsZIHygc7Qfa_2_SeXcO0TGrO3BTo0bxOsC9K6CXK4bKwXPWlh9vdMYuPh0v-k7VS4duYAqk0cv3yPl8HlfZh_JvsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMI2oaer9vDgQMVhQp9Ch2KPAhBEAEYASAAEgL6DvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJWNr7Lq-steX9dQ184bASuqgBT31VX84gMnCIlcgJz5e9TAe7LgtBmItqcqDcM_XNk6WV5Ax9HGAE%26sig%3DAOD64_0A3rVdtBLk2CzCN0KMgT09X4bdsQ%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-BYnBvTXDrgorqf0CaXqB191iBQOGXUHDnafJdI3JlxpSebHCPG3hElXbGkXdkrFzR5V8ScyVHM_Y3KiLrhejCUqEtHdvoVJf3j4u-bWa0LVedJJNdV0DZfJKuxiVwelhx6NQwNfn1Y_MzLLR0DWtUVyFZBl8hGu8ZVHyRCEfUUeauW1n8%26cry%3D1%26dbm_d%3DAKAmf-BV3GIrPH5nFbrmP9-zAVL2HpG4SSyh8RWN6N16nc6MP8eiHc4A1SVUT8J3qYOw6lcMVmwxim6w3X7b8VOvF09uBhYkJNtqvXm8GjKeb4WNOiDfG8Ivk_2YWsU8f9jGmMwt5ZGo6a1FouVMaqJ7vig3H48BbGO-TBJep9zeEx9GYoebMBOCN3pACyvyXVnnvNcPaEFlp2g9DKSs-Ll8SkZ9A27ZzwWcWpCM17cl3MxTdka9EMAn4nFfN1ybqlTCm7Ngq6Xp6E8kKOI7QfC2D4fDYW35jPx4BiyqfjOmIGSamrmsScaS4kTmh5y7BqrJopKIIf3rh5Xc3Vy9mFP4jQI4hV1FE5OaYt4LyQ0HkY5xaPtZKwJUDHd7SQOEKArh1f_zBMLPqPANC5ap9PMnG4jUehz5-t-0mpPkeLzS2XnSKLYW7YQ8EZ_L29R-aiWfhxMxbz_txLX1w5qV__DfE0puuXpP7qKvO2czOQVV65NO47yatnMB6IGfRRkQOhM2a8VL1KiTt4vvb_3dWd38NMCr5Aex2IPUt4v0AUMSpzpSCurnvgZHKKNrIhr5eibLurhjJXd8F0ToM7ejT3uezXhQ75UUCzZF0erpN6j3ONk0bgh7F2Zz_rSjAQy2bQHsKB7QOVsSXkwlcbawPhvIr3fT4SC3geXeb341OcsTxRCy5_SoNSGK3UT-k7U7qu5wlcqR6IcFdmwV-l06x2VOpik-XZWCjg%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D1567995846%26adf%3D724619058%26pi%3Dt.aa~a.1856579592~rp.4%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%26nras%3D3%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1208%26ady%3D2808%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D6%26uci%3Da!6%26btvi%3D3%26fsb%3D1%26xpc%3DZE5btzgJdW%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D17&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=6556199831092&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Sun, 24 Sep 2023 17:55:37 +0200

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 928E 22 KB
8 KB 22ms
21ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 275348
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 21 Sep 2023 12:26:28 GMT
expires: Fri, 20 Sep 2024 12:26:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 tGcDLxZnxcZjneq6ZTfMhLSKmVRaNAcBIKHxIKG0fIc.js Show response
pagead2.googlesyndication.com/bg/ Frame 3090 37 KB
14 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/tGcDLxZnxcZjneq6ZTfMhLSKmVRaNAcBIKHxIKG0fIc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b467032f1667c5c6639deaba6537cc84b48a99545a34070120a1f120a1b47c87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:32:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1403
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14772
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 23 Sep 2024 16:32:13 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame EDB4 41 KB
13 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AQ49ALAPWDbgaNDP8Nd8OPXXqG_cVCGk_-tQRvGOcRbqikRAVGjnZJCKV8BN6kGW3dRzzrNl1TZZmes6veAXLoyVwnMZnh84z1Qsgt_hcj4Wy7UyDXxXEtxlTwyxzMn6XbJ8B2NvRpcPfxfLrfydkXZ71u2tCfKbzMZpOoVX39sBdX7yA&cry=1&dbm_d=AKAmf-DsZpR8F9toIX6uDts1EpnXuc_l76mhc_4NjxxNyKaCNwj7dFoPXJyY3-0r1w0jKA95gekbTzsJi9DOu32H1cVNgVyscOhmrdZoqKdVeSCyudI34iO55XDiGBuwGBeZ-LQ65Ik0vBrTvUUx8NuooIwmoddBOmRAcFGAY4fd3pXShde-DqKG3umsP4fLraZXcpxXUStLAXMXHiL_lQPU_NOZUqM94IJK_RZk8RycKBzCfllLrjTzw7pIO-_TfEBnBEupBXcoOK3eQ4kE2UpEy4kPYwY1D5GFtHmWxyIwXX2IabzFi_D07HhYUaYUCq-0boMg_MkvlJX5uPstqJJsAtso0qjs4z9pBU_WKZZSO9AISv8tWMEPGdXw9r7beDQSS7ZJ1D5hcjm9vgiDk165Q7JBcAz5zljuUa-9jDGP96FjFkBmyJ9qaRALcl8VKYgQ7-woEuCaJS0VeQ_buQ_ReXO7ImRybOqt0NHr_-JfmD_TYqDGE8O2paeQOXJJGC2Z4FSzccWbvF4TX5n0GaGQ81wTmmyyB4mU3NOyexUyq2UdAS8U2EZ2vB8e6f7JwjUp2bcYDDBgGVz1-y_6256sbkqdWbjbR0IUmxXD1-5-79GFgqY6G-xrVpM2wY-4ZWbxLQg6F66jR8-Ss3EVYDl4NK267MQR-Bg_PhoBq0y32Any2bThNA-yn9LO6lfKU7TqOf93zoOjDXeELvrLePlTKJmkNuFnjHaZU9Q2vdNVCcWtcXpyvcLdQN_nMDhsVz5wov4POLU_iN6noywRgyk4kUHrYYMybi_8Nva1g5nomw8lB7e2z0xXA_7Q8CCI31bIT6uGby2xpTSmvvDuObaNZUGYV9BCxy7PwkMSeYeF8i603sEPdZdpwVLF2JTHM3u32MvujoSVGk-3muQ7qK2wUwyUdmHX26T_38gk7rnoEsQFKooC3_2mbpivj4MmbaSJprxVjRloIYwz9NQmx4mEoQxlCCx47_BgAcGjlENzSPaNW0Dp6UkCUSjXZlxI7M5bcTNjC26GgQ__DOQX_FxzpdAfIHJtF4BM8j1TLEFGDOKrkPfwn22OiMgeJfDBFpqKLArSzhbRdFhfP9eRlN4fsIiGjEzaEFXaIGjQguOeKur_9qghegBOEYlKUXkaHvRMjFjVZPb9G3YLSAw9sXe8R0rJgH2wiGsUwhlBrIkqFzzH1f0ZLHFb1Q0wkWbO2HGiPwFzI3v8FBLbPqI_xU3prB-608LODVUBbL2GFMYbYdZDcwc3PLt5SNq8lSWU4hjVFy9p5kdNxqZddqxz2vPthlY2FvvrODonC0TvZscboArR25SY5BLo1FBZqAZFo-Jya2HcTxe6siqq93HB0z-GiGIsVdM9ZaajNxMyBnd7kct6ptVUw5wBpv_zUV8ZWQT3jKCUvIBz3t8Bi4u4qFPvWd37Ah4mKEA569QMDzrqpXpKYvqBY7nRAUHGPzG4cffxb2BpO74ZNde9V7rQWD0V5R6yTP1Yw97ZDKdzAB9TdqDduOAC855Rjj_7_gHP1IxWI-VhFo2uhvy3XhxnXaOevlP1NQOZlCGMs9mD-q2geTmoifoK4FmsbUJqTLzwabsMDcFqnpjj9HhuUrBZuXFPCpO_EMmUu7XWYHOvva4n4M9LOmyEiAE19-C_l4TiHUF7TzJAtFe_15frDi1xZBza6D5ETbmq6Wj127NMDg-ayj30iOO0UtdeLW2g6ORDpkg35VWHLaNc9RYaih2FvjBsdb_yC5tEW2FHNiAkDyob35h-bK5eahbPEHyZj5uUx0pBkjYG4I601Gmb5ogrSiKNeF1M_Bang7zC05-HxgSZfwIcG7eF5-j1Rb5XVGJyqfRkzdrwONML7KNTDI09tcaWCpB9JXaXdBTt5Z9W23Wg94Wuab-3hLM6fEXCgmKEXODUYLvUcEEQETm_vHV3DcLVyueVXBdQhpXnsuIuFKZxJta7onXs6XnzhnjBlE8phupn5uUNqZXPnsWxHYH3ySjx6Z3KyRpJzNRrFooK4CqCbntD0c2e2-KfJdnFXPHoCGeinySutrCyt2652-BLrM5hJuxd1G8OlKL6vhhEWfjQuC_yIn9azYE74aFAdBH2DhtkNDD9ndqQ-XKc1sF30xc-h0Bc-0IVyrHeEM81Xs2iWhq8EuPRNE_dEQWUDFgFqXE_BvoUsouZsh-otOlljRmPH_Rarv8QxuWJWRdbE2TFSZ0d-h95qDYjNSDkAUAd_wAslXgn5jiEjhLun7kX2GqJiNRVpOndW73H6CKEbmKbCQbqSEl1iWQGoCa9Mp7U8OnoVQmKwyX1A60JE4CnU3eoK5VeDfbk_P06lcwPUfOaoRPU-orEceHhmuWDewhLDlNWjvV5hOPrJZKNgpisFfjw364U18XQgk9-Rs9N66BbK3Q8nrIO_PKE8Y8isIkDtZPiCdAGNJr1Z34ocY63KEXbZquhUq5pfZyn6RNzLVgmhN3IwJDMHGGas6TKd0qVhlpFAoOzovt1YnC1p9AIMet6VLE0uqiFQjxSv4D2fmuRQinsywmsXZF49X_6y67rAtGnl9vsREjCKOOy2D9WfjhybWsVEDbOcG6pvXvpCR7d8tGyNEHZZqs8ax2fo8CiKp8I-98YHV6KecdzJtPlcTJTo1UTcTO8ErGqmICtZ0K7Ou0z1_81Oh1jeoQVYOvLFTI74mlmKXiF92oImnZ-nPDXVG3Noln90-th_LfMzptyuxQ5N23JCJzItWI7NeFz8fxzqZr_IQQt-DrpTsJcEQJM9JR1cdkNBMgHu2g_BecDMF5qQofqbk6foy96Ytch5PW_tSFn62gFWTqqPntjW9fJIon0Heb6LiMil1MF9Wx1Q04qqMtkQYTuZfm2u5L6rC7o0R0ceiOj2u45MIsLrOft4krEqipxcvkHR3m0BWtK0e6uXYP4SVVxrae5VIHvWDgee_sQrlsmeCSfHuCqkxBggoAOTrIsXq5v37TIGw2wonJVK4HhWOiVekOjKdL19ek-we2_z_lvZZdTSrb-P1D_91brH0XbS4KmzTzHFZTlMrGKK4LRTfKQtS2YlviZWCDWWcdakPEM-QQphf4xRiaKkcc1DDw4AG16jBg2E4YhA9FDOHwFDX5JKUJtNaeJaCtR8YNOyRbHj1swXqDYNQhFDzQZ-nh-_lQp6iAM2rPXvOkunB7Wz7c7-Toob18fKiz_Gjq-uEl7xwCkwWdp76Tz6f4lBsc13-4FSeSY01OL0DdCkwxMia0RxeGMaGQ258OxdAs5O4vh-QwCYoT5Y0RbOJ4zzfe3VtY309UERUtuPMryylaql1IDpaumdNr_jYWLYkF-tHE81fMNhNSfvSFnrxeEZPqnq3xfhGa_NJ3HTXTLBQjIg7hG1gwki2Ua9m1XzEoIdEm7SV2rzjBWwNQMSB5MQv8x3XSwdiPpHBM61wf3XPdurrKfHKxzYmqFe-dqZy19sElQoHO7dlS4CZzy1Q2zRaf4M0QEydrnwJ6baFMUFHEsFIEF_b-bCx1xG4Nk1mlSSAso5o21kbOMNEapx9npGZJgeelNcuqZWZHSiVIOhF1ldcm3ZVNDnHRda_Qd66T833wE6TeAXdhPguavO3nHF4G6khdPUuCSoKUv5CB7JNSOHyWiRweEhqfgA6iI8z6Z_jjVnkcps73KO7l5X6D-762zNciWFWGH7Z9YlcQO2nlLOCO-U9NaZaVDAqciPeUinPZsBgUjrlmW9xhBIrGyHTEZWAmYVBRF0nMrptK6VZEQu-KZ3GfasZt5rMS1Rpx6wOFS1T1mKVy246TE-jH2g9F1DiGEXBqrB1e06HxZMYUuob-i8wtUAQaibpWL4gPkkOhP-K2rR3kxa7THgendrTYYMKDI1d-Apz4193khYDvtgWFjJz-RlDtKGOMEz0DATpIVwjh3Hm0SsYPk30_Pc5AOEg&cid=CAQSOwDICaaNNKdirMATOjldqJn4SqzEIMwXt0RjxOEWzU1dPcImwNJ_2CW_VO5yAiiZjnfRwY48pV7U_9ufGAE&dv3_ver=m202309120101&rfl=http%3A%2F%2Fdocplayer.net%2F&ds=l&xdt=1&iif=1&cor=12507797150336203000&adk=2935317967&idt=93&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 275349
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 20 Sep 2024 12:26:28 GMT

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame EDB4 12 KB
4 KB 91ms
28ms Script
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1695574535942570&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCpewgB2oQZerDOfPBtOUPhKGW4Amm5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0Lq2c_RPT6KQhSmfjL3XrfFiStWduxcXiKuBfNsoZXNwGvkhV3prZuIv0qk84p6_MLN00bjZpKpwQhtoEtCeupfjTczpjPiDYQ4GJKLNIT16wIP4oABDbKLlRHc4vsP3P-sMFEyVfG1IxTGXJ-PH9ENr52xr_msFZ1-5vaIjl0Z9Df2sMtDpAWUklNvkuaKH5LQs-Ih82IUFedI0BvzzLBJe-r0bIFR1PHlD8bBf7bq5bnc9vQn8tu1YKeSGhtkwILPFDOCwxH-aLC9byMbiET7ARi2Z3zKOeCOp9u8QA-7rjR6Sn4yBxHVIElDABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIquOer9vDgQMV8yCtBh2EkAWcEAEYASAAEgKon_D_BwE%26num%3D1%26cid%3DCAQSOwDICaaNNKdirMATOjldqJn4SqzEIMwXt0RjxOEWzU1dPcImwNJ_2CW_VO5yAiiZjnfRwY48pV7U_9ufGAE%26sig%3DAOD64_1kwgR2Y6uskeiGe6f1Fn35-fYPEg%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-DpEEbCUSvcxkVCuzAlOLDzNVwYi6rfklNWhOWXApzZgA2_7TYh0AvL_o0HPZB_uAA8Fwr_mHDDwvlo-tZBb7Z09zatdZFXGnN8RNMyMfXWNW9rhi2TcTYRfpbEZViofcPkF7tjE_uYzWO2JXrG5ZIXxAXPviKs0PueV7ZWUhmBipINh1c%26cry%3D1%26dbm_d%3DAKAmf-CpUOShDQqqdTP8_rwqX6V29gcXKULGi2hV5rxklGGBg-wPJNRPsebxqI0yHLvYmupmMxWS5foKlp0j5G0eAGQD4rargYEip04b_Qyr74z88gc2-YD4nCmwAr9oiG9zpfLYwSgsCy_3lcgbpNSHQz_astDrZNK90RaFIQOGZBa7TEI0E9vWakaEI5MxyBUXM5YhJ3eBQ8h-q89t4fbAZLd4crW7A8ASALTsfqbfytRffrP8vp3CpxDV2AYI254KRrxYSN8utu3N250pCAHIiPiIHmB4sRKgESTgltX9zrgbRQG7Ek7J6LGudwiaruH8zKsPWCBnQLhbrfQGSpxaQ2Exhikqb9XazRSZ1nin5dxCq12uLpnNznj4mpJFieMj-c5_57BaOx0jKSSOo-2ANF0P0stb-XYtnJzRygbm79lVN1cR3qjInARuPHMpIL3SyErxXgTgt443OzIV2GF8dVVdl0BO2aVFf4UURyD9r9xrdyLI1O4wVJOVR9qErdP5H5MBaHOVqNBNzJcMD-6_eMQRPOyzn7giS5VdqfBlWJMPKuzhWQNlhG_7lxpKnkLblWIdtSJsvVpGlJd2FaFsm80m7JNpKhBUxVhntSiTN2I9CWwR7GeOvrCH0AQu9w_X0AR-1Nw25sKd8TXZuwoGxpkMqubP-0nFZaSw93wq8OYPyceoxAcD1GL3FvS6jF0cgaczSuxInClwErt8bOvm5wpHoFqxbA%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: dea8637baad727203386a52ee8ad55f647a016a7728727723a55bff6b2437c41

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4318
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js Show response
pagead2.googlesyndication.com/bg/ Frame 928E 37 KB
14 KB 31ms
30ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85de8e1049567f060665a08f4f9784af156edc484723473acd40953eb3bde550

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 07:19:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 380173
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14709
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 07:19:24 GMT

GET
H/1.1

200
OK

request.php Show response
hal90002.redintelligence.net/ Frame 8AD1
Redirect Chain

https://hal90002.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=5f22313682&subid=&uid=1ff882b731adf80e&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90002.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=5f22313682&subid=&uid=1ff882b731adf80e&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

4 KB
2 KB

150ms
104ms

Script
application/x-javascript

46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=5f22313682&subid=&uid=1ff882b731adf80e&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCD0rhB2oQZaO6OYGWtOUPhea4qA-m5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0HOE-rUuk54Q_33_el6ArlJwGuWwP-WvB03pIYEILtyZucP6V0M7bO8oq8Nbk05bXepYs5G8UVI6yn5MOHIKW0-74Q70d3SfRp8z0yPlxDtgoNPLn5z9QAeSE9be9BH-KZztuy092Y2em00c29Kgv7LxkC_RKQeys0llSw7c0khP9TSBsIHR_nwD0o2Jz-NLcxyD-u4oPfdc8SEoLT4LGwpKaBpW8zJ8N0g62e4T0j6Vv15Ejl7oxFo8SWl3mT9spwEqfHVCsFz5Zsv_b67gwdMxbh_0HbavMS51zVDk1J3Ex9wIGIMw48tBU0bABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMI49mer9vDgQMVAQutBh0FMw71EAEYASAAEgJz9PD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJWzja5vjlphRiTk1OcK_bRt4hNr1WLPRAPuQ-zRQIMwQUtVhW_B6rYDYqZLX4SJVDjXTxrAru9GAE%26sig%3DAOD64_3d81Yc-OLsKe-wOgT03yBiGW5kaA%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-BcD55aY-78ow02SmBQzf9bOzfmT_sxyM9SW8vZkklsAM6vSM-wOOLqxhsIo7ap6_tIVczvfb0Bpi6Cnziai-Xg1bdbcdxrMMBsgFiMQWcJyC26DA_a8XdL0mJo7bcLCda0naMTsKR7w77GPAvTogUOjU-r-8KkyZvHwPHe9Tjb2hiHhdc%26cry%3D1%26dbm_d%3DAKAmf-CCihGrMlYmY86yXIlUrmX2ApuqlEImZoP3RDO1v8iGNJIZ2BnDR0S3lnsudpY48JvHvSoDOARQ6oxdZXQMEqWMNoyJK5hvpoLufCcQLwxSmPtC5naaL1jCFlkHuRRFAti0Z3pBYw7yg5li7624H5KIvXJD-TIB6O2DdLA1omews7wMrjMgnQ3QbhtvZLB4xoxryPGS4gMYkmQyQcXRCZuRU8ioAc_E7eE6amDk1ZXrPlkTxlGHFjLQQnWx-Rt9fkNJWmWSuwD_E89YLcVRguFoIFxTKyH-GK_q2PPku0a6iBUKFk-0_Iw30OxLtujSuPndQl339hKk9EITsQPYo-_lyle3KU_XUbNnGoFMHBv6MDiu6HaOu9PE4dYa5zcBceBgoPzV6JKQz_LaJ2llvMbAktkb01_1dl2cRu-McLIvmUOWEf21NB5eu7Xf2xE-4nKnOUGscV-OCVm1L_iPTvKXGOiB-KLsBy5ur2-98JSFTicQdRR3KcjaJIc3IEALoO73zcZjjDJLJ0pK8Xo6N-B22ly-GifFJSvZyVfOn_v6PBzligpbebpJAP1rbp9pzmh8j-QAdlIJtFg_BqC8if3dpRheK__j_GiMjw2pI6QLYEukMpy23kZuO-uDDC2s0Jx8dvmT7esLGS7kAvEbHuai72VCQIUyND1Gwl5Km7SPrxFK7c9RTQ6p7yEQTY7dPiWRwnWB9cdeEUP21qlqoXPjugDEKw%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D687377255%26adf%3D4290548377%26pi%3Dt.aa~a.2429977064~rp.2%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%252C368x280%26nras%3D4%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D810%26ady%3D2988%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D7%26uci%3Da!7%26btvi%3D4%26fsb%3D1%26xpc%3DiVZjO70nvz%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D22&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=3790174192713&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=4290548377&pi=t.aa~a.2429977064~rp.2&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280&nras=4&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=810&ady=2988&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=iVZjO70nvz&p=http%3A//docplayer.net&dtd=22
Protocol: HTTP/1.1
Server: 46.4.10.47 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 740493f5bf90e75aa15056d6581b2ea1cd3ab3678347dd72971e1c0d515da722

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 84790000102752904444994012457002
Connection: close
Content-Length: 1352
Expires: Sun, 24 Sep 2023 17:55:37 +0200

Redirect headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:37 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=5f22313682&subid=&uid=1ff882b731adf80e&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCD0rhB2oQZaO6OYGWtOUPhea4qA-m5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0HOE-rUuk54Q_33_el6ArlJwGuWwP-WvB03pIYEILtyZucP6V0M7bO8oq8Nbk05bXepYs5G8UVI6yn5MOHIKW0-74Q70d3SfRp8z0yPlxDtgoNPLn5z9QAeSE9be9BH-KZztuy092Y2em00c29Kgv7LxkC_RKQeys0llSw7c0khP9TSBsIHR_nwD0o2Jz-NLcxyD-u4oPfdc8SEoLT4LGwpKaBpW8zJ8N0g62e4T0j6Vv15Ejl7oxFo8SWl3mT9spwEqfHVCsFz5Zsv_b67gwdMxbh_0HbavMS51zVDk1J3Ex9wIGIMw48tBU0bABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMI49mer9vDgQMVAQutBh0FMw71EAEYASAAEgJz9PD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJWzja5vjlphRiTk1OcK_bRt4hNr1WLPRAPuQ-zRQIMwQUtVhW_B6rYDYqZLX4SJVDjXTxrAru9GAE%26sig%3DAOD64_3d81Yc-OLsKe-wOgT03yBiGW5kaA%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-BcD55aY-78ow02SmBQzf9bOzfmT_sxyM9SW8vZkklsAM6vSM-wOOLqxhsIo7ap6_tIVczvfb0Bpi6Cnziai-Xg1bdbcdxrMMBsgFiMQWcJyC26DA_a8XdL0mJo7bcLCda0naMTsKR7w77GPAvTogUOjU-r-8KkyZvHwPHe9Tjb2hiHhdc%26cry%3D1%26dbm_d%3DAKAmf-CCihGrMlYmY86yXIlUrmX2ApuqlEImZoP3RDO1v8iGNJIZ2BnDR0S3lnsudpY48JvHvSoDOARQ6oxdZXQMEqWMNoyJK5hvpoLufCcQLwxSmPtC5naaL1jCFlkHuRRFAti0Z3pBYw7yg5li7624H5KIvXJD-TIB6O2DdLA1omews7wMrjMgnQ3QbhtvZLB4xoxryPGS4gMYkmQyQcXRCZuRU8ioAc_E7eE6amDk1ZXrPlkTxlGHFjLQQnWx-Rt9fkNJWmWSuwD_E89YLcVRguFoIFxTKyH-GK_q2PPku0a6iBUKFk-0_Iw30OxLtujSuPndQl339hKk9EITsQPYo-_lyle3KU_XUbNnGoFMHBv6MDiu6HaOu9PE4dYa5zcBceBgoPzV6JKQz_LaJ2llvMbAktkb01_1dl2cRu-McLIvmUOWEf21NB5eu7Xf2xE-4nKnOUGscV-OCVm1L_iPTvKXGOiB-KLsBy5ur2-98JSFTicQdRR3KcjaJIc3IEALoO73zcZjjDJLJ0pK8Xo6N-B22ly-GifFJSvZyVfOn_v6PBzligpbebpJAP1rbp9pzmh8j-QAdlIJtFg_BqC8if3dpRheK__j_GiMjw2pI6QLYEukMpy23kZuO-uDDC2s0Jx8dvmT7esLGS7kAvEbHuai72VCQIUyND1Gwl5Km7SPrxFK7c9RTQ6p7yEQTY7dPiWRwnWB9cdeEUP21qlqoXPjugDEKw%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D687377255%26adf%3D4290548377%26pi%3Dt.aa~a.2429977064~rp.2%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%252C368x280%26nras%3D4%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D810%26ady%3D2988%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D7%26uci%3Da!7%26btvi%3D4%26fsb%3D1%26xpc%3DiVZjO70nvz%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D22&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=3790174192713&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Sun, 24 Sep 2023 17:55:37 +0200

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4170 0
20 B 127ms
126ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bjn9uCGoQZfzTJIaSjuwPnJ-D4AIAAAAAOAHgBAI&bg=!ra6lruHNAAYrDsWMCw47ADQBe5WfOOyDc2-SciMr_2AqWHRsages9b8b_RPmrt9OFZVm8jVSAowYpNZadsJVDs1s0rrOAgAAAGpSAAAABWgBBwoAenXOEHHHlvqJ-GdAS4ivC-RQCGDHQz_PW-gltG00gj3MSbN5hfgsh2AgKWUyYUil4LqVRzkjXdbC5tQgFMk-LbA1r_mIxN4_shbLGqU2LG_WsHFsiNlX2K7DrURTNcU7zXywp6U4v_DjwrpjlcLRxSr-hO0e-ay0Km0ymQMQcrrXduilEIx9q6kOn1hfIAGw9F-zDL0-vGqKjJ8s23Wva7tLUhKyfP42aEsM6IhwUVimH0ZyPlDhK1fUhYEimm96gnfyv2QsYQkQ4_iJjVnIok3g__3ulmltuN-EgLyWs9Jsw_MDTdCufeabQ4awXIbAhXHKd_2qOMVybtsLY4URGW9JBJs9N9U5GWB3H9yMazKuhT92B29y1PQuyNxwzXKQKQRA7eYHbnFc1rvBL5KGZR7IwA_qxK5caHfTJRbKQba1siN_EmQ446pkL6BFW0eEmFX8C6fP6HcnRLy_XWAj9u41GQYDmH6LgbE86SZm_SyMAyX-xByst45P6oJRcECKkSPjHhYyKVzqsZF52sdFrFJ4IjOfBWdzi7rIa5Kv4GiQxK7bLZmAKNQPNLbwXuRqihbOEsZDaP9wj9KsPKRxZzm0Ns3gigRPa31Xr5TubDaxgISFqHz-cTvtObbssM6LuptjSU8nIH28IhJbkbfmVIiYzeVVFdkHHahg204-4oM8AzWNu8nwvqTi1jMaShXEHYHfd7TitNMai6_f6ggizIintnB3FTZtBWpJSUSXBXrrjFuhiGijrGXk6WEAznKz2CQIbWSXGwrB5SQW-jdtMqHTTZVTzi7fDBFdEHtGgrMBd8GqxdyEUfIKfrwrzkSauAe716TMspKKP8UMQW7bTJbsROaoQpcAeywaSTTeZfPxHz8s13uIuHKMbxTkAA222Dd5_kBsioGtaESR3Z0TlLAZOudx4oeg3sjtYCOWI-4d_wsnzW2M6rWpF6NUmaDjRyMhjSEicmA8MTOAbGM1YC9c1wjTA50teiRKlD75qa-ciH3d76Eoxu5D3SjnR0Ab8oRNpS7itXN09dTF1ihGFq53RNsSj9JYRm0_uM3GmpbsxdFytEIQug7X0mR6qCOUlLAQpNPTUJ-up0cVV1oL1J6UyRIooG41Dt0fJ3S-AuyiDoPvEvC-JAywyMF6VfpLnWsyE50HsDcjMz_VWd-fk92aM3QvDWWYo4bJdev7_ggZU0KbXaeAz9-A0zed_g

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame D941 41 KB
13 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AmFQhZLb5Zj9tQGFVy7VaoOB3jNwf5q_PN27-nZfjVrO-kV2hfsKQjCpLUFN5nAgNecW3XE7ctdC5xZV8rtQMfmZ7U37JyAA4C-6_rKmEe5ekcO0N-CMyy4pHnzav4oAUm_RPrrPRAH2rjWLrF1cMXLFncaOeoS4mOtUQk3LK8hWs7eHQ&cry=1&dbm_d=AKAmf-DO1kWd43GmUYh_vTcAFGUfiZCW3-pyjfVhb8ICwvciUq1wqb4y0ax_bYOCrgzG6vMSZfw7jphe8-9S1i3x5ubDb0jyFKfeuNBOm8t1CJqaR87b35yqCDNBNdq0758wjs4VMNNxaK9BiaJ5nASo3fxRQeAOm60f54ATxaBPJRsl2mnaABXAuYT7dZDJ2AH0wPKkXPxYmX1GNbhwI_xwEAP5SgPOP782yok8hO1TuiwL1B2DiUO9bVPePBv8WWA9_Wk4Qg-qS9-dvtpu4rgbWMP9MbvKvjUUiUTr-otm434bwSKPrzHbMZem3oWRjcHcbPlh-8mZgiCvKvCzzdX5wKiAi1EEyxKz8jHTs358niR6mFyMykYfJRmBId8IKTdWoTnfLzV72BYWIUaVGRopmt-q90gkvfKQjvAPH980WBlQTqijUJo1UyvlWvFURoZgfKKzlYgbLnX1LWpONKJEErIl694x2cO4R-e9Fk5CpvysfL7buXChj9aufPEQ7HHs6b2F8Fch1FOrtG9Bv56WyoI-a4f96b9wFx1UoS4T_31Gm4zCScUR1kKTbRGf3vpvUuVAMFV_z6TWh6ECIE5AIvSdYSYiaKkxFxyC0AaZOLdg4DsrgQSGKUEXchcJt4XH_EDQyPLdGzJsGRYOaLZRK6lW9br0ubZVlZOZQmX4Li6F6ehS90U1k-yqsZkThF3DCMe9hAOuR-AcD6Wbw8JbSZpAMlP4w-s2trWMNPxHIwu_13UQtWcc-YCYkJ4rvDVIxPe_dJSDKKbatBCVPw9A4QPyBUcWVFeWxwyooM8InjqRCY8VtR27K7qmP3aejNviqi1rufjTlFLhJUFTnWiin9mZf3xQsE6ghfKQXU_4UZnDtNiOzrcuNxhRkM-Lg0prb5VvIJ6BmX3aYPQ7Bf0Qjyv4ff2QUCr3hXQ_0d1zPhxqMUpels8gxiF8fh7aVNJjdUH_iMIYqPmohW-fC_IBbtMpbJThhgngCBeEQGu5LgYAGNLKXOphCMYVnncQFpHKvDe1-uOs56Dc5E1i5pKJ8Czx8qkB07-4o7cMSkrJJXHpm7wb4j1mBdQ5uw7ywDEEn1RwjUGLQclAmfPQpK56Zhc4IMe-NCqvUyDt_hIb1nVNK7rT4KQxae7PoSTtQol9lo_mz7fzybM4xGakhaElqDQCfiD6mNapvFpDe3s8KjDJjVUP8dmlI91Rc6ZYma7h0ki23fAZakfw6IWzPbebp_IWEHbQh0wiu086lvftwa1VvI5vCIueuu48WcpP5eU4u2WT--MevN6X26N9B27vsvzMqDozG8xW5E-PBuTDXDtHJoft4Wg67Vm70mXi_mriiWxJ_aClmOQiVaetuI148W76PwjpYX9JSygC7XxHZBwWxgByvhO95L_FNantv41d8CvcL6kykZ2-0KgnwL9M5s2o-5GzegmBCeY3-N6izfnb4tKg7cdSHOpiR17D0Vq4nGEWHCjlroNDHNBii7yDSnZboS5Oxi1NesZgOohc80aKZmTAw_19gYKphlKN1rLAiJyu8AuQJyYbg8grU3PSLA6ubKUWeNvF51TdumpJY1BtX29M4Huj2Nzmf6ujpmvlU6N5P4OX-tTi0GL5bcRArPk4_Y_E7AbbTxn8pA9aOO9ywVtXcCF_qh_7KEzAvAVYesigVvuAbCInIBFBdXruXeTRUQyht8wv95rc3sU2-c7eJvQw-QZfehy4qZUPRoEZqSN0K7xzlFjEMfIvFgOnXZbG9UQKDgMlsj7l5rw-lWPx_uYqi9YDWE5ViGdD4VMzA6SgzqEoZpaDK8mPsFxUz9lzinRbEWTuJQyZSh6299DRaMVxe4tJEKrA-avRFUeHJXkLipqdsiuZvIx7c43KuRZiGLdnYKlejcONP4FZT2fvAA2X3JvI8NspYMavlNIBfyGXv_GI-lDael6zMmEr7Q5D3JN6pob8eYykPJpsI_vGO_w14_ij8lQ0eJaBE9IWBSNfnMjiBoiQ1T526oe4yOzmyfs1KhGJsCMaBrldO03IUvdzvS-ILSvDX4lvmhTnMm8f73uggQx5NUkXVmuLoSlkjosapd8gWK0FHeK0CLFoiR7_d-XyAMMcV4s_M78DKz7FopWvx6gV6OgWom-pOlUn7Rj3s9-JbGD-VdhRZpq_JV5OEFwKkT_a2s9HGcNwNnYkNjNS_paN4giWOCjOZQKt-ysdA4TX8PwObU-6GvwkqMDPGQxGGYMOffGUPD7m8fMmgsF_ES8Qe-F_wwcbcluSnaZBuNdhFp2WShnMUP7TEbkR1MthD2soQ-3gNfIfvSTj_guRPZXwE-iLjRuh6aPCwn4fz7wahKOcVnKMk3zf6Tj9c5W3Fw_95qalCAAtpyyLpkVYkmDrQRjXyNpMXo9i3tQ-NlDmRQq5MxCPgHIT2hlL4bcCcblTMGjlcVEfRR96mPw3y5r1L8wAijovgkXoo8V6tw6-xJvyhxKATjArjJhNzvB02GOlxJz-nmzY9SQYRkh9FANVw9LOjCEoDWDRejgCvC7TL3tlR9_vkADT6honJAVBShCuctkwau57wthbX50sAkkehvpWiXITdvWJwK3aJ7ydrQt9_sVOWcYWcxJ57XvBlhCUpbOpj_f7cZOWuoaKCATjoJryg5WhLRvSrC-verCYzcI68gzHJVkHpVJIp81Gb-acpc5Si82punuMFX2ZZ0x_A7iVMtgOYd_E7u9AFSnBheZK66z96tppchDDcK0JgYQ8gtExlM4UDpeiPNYKX32s0QxKoXHtp4KJy4UiYQP3JBpGZ_vf2Gb68HSi3JDLfAJqqZjcA12FxWEFNbRo6L2VgJydojBn90etxCbEn-Oj586zDZ8s5jPEs5nf07trpHKDFzH4d63a9CbkfYxkj25k9KCkPArKu14Wj6IzJ_IF0_QvMDPw7Aaof8NgermiO_59wp0bJl20TZorB98PuIRTEo3fzAgIneLw-7GiRauY78KhELSHWcSj6A7oolyQAoPMmTZhJjjUqrqIpPHdLCj4rBLQ5i-6u2cgHkdDdcpEISy7olclIrp0v7AW-ql30oNI5p-it63Pg1KHNkYy5wgWHtP-Me4vjFEm_8ZD_2pilxDuaJBnF8CgzQnSx8J8oEc7H-C7dbPt2LQai-YyY4dskRLOzz3MSPlp01yWauR7_uIHsQqB4RSwl2hmD3OAU9AzAg1EUeOrvTp6m0cCrv-lbWPyjxhUTcM6hCrQh9OEdSX9yrDXj9sOfVIUB5oKV_VH09XBprCBxj1fBtq925dd3aOQOVKZTOngFsnrSoeQMNRFMIOfH_QtxVrzfjyvaV1chdwwnldIjU13iikXgLV1MkI009ZVAVjm3oKSP_rJcLUSqDVaqMNWgwwqUjy3H2WmjfRwCMWoZFMQ4f31hCookwURT4-xcbVtHNSg4yxf5jTXgrcTpC-iVeUmCWITxuWbD_5SK2mL0ZjSRkasJilqDmJoerpnD5XhbhuehLrZjraMlWgVSn3iv0VKkKHlp2_Jz8Sms6br2Cis1hTuUXtoBuvdHbsjNPIPy_AixmG1PAyXQUQde7lMIP6leaToSRGBlKNL3pty6kPaTzBUnBYbzywbKWm-026c9qqiMtTnpsCF1tQhuPD9dDngDdqeMNKw4rVRNZH-Qj_kH_I0cF9IXMPo__p48e52XdoV7nlTJHJEJb_nRMJKiQ-SqXl5WVbZtjYkJ4Cnme28n4ZJm_YG7BxIjrthNJT4YVzr_gx5wXS-AarMU4vO2VanzF7Zzj4aDu_YONbAO-VmbfXiuMQ4PMEf9brXRcxvvG3w2eL7QRpVKFcA_QnrIoHPZryTjcvoi0GM53nAWTy4HJIJdGLfjn7TX-mS2UcvEQRuO6uWhaYBmzxfwM5VCnj4avGjE1qDbLEJ4KInb7_Vqd-EfqEx_7GVQgQcasNFEKZH1g&cid=CAQSOwDICaaNK7cDtYM2eQkkvSB_2qqYmG9TSTsDqoGLdpVO_8ZWi2Iz4okgXdK6f3KMiQr4PdRvFsm45JuDGAE&dv3_ver=m202309120101&rfl=http%3A%2F%2Fdocplayer.net%2F&ds=l&xdt=1&iif=1&cor=17820813235555064000&adk=2988274607&idt=254&cac=0&dtd=9

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 275349
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 20 Sep 2024 12:26:28 GMT

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame D941 12 KB
4 KB 75ms
26ms Script
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1695574535939630&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCKy5VB2oQZe6sOeShi9YPvO79gAym5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0K4G8T5W3xghW6RgHru0eY51Ct2taW1eCRxJ5UwsguYduDOOMlsOsBjmfwE_iqnFcQInvSUCx5YNbo-QXbjbGuDHA2xsf2IEjF0QUc52q1yEBogjAdxuEKCFHguL3Nh-HzCpn1u0rQaiv6sdIz0oTdc1PFSrvnO5oIQNCUg9Ve8guaeFr-rmmk60Qof5rl0hW-XeDUhJ7OHDyOWeorAKDv_eMfQJMh008fNEnOUgiSB2USPb8tXBfct0uqdq6Lg4EzAenEJ8-PMQV1YDsGR1RUCzna1GGJFw4e5B4hMCHNO_nM7TWlnikSMTrQPABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIrsyer9vDgQMV5NDCBB08dx_AEAEYASAAEgLngPD_BwE%26num%3D1%26cid%3DCAQSOwDICaaNK7cDtYM2eQkkvSB_2qqYmG9TSTsDqoGLdpVO_8ZWi2Iz4okgXdK6f3KMiQr4PdRvFsm45JuDGAE%26sig%3DAOD64_2eQzHX0np56-KSRj0ZWfyv75otZw%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-DldoRQPAi2cD1Bbpn9diF8TT7hHMOhYyYereyjgxV4ezmk6bEeqM7K-chd-Ip9FEpWif9CP54rFv2gJ4Y-_1CGpErj7OatAYWjBezxni0GR5HdyV9SfhZD1VeBakjWfnA027XqIUdR_PL-ZlpajiO0-WUdtg4VjlomNHSBEmNJmTBL2Sk%26cry%3D1%26dbm_d%3DAKAmf-CKaTbAsbJmoeAAvTtU-AFMo6Wg_QtDuQfdEiQwlO2ToxGm47NVSfNmXPiz85aWPfhjZuC30e3-J_OzzqnbYqUc_O2_43I9UzL169w65eRb0oHskV2Zyz-1JUFZ_WMT9XkunQ3H9cxwZZ4Y8AqmQtImOLGFIbQIO_WLNTVD5lKoq-4iRYimrZf9EGuyloWfWtYgZAXwHvhwc8JzYFYaD-6Ns_rArkl_vJeMPwAtGkxyOlQtjwhArUV94qoBlg5dmnjNVo4lyJsWahaWkXFLCpIw4mhm0fijRviMuarD1EhAwihNo-nqJqcGZqI57aPY6i0Ek425yHXj9GoCjPpF9w0r0ujHoz2QhQaW-0u6jC9uOyYWuLjkIUvW3r_kngvJmDuT-ypxqGASZ4Zs1tTRPi1k5HZSvlss0GnK76dBjgMGjzUnRRfI2rCZC-BudjiuslAWjJzuuOYFwsHv9m_OXSGN5W9lJi9FMcUa97lwfXhUyET3n-PVdUL_9RFHPupcAzC30fp4TtOhMEwE4YTWU9sKFrkQmaysdnVm2p1dimhmf4r-f6IOVimp8VCrcy0bsJMKM0R5VGv3RbshSrFoi8mhS4q-oSRigXDrDSVusAZOW2wICTPpkQfatU955w5pvOdXMI_1sLW8ufX19t7-mkn8TAm9A8Z7LNqDiUhGjMPl51ganfqif7EddLZaUHlX6Qk8KaxQ0lUeORMScenN0kWAHHkmkA%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 45c31730c1d5e8a0761c024299cfe48af765d3ae4337d252ce0cd024d99df985

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4318
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A7FD 22 KB
8 KB 21ms
20ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 275349
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 21 Sep 2023 12:26:28 GMT
expires: Fri, 20 Sep 2024 12:26:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame F5E2 22 KB
8 KB 21ms
20ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 275349
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 21 Sep 2023 12:26:28 GMT
expires: Fri, 20 Sep 2024 12:26:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request.php Show response
hal900014.redintelligence.net/ Frame EDB4 4 KB
2 KB 163ms
100ms Script
application/x-javascript 176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=5edfce6ec6&subid=&uid=fea81e04457db706&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCpewgB2oQZerDOfPBtOUPhKGW4Amm5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0Lq2c_RPT6KQhSmfjL3XrfFiStWduxcXiKuBfNsoZXNwGvkhV3prZuIv0qk84p6_MLN00bjZpKpwQhtoEtCeupfjTczpjPiDYQ4GJKLNIT16wIP4oABDbKLlRHc4vsP3P-sMFEyVfG1IxTGXJ-PH9ENr52xr_msFZ1-5vaIjl0Z9Df2sMtDpAWUklNvkuaKH5LQs-Ih82IUFedI0BvzzLBJe-r0bIFR1PHlD8bBf7bq5bnc9vQn8tu1YKeSGhtkwILPFDOCwxH-aLC9byMbiET7ARi2Z3zKOeCOp9u8QA-7rjR6Sn4yBxHVIElDABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIquOer9vDgQMV8yCtBh2EkAWcEAEYASAAEgKon_D_BwE%26num%3D1%26cid%3DCAQSOwDICaaNNKdirMATOjldqJn4SqzEIMwXt0RjxOEWzU1dPcImwNJ_2CW_VO5yAiiZjnfRwY48pV7U_9ufGAE%26sig%3DAOD64_1kwgR2Y6uskeiGe6f1Fn35-fYPEg%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-DpEEbCUSvcxkVCuzAlOLDzNVwYi6rfklNWhOWXApzZgA2_7TYh0AvL_o0HPZB_uAA8Fwr_mHDDwvlo-tZBb7Z09zatdZFXGnN8RNMyMfXWNW9rhi2TcTYRfpbEZViofcPkF7tjE_uYzWO2JXrG5ZIXxAXPviKs0PueV7ZWUhmBipINh1c%26cry%3D1%26dbm_d%3DAKAmf-CpUOShDQqqdTP8_rwqX6V29gcXKULGi2hV5rxklGGBg-wPJNRPsebxqI0yHLvYmupmMxWS5foKlp0j5G0eAGQD4rargYEip04b_Qyr74z88gc2-YD4nCmwAr9oiG9zpfLYwSgsCy_3lcgbpNSHQz_astDrZNK90RaFIQOGZBa7TEI0E9vWakaEI5MxyBUXM5YhJ3eBQ8h-q89t4fbAZLd4crW7A8ASALTsfqbfytRffrP8vp3CpxDV2AYI254KRrxYSN8utu3N250pCAHIiPiIHmB4sRKgESTgltX9zrgbRQG7Ek7J6LGudwiaruH8zKsPWCBnQLhbrfQGSpxaQ2Exhikqb9XazRSZ1nin5dxCq12uLpnNznj4mpJFieMj-c5_57BaOx0jKSSOo-2ANF0P0stb-XYtnJzRygbm79lVN1cR3qjInARuPHMpIL3SyErxXgTgt443OzIV2GF8dVVdl0BO2aVFf4UURyD9r9xrdyLI1O4wVJOVR9qErdP5H5MBaHOVqNBNzJcMD-6_eMQRPOyzn7giS5VdqfBlWJMPKuzhWQNlhG_7lxpKnkLblWIdtSJsvVpGlJd2FaFsm80m7JNpKhBUxVhntSiTN2I9CWwR7GeOvrCH0AQu9w_X0AR-1Nw25sKd8TXZuwoGxpkMqubP-0nFZaSw93wq8OYPyceoxAcD1GL3FvS6jF0cgaczSuxInClwErt8bOvm5wpHoFqxbA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D687377255%26adf%3D1097532353%26pi%3Dt.aa~a.1853940267~rp.4%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1456%26idt%3D1%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%252C368x280%252C368x280%252C368x280%26nras%3D6%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D15%26ady%3D3945%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D9%26uci%3Da!9%26btvi%3D6%26fsb%3D1%26xpc%3DQLB7WWkqKP%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D34&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=1168230154660&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1695574535942570&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCpewgB2oQZerDOfPBtOUPhKGW4Amm5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0Lq2c_RPT6KQhSmfjL3XrfFiStWduxcXiKuBfNsoZXNwGvkhV3prZuIv0qk84p6_MLN00bjZpKpwQhtoEtCeupfjTczpjPiDYQ4GJKLNIT16wIP4oABDbKLlRHc4vsP3P-sMFEyVfG1IxTGXJ-PH9ENr52xr_msFZ1-5vaIjl0Z9Df2sMtDpAWUklNvkuaKH5LQs-Ih82IUFedI0BvzzLBJe-r0bIFR1PHlD8bBf7bq5bnc9vQn8tu1YKeSGhtkwILPFDOCwxH-aLC9byMbiET7ARi2Z3zKOeCOp9u8QA-7rjR6Sn4yBxHVIElDABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIquOer9vDgQMV8yCtBh2EkAWcEAEYASAAEgKon_D_BwE%26num%3D1%26cid%3DCAQSOwDICaaNNKdirMATOjldqJn4SqzEIMwXt0RjxOEWzU1dPcImwNJ_2CW_VO5yAiiZjnfRwY48pV7U_9ufGAE%26sig%3DAOD64_1kwgR2Y6uskeiGe6f1Fn35-fYPEg%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-DpEEbCUSvcxkVCuzAlOLDzNVwYi6rfklNWhOWXApzZgA2_7TYh0AvL_o0HPZB_uAA8Fwr_mHDDwvlo-tZBb7Z09zatdZFXGnN8RNMyMfXWNW9rhi2TcTYRfpbEZViofcPkF7tjE_uYzWO2JXrG5ZIXxAXPviKs0PueV7ZWUhmBipINh1c%26cry%3D1%26dbm_d%3DAKAmf-CpUOShDQqqdTP8_rwqX6V29gcXKULGi2hV5rxklGGBg-wPJNRPsebxqI0yHLvYmupmMxWS5foKlp0j5G0eAGQD4rargYEip04b_Qyr74z88gc2-YD4nCmwAr9oiG9zpfLYwSgsCy_3lcgbpNSHQz_astDrZNK90RaFIQOGZBa7TEI0E9vWakaEI5MxyBUXM5YhJ3eBQ8h-q89t4fbAZLd4crW7A8ASALTsfqbfytRffrP8vp3CpxDV2AYI254KRrxYSN8utu3N250pCAHIiPiIHmB4sRKgESTgltX9zrgbRQG7Ek7J6LGudwiaruH8zKsPWCBnQLhbrfQGSpxaQ2Exhikqb9XazRSZ1nin5dxCq12uLpnNznj4mpJFieMj-c5_57BaOx0jKSSOo-2ANF0P0stb-XYtnJzRygbm79lVN1cR3qjInARuPHMpIL3SyErxXgTgt443OzIV2GF8dVVdl0BO2aVFf4UURyD9r9xrdyLI1O4wVJOVR9qErdP5H5MBaHOVqNBNzJcMD-6_eMQRPOyzn7giS5VdqfBlWJMPKuzhWQNlhG_7lxpKnkLblWIdtSJsvVpGlJd2FaFsm80m7JNpKhBUxVhntSiTN2I9CWwR7GeOvrCH0AQu9w_X0AR-1Nw25sKd8TXZuwoGxpkMqubP-0nFZaSw93wq8OYPyceoxAcD1GL3FvS6jF0cgaczSuxInClwErt8bOvm5wpHoFqxbA%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.26.250 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: 9ddfe30389f04beba5dc76126fbdf5e0f3b4989afc9f02b87a65a4e658fb3c54

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 54363700101959804444994012457014
Connection: close
Content-Length: 1330
Expires: Sun, 24 Sep 2023 17:55:37 +0200

GET
H3 200 hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js Show response
pagead2.googlesyndication.com/bg/ Frame A7FD 37 KB
14 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85de8e1049567f060665a08f4f9784af156edc484723473acd40953eb3bde550

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 07:19:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 380173
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14709
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 07:19:24 GMT

GET
H/1.1 200
OK request.php Show response
hal900014.redintelligence.net/ Frame D941 4 KB
2 KB 147ms
98ms Script
application/x-javascript 176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=42be7a0425&subid=&uid=e39df99d6e704b08&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCKy5VB2oQZe6sOeShi9YPvO79gAym5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0K4G8T5W3xghW6RgHru0eY51Ct2taW1eCRxJ5UwsguYduDOOMlsOsBjmfwE_iqnFcQInvSUCx5YNbo-QXbjbGuDHA2xsf2IEjF0QUc52q1yEBogjAdxuEKCFHguL3Nh-HzCpn1u0rQaiv6sdIz0oTdc1PFSrvnO5oIQNCUg9Ve8guaeFr-rmmk60Qof5rl0hW-XeDUhJ7OHDyOWeorAKDv_eMfQJMh008fNEnOUgiSB2USPb8tXBfct0uqdq6Lg4EzAenEJ8-PMQV1YDsGR1RUCzna1GGJFw4e5B4hMCHNO_nM7TWlnikSMTrQPABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIrsyer9vDgQMV5NDCBB08dx_AEAEYASAAEgLngPD_BwE%26num%3D1%26cid%3DCAQSOwDICaaNK7cDtYM2eQkkvSB_2qqYmG9TSTsDqoGLdpVO_8ZWi2Iz4okgXdK6f3KMiQr4PdRvFsm45JuDGAE%26sig%3DAOD64_2eQzHX0np56-KSRj0ZWfyv75otZw%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-DldoRQPAi2cD1Bbpn9diF8TT7hHMOhYyYereyjgxV4ezmk6bEeqM7K-chd-Ip9FEpWif9CP54rFv2gJ4Y-_1CGpErj7OatAYWjBezxni0GR5HdyV9SfhZD1VeBakjWfnA027XqIUdR_PL-ZlpajiO0-WUdtg4VjlomNHSBEmNJmTBL2Sk%26cry%3D1%26dbm_d%3DAKAmf-CKaTbAsbJmoeAAvTtU-AFMo6Wg_QtDuQfdEiQwlO2ToxGm47NVSfNmXPiz85aWPfhjZuC30e3-J_OzzqnbYqUc_O2_43I9UzL169w65eRb0oHskV2Zyz-1JUFZ_WMT9XkunQ3H9cxwZZ4Y8AqmQtImOLGFIbQIO_WLNTVD5lKoq-4iRYimrZf9EGuyloWfWtYgZAXwHvhwc8JzYFYaD-6Ns_rArkl_vJeMPwAtGkxyOlQtjwhArUV94qoBlg5dmnjNVo4lyJsWahaWkXFLCpIw4mhm0fijRviMuarD1EhAwihNo-nqJqcGZqI57aPY6i0Ek425yHXj9GoCjPpF9w0r0ujHoz2QhQaW-0u6jC9uOyYWuLjkIUvW3r_kngvJmDuT-ypxqGASZ4Zs1tTRPi1k5HZSvlss0GnK76dBjgMGjzUnRRfI2rCZC-BudjiuslAWjJzuuOYFwsHv9m_OXSGN5W9lJi9FMcUa97lwfXhUyET3n-PVdUL_9RFHPupcAzC30fp4TtOhMEwE4YTWU9sKFrkQmaysdnVm2p1dimhmf4r-f6IOVimp8VCrcy0bsJMKM0R5VGv3RbshSrFoi8mhS4q-oSRigXDrDSVusAZOW2wICTPpkQfatU955w5pvOdXMI_1sLW8ufX19t7-mkn8TAm9A8Z7LNqDiUhGjMPl51ganfqif7EddLZaUHlX6Qk8KaxQ0lUeORMScenN0kWAHHkmkA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D1567995846%26adf%3D1403646308%26pi%3Dt.aa~a.2652211261~rp.4%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%252C368x280%252C368x280%26nras%3D5%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1208%26ady%3D3773%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D8%26uci%3Da!8%26btvi%3D5%26fsb%3D1%26xpc%3DCX7ez5xCT1%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D30&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=781247138916&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1695574535939630&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCKy5VB2oQZe6sOeShi9YPvO79gAym5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0K4G8T5W3xghW6RgHru0eY51Ct2taW1eCRxJ5UwsguYduDOOMlsOsBjmfwE_iqnFcQInvSUCx5YNbo-QXbjbGuDHA2xsf2IEjF0QUc52q1yEBogjAdxuEKCFHguL3Nh-HzCpn1u0rQaiv6sdIz0oTdc1PFSrvnO5oIQNCUg9Ve8guaeFr-rmmk60Qof5rl0hW-XeDUhJ7OHDyOWeorAKDv_eMfQJMh008fNEnOUgiSB2USPb8tXBfct0uqdq6Lg4EzAenEJ8-PMQV1YDsGR1RUCzna1GGJFw4e5B4hMCHNO_nM7TWlnikSMTrQPABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIrsyer9vDgQMV5NDCBB08dx_AEAEYASAAEgLngPD_BwE%26num%3D1%26cid%3DCAQSOwDICaaNK7cDtYM2eQkkvSB_2qqYmG9TSTsDqoGLdpVO_8ZWi2Iz4okgXdK6f3KMiQr4PdRvFsm45JuDGAE%26sig%3DAOD64_2eQzHX0np56-KSRj0ZWfyv75otZw%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-DldoRQPAi2cD1Bbpn9diF8TT7hHMOhYyYereyjgxV4ezmk6bEeqM7K-chd-Ip9FEpWif9CP54rFv2gJ4Y-_1CGpErj7OatAYWjBezxni0GR5HdyV9SfhZD1VeBakjWfnA027XqIUdR_PL-ZlpajiO0-WUdtg4VjlomNHSBEmNJmTBL2Sk%26cry%3D1%26dbm_d%3DAKAmf-CKaTbAsbJmoeAAvTtU-AFMo6Wg_QtDuQfdEiQwlO2ToxGm47NVSfNmXPiz85aWPfhjZuC30e3-J_OzzqnbYqUc_O2_43I9UzL169w65eRb0oHskV2Zyz-1JUFZ_WMT9XkunQ3H9cxwZZ4Y8AqmQtImOLGFIbQIO_WLNTVD5lKoq-4iRYimrZf9EGuyloWfWtYgZAXwHvhwc8JzYFYaD-6Ns_rArkl_vJeMPwAtGkxyOlQtjwhArUV94qoBlg5dmnjNVo4lyJsWahaWkXFLCpIw4mhm0fijRviMuarD1EhAwihNo-nqJqcGZqI57aPY6i0Ek425yHXj9GoCjPpF9w0r0ujHoz2QhQaW-0u6jC9uOyYWuLjkIUvW3r_kngvJmDuT-ypxqGASZ4Zs1tTRPi1k5HZSvlss0GnK76dBjgMGjzUnRRfI2rCZC-BudjiuslAWjJzuuOYFwsHv9m_OXSGN5W9lJi9FMcUa97lwfXhUyET3n-PVdUL_9RFHPupcAzC30fp4TtOhMEwE4YTWU9sKFrkQmaysdnVm2p1dimhmf4r-f6IOVimp8VCrcy0bsJMKM0R5VGv3RbshSrFoi8mhS4q-oSRigXDrDSVusAZOW2wICTPpkQfatU955w5pvOdXMI_1sLW8ufX19t7-mkn8TAm9A8Z7LNqDiUhGjMPl51ganfqif7EddLZaUHlX6Qk8KaxQ0lUeORMScenN0kWAHHkmkA%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.26.250 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: af17ac2065f28bf520d2fbe2fe23f4be3a341a5fe5fd2eb76b244b4e7b2a3ac8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 25224300101959904444994012457014
Connection: close
Content-Length: 1355
Expires: Sun, 24 Sep 2023 17:55:37 +0200

GET
H3 200 hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js Show response
pagead2.googlesyndication.com/bg/ Frame F5E2 37 KB
14 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hd6OEElWfwYGZaCPT5eErxVu3EhHI0c6zUCVPrO95VA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85de8e1049567f060665a08f4f9784af156edc484723473acd40953eb3bde550

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 07:19:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 380173
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14709
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 07:19:24 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3090 0
20 B 127ms
126ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B-QToCGoQZfvXMuPmx_APz86DiAQAAAAAOAHgBAI&bg=!3d6l3pHNAAYrDsWMCw47ADQBe5WfOMOLSQzquA8qsAO7Nx3AwXh8HJ6ykDxw4nzsJuuNJvFJoLbvjWAEpGD45XBURc3qAgAAAINSAAAABWgBB5kDB59Cjguq3ruGEJuxsZrpVHcs19cNbvWp2sHOwolxpOufLc2I_zJW1tO0nnaDL1oa8XJBZ19ZKTtlFTL8lXF4jc0GNPfmjDgyRCNudbeIrDPeQxO11QX6T3bJiCzbx1hevf0bNQshkAy0afszG0FvLNj5OP9iNwfvvwWbDla3AiM3u3TqVcZx1yYKDu8_bbV_OxmgYDIlHr7SIPEWrMnFu_t8mm5qReHPgVzKGXVRTmzJQKF5RlGb_DxKXaclbAbV9PUUnTSUUy3oJVeglELeX9gcEiuIxoJQmLHK0GapsLj18TZ-0TS4j7llwkTXf-7zrO1xrvRT8jWUvtbZ_fPpU1iDXlUPZmekK-F4F340N79CRFxmhXdhgivYi38D5SIScJsnMJ7kVND0eNR-PZKoOc3VgTxEKcbU7Lh0Wst6Bk_H1KDZNJmkve9elvTiYW9Bc1Tbw40amFLKuTwcX-zGbsheipV0WNDxGtPYndP6RgiRrj_Qcg69OAMkfd7rniYcNOmDUkj6SX55n5MgVFF8fX7xGU6zhQlMOpoeB1bMP1pEUrnAHIXQi_hvD8MkBs_xDnZKIwYuXy562xGmAyX-PFFNu53x5OKBosqrYOFxw8FAZk5pL5APjGwgvjd5RJGnbwnv1XGs19wEWOK71Z6G6CpSAdSAVm543eFiSDq7oXAeHBm1Q4eAX_A2ot9x73NADvUuit6yMKLWRubdpOuaj8hgPZaOD8Byd-Bhy7pXgky9lLlMg8-yg7LapM2pj1OhrxLGKm9moZKqpYQ1Id8moFgnHaqQzgM5cQl4N9YE9ueHvIhkpPhY4yZa7GcU-LqC25bh9wHJDNe-agdBmUSHkT3AfFnk4hVvJEvQ4aPigOATJm1M08jr-3NISNVKxvsz-gwGNBKQSm8Dsz348TV4K2Fwvm8MeNBxEoHbNuGWSWBjhN5UwbbZWmlOnNdwOrCQFbUxu8Kf-7S0Zxoo6qa8p0d_Ywo9Fn1N86FZJIO9U-0YMVTtVKHhTaupucr4hoZ0mjWwJrMDfmM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK e99aace94e6e5873881d3400993e1e7e Show response
pv.medialead.de/trck/epv/ Frame 259D 0
467 B 253ms
179ms Document
application/javascript 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=53980700112083004444994012457028&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: hal900028.redintelligence.net
URL: https://hal900028.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=a85b61c703&subid=&uid=11779aefb9af234c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fad.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCkb8zB2oQZdnnM6qH1fAPz7iIkAam5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE4wFP0D66GYnxaZlrzE1bXHeH7agzXa7lqGQ2s6X82CU3o0bgijvxi5xrxmMViY1i85gLdoGLCZqrqJt3iz_jnKO0eEC3G48NnKVvknwEJTVwappp30UGYcMOOP6QwaXiSihn5vq5eCHGRpda6OXpicnIHBuXwsJQWeYEj09daUvbIbbljwcZ2Lg_Rxzzd7mKnJDOzxp1xRWw_ysSxkGjvA_jTa6YpQd6Jyp8kAwBktTks6D5ZcdWZWDB9Pi5C-Kw3zpbMa8b5CrUILV-40sl6tU2zg9a-9aTimq4TlbjneBxR0noLsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMImYeZr9vDgQMVqkMVCB1PHAJiEAEYASAAEgIUB_D_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW5EgOa6nXPpoT5SBiAnTY9bDFi1Kse5S5ExrWEq65P1klsuqzNO3MonEC-i0SPVEKA75I2QaCGAE%26sig%3DAOD64_2epWSa5dEH1g2P6ZuFGFyv9tgs7Q%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-C_YY4bcI84HFniOjTS0xWXFW1psxX47S3Mkk5Af9hONGuRPrYJKrupk4ftSwwJG93k0ldLVo8e9HCQUZwFbsmtOn2IDufizplL4VB0xuPZCknKcsOH0dU_2qcdr2l2pvEE6YNYrvMV-VL_Ce_ucZWCZP_qo5vRsDOwOo7aJ0YPH1DDrfA%26cry%3D1%26dbm_d%3DAKAmf-BqXrz6YkQmQLY42M56ie3HFPm7vB9NHb-RKvdyEkpuTntaDJtE71-JOjBPXJQ62vUWwdfr2LkYRRu-c_wOgBk75syLwJYUIvxBi3TbpQ0RimQ0nBzJ_ygjsqA_lyEekAaVke_3uZepNDGSXgXDmZzcu4TwKq-p1toGdSbxjuIeBkFcmPDnPNZjoti8sb3lHRnO4IT7W2NN5N4cUg063gvlV2-0RoXe9Qh-KpL0JSQS-LEaRHITLqKXuSdBKFSL8BDBkeuEZwQQhdfj7QeJS9AYmr5KRviI_W6UO5QFQlKFYSHs_hMQl4EuSmTbrctca1abOOZq5SN67WlcaqLEvP_j6_dzJU4qKXBEcRBiAczHtnZlze4xZQUsYlL3MUUlMOOBAymapEwaeUQZOQmKjK-guA-vo-61pJh7Ztxwjk9MfSS3ob1vea0IFO02EY2muF1Xy6pm5Yix8sURedOWgpJboMVPPyb8AsEX-3SsW96wq_FbC1R2ENJoz_FbBdyMN9m7vPZ9061xglpfku0nl3ihocdFDqmgk-GMwCQWeTIamaax3hJMVDB0uLTF7gKBU-i4e0cRxKNHzw3Ktz_UHLWBnKlxGu6oN5sao8D9lnMz05DDN40-B7CQos0H3c-XyVQ77wjxeAguTIwbC1v0Iqy71jLma3X8AJnaH9MjBV5Ah_qfBcLrBh3hMdvJ1G488zFBGmpB9O3co2AHAq0swja3FRCf1A%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D10950491%26adf%3D3202966620%26pi%3Dt.aa~a.1856536719~rp.2%26w%3D348%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D348x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%26nras%3D2%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1218%26ady%3D1855%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D5%26uci%3Da!5%26btvi%3D2%26fsb%3D1%26xpc%3DJli3MZYwUS%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D12&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=3846793093027&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Content-Length: 0
Content-Type: application/javascript; charset=utf-8
Date: Sun, 24 Sep 2023 16:55:37 GMT
Host: pv.medialead.de
Proxy-Host: pv.medialead.de
Server: nginx
Strict-Transport-Security: max-age=15768000
Vary: Origin
X-IPLB-Instance: 40027
X-IPLB-Request-ID: D972D785:CD6A_91EFC182:01BB_65106A09_180FE02F:22021

GET
H2 200 / Show response
adv.office-partner.de/ Frame 9EEB 930 B
932 B 96ms
21ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900028.redintelligence.net
URL: https://hal900028.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=a85b61c703&subid=&uid=11779aefb9af234c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fad.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCkb8zB2oQZdnnM6qH1fAPz7iIkAam5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE4wFP0D66GYnxaZlrzE1bXHeH7agzXa7lqGQ2s6X82CU3o0bgijvxi5xrxmMViY1i85gLdoGLCZqrqJt3iz_jnKO0eEC3G48NnKVvknwEJTVwappp30UGYcMOOP6QwaXiSihn5vq5eCHGRpda6OXpicnIHBuXwsJQWeYEj09daUvbIbbljwcZ2Lg_Rxzzd7mKnJDOzxp1xRWw_ysSxkGjvA_jTa6YpQd6Jyp8kAwBktTks6D5ZcdWZWDB9Pi5C-Kw3zpbMa8b5CrUILV-40sl6tU2zg9a-9aTimq4TlbjneBxR0noLsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMImYeZr9vDgQMVqkMVCB1PHAJiEAEYASAAEgIUB_D_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW5EgOa6nXPpoT5SBiAnTY9bDFi1Kse5S5ExrWEq65P1klsuqzNO3MonEC-i0SPVEKA75I2QaCGAE%26sig%3DAOD64_2epWSa5dEH1g2P6ZuFGFyv9tgs7Q%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-C_YY4bcI84HFniOjTS0xWXFW1psxX47S3Mkk5Af9hONGuRPrYJKrupk4ftSwwJG93k0ldLVo8e9HCQUZwFbsmtOn2IDufizplL4VB0xuPZCknKcsOH0dU_2qcdr2l2pvEE6YNYrvMV-VL_Ce_ucZWCZP_qo5vRsDOwOo7aJ0YPH1DDrfA%26cry%3D1%26dbm_d%3DAKAmf-BqXrz6YkQmQLY42M56ie3HFPm7vB9NHb-RKvdyEkpuTntaDJtE71-JOjBPXJQ62vUWwdfr2LkYRRu-c_wOgBk75syLwJYUIvxBi3TbpQ0RimQ0nBzJ_ygjsqA_lyEekAaVke_3uZepNDGSXgXDmZzcu4TwKq-p1toGdSbxjuIeBkFcmPDnPNZjoti8sb3lHRnO4IT7W2NN5N4cUg063gvlV2-0RoXe9Qh-KpL0JSQS-LEaRHITLqKXuSdBKFSL8BDBkeuEZwQQhdfj7QeJS9AYmr5KRviI_W6UO5QFQlKFYSHs_hMQl4EuSmTbrctca1abOOZq5SN67WlcaqLEvP_j6_dzJU4qKXBEcRBiAczHtnZlze4xZQUsYlL3MUUlMOOBAymapEwaeUQZOQmKjK-guA-vo-61pJh7Ztxwjk9MfSS3ob1vea0IFO02EY2muF1Xy6pm5Yix8sURedOWgpJboMVPPyb8AsEX-3SsW96wq_FbC1R2ENJoz_FbBdyMN9m7vPZ9061xglpfku0nl3ihocdFDqmgk-GMwCQWeTIamaax3hJMVDB0uLTF7gKBU-i4e0cRxKNHzw3Ktz_UHLWBnKlxGu6oN5sao8D9lnMz05DDN40-B7CQos0H3c-XyVQ77wjxeAguTIwbC1v0Iqy71jLma3X8AJnaH9MjBV5Ah_qfBcLrBh3hMdvJ1G488zFBGmpB9O3co2AHAq0swja3FRCf1A%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D10950491%26adf%3D3202966620%26pi%3Dt.aa~a.1856536719~rp.2%26w%3D348%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D348x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%26nras%3D2%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1218%26ady%3D1855%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D5%26uci%3Da!5%26btvi%3D2%26fsb%3D1%26xpc%3DJli3MZYwUS%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D12&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=3846793093027&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Sun, 24 Sep 2023 16:55:37 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Sun, 01 Oct 2023 16:55:37 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 link.html Show response
track.webgains.com/ Frame 8E22 2 KB
2 KB 178ms
87ms Script
text/html 18.134.234.224
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=53980700112083004444994012457028&nw=1
Requested by: Host: docplayer.net
URL: http://docplayer.net/204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.134.234.224 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-134-234-224.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 2aadf3c24db4c4f7975ff48fab9c6b051497d3ac6b5ab035cc02cddc75edf13d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
last-modified: Sun, 24 Sep 2023 16:55:37 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Sun, 24 Sep 2023 16:56:37 GMT

GET
H2

200

activityi;dc_pre=CK-s9q_bw4EDFTPUOwIdLXwAJQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1100649423509.4055 Show response
8019191.fls.doubleclick.net/ Frame 94EB
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1100649423509.4055?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CK-s9q_bw4EDFTPUOwIdLXwAJQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1100649423509.4055?

392 B
329 B

69ms
68ms

Document
text/html

142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CK-s9q_bw4EDFTPUOwIdLXwAJQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1100649423509.4055?

Requested by

Host: docplayer.net
URL: http://docplayer.net/204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-212-218-19.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

9782f65bbfde198f0419845d0044a04cc3806841554f8b6c2ed5f630303148b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 218
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:37 GMT
expires: Sun, 24 Sep 2023 16:55:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:37 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CK-s9q_bw4EDFTPUOwIdLXwAJQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1100649423509.4055?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900028.redintelligence.net/ Frame CB52 7 KB
2 KB 70ms
24ms Document
text/html 88.99.165.19
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900028.redintelligence.net/request_content.php?s=53980700112083004444994012457028&a=d25c6cc4
Requested by: Host: hal900028.redintelligence.net
URL: https://hal900028.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=a85b61c703&subid=&uid=11779aefb9af234c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fad.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCkb8zB2oQZdnnM6qH1fAPz7iIkAam5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE4wFP0D66GYnxaZlrzE1bXHeH7agzXa7lqGQ2s6X82CU3o0bgijvxi5xrxmMViY1i85gLdoGLCZqrqJt3iz_jnKO0eEC3G48NnKVvknwEJTVwappp30UGYcMOOP6QwaXiSihn5vq5eCHGRpda6OXpicnIHBuXwsJQWeYEj09daUvbIbbljwcZ2Lg_Rxzzd7mKnJDOzxp1xRWw_ysSxkGjvA_jTa6YpQd6Jyp8kAwBktTks6D5ZcdWZWDB9Pi5C-Kw3zpbMa8b5CrUILV-40sl6tU2zg9a-9aTimq4TlbjneBxR0noLsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMImYeZr9vDgQMVqkMVCB1PHAJiEAEYASAAEgIUB_D_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW5EgOa6nXPpoT5SBiAnTY9bDFi1Kse5S5ExrWEq65P1klsuqzNO3MonEC-i0SPVEKA75I2QaCGAE%26sig%3DAOD64_2epWSa5dEH1g2P6ZuFGFyv9tgs7Q%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-C_YY4bcI84HFniOjTS0xWXFW1psxX47S3Mkk5Af9hONGuRPrYJKrupk4ftSwwJG93k0ldLVo8e9HCQUZwFbsmtOn2IDufizplL4VB0xuPZCknKcsOH0dU_2qcdr2l2pvEE6YNYrvMV-VL_Ce_ucZWCZP_qo5vRsDOwOo7aJ0YPH1DDrfA%26cry%3D1%26dbm_d%3DAKAmf-BqXrz6YkQmQLY42M56ie3HFPm7vB9NHb-RKvdyEkpuTntaDJtE71-JOjBPXJQ62vUWwdfr2LkYRRu-c_wOgBk75syLwJYUIvxBi3TbpQ0RimQ0nBzJ_ygjsqA_lyEekAaVke_3uZepNDGSXgXDmZzcu4TwKq-p1toGdSbxjuIeBkFcmPDnPNZjoti8sb3lHRnO4IT7W2NN5N4cUg063gvlV2-0RoXe9Qh-KpL0JSQS-LEaRHITLqKXuSdBKFSL8BDBkeuEZwQQhdfj7QeJS9AYmr5KRviI_W6UO5QFQlKFYSHs_hMQl4EuSmTbrctca1abOOZq5SN67WlcaqLEvP_j6_dzJU4qKXBEcRBiAczHtnZlze4xZQUsYlL3MUUlMOOBAymapEwaeUQZOQmKjK-guA-vo-61pJh7Ztxwjk9MfSS3ob1vea0IFO02EY2muF1Xy6pm5Yix8sURedOWgpJboMVPPyb8AsEX-3SsW96wq_FbC1R2ENJoz_FbBdyMN9m7vPZ9061xglpfku0nl3ihocdFDqmgk-GMwCQWeTIamaax3hJMVDB0uLTF7gKBU-i4e0cRxKNHzw3Ktz_UHLWBnKlxGu6oN5sao8D9lnMz05DDN40-B7CQos0H3c-XyVQ77wjxeAguTIwbC1v0Iqy71jLma3X8AJnaH9MjBV5Ah_qfBcLrBh3hMdvJ1G488zFBGmpB9O3co2AHAq0swja3FRCf1A%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D10950491%26adf%3D3202966620%26pi%3Dt.aa~a.1856536719~rp.2%26w%3D348%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D348x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%26nras%3D2%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1218%26ady%3D1855%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D5%26uci%3Da!5%26btvi%3D2%26fsb%3D1%26xpc%3DJli3MZYwUS%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D12&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=3846793093027&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.165.19 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.19.165.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 1ae91fb753d3a086524f69a4687d48f114956f43aef2a9f5e2c8dd7f52e6c1b2

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2094
Content-Type: text/html; charset=utf-8
Date: Sun, 24 Sep 2023 16:55:37 GMT
Expires: Sun, 24 Sep 2023 17:55:37 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame 8E22
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=53980700112083004444994012457028&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=53980700112083004444994012457028&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
483 B

1046ms
729ms

Image
image/gif

145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=53980700112083004444994012457028&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:38 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx
Host: pv.medialead.de
X-IPLB-Request-ID: D972D785:CD94_91EFC182:01BB_65106A09_180FE06D:22021
X-IPLB-Instance: 40027
Vary: Origin
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Access-Control-Allow-Credentials: true
Content-Length: 43
Proxy-Host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=53980700112083004444994012457028&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Sun, 24 Sep 2023 16:55:37 GMT
server: nginx
content-length: 154
content-type: text/html

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 8E22 43 B
702 B 146ms
80ms Image
image/gif 23.212.218.19
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=53980700112083004444994012457028&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.212.218.19 , United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:37 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 68FC 1 KB
643 B 21ms
20ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 76128
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 19:46:49 GMT
etag: 48472445140208031
expires: Sun, 24 Sep 2023 19:46:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 8E22 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 838e727d03dfd20f95b6f466ad135eeccb58128e500cd494ec9540e0fb1da808

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK e99aace94e6e5873881d3400993e1e7e Show response
pv.medialead.de/trck/epv/ Frame 3842 0
467 B 393ms
324ms Document
application/javascript 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=35726500116043204444994012457026&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=af919057b9&subid=&uid=3e9eb985345dba0a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC14quB2oQZZrnOIWV9AOK-aCIBKblvaBpvZOcp8kP8C4QASD52-xGYJWCgICYB8gBCakCYTFGH3HfsT6oAwHIA5sEqgTtAU_QUPJyh-48wh0deqfoq1zlQuKvbfBRnSGR5OW1EiRwY6sq7FpGnSuKkvI_kooH9MjkCF36K6jBaygQSgoVHbNxNG8fiy12fy3l_ye14Y7LeC3hskAqF5-O3THgWpC1xl8Q0r24-b9PWB37BPvQnRbJKf_86dmAlo2BS_1j4uJaproE_a1KcrrXDxW2p1wKKNdWXvXkjW5zKj_rqwmsX7OzDZFvgim6Meku5YsZIHygc7Qfa_2_SeXcO0TGrO3BTo0bxOsC9K6CXK4bKwXPWlh9vdMYuPh0v-k7VS4duYAqk0cv3yPl8HlfZh_JvsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMI2oaer9vDgQMVhQp9Ch2KPAhBEAEYASAAEgL6DvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJWNr7Lq-steX9dQ184bASuqgBT31VX84gMnCIlcgJz5e9TAe7LgtBmItqcqDcM_XNk6WV5Ax9HGAE%26sig%3DAOD64_0A3rVdtBLk2CzCN0KMgT09X4bdsQ%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-BYnBvTXDrgorqf0CaXqB191iBQOGXUHDnafJdI3JlxpSebHCPG3hElXbGkXdkrFzR5V8ScyVHM_Y3KiLrhejCUqEtHdvoVJf3j4u-bWa0LVedJJNdV0DZfJKuxiVwelhx6NQwNfn1Y_MzLLR0DWtUVyFZBl8hGu8ZVHyRCEfUUeauW1n8%26cry%3D1%26dbm_d%3DAKAmf-BV3GIrPH5nFbrmP9-zAVL2HpG4SSyh8RWN6N16nc6MP8eiHc4A1SVUT8J3qYOw6lcMVmwxim6w3X7b8VOvF09uBhYkJNtqvXm8GjKeb4WNOiDfG8Ivk_2YWsU8f9jGmMwt5ZGo6a1FouVMaqJ7vig3H48BbGO-TBJep9zeEx9GYoebMBOCN3pACyvyXVnnvNcPaEFlp2g9DKSs-Ll8SkZ9A27ZzwWcWpCM17cl3MxTdka9EMAn4nFfN1ybqlTCm7Ngq6Xp6E8kKOI7QfC2D4fDYW35jPx4BiyqfjOmIGSamrmsScaS4kTmh5y7BqrJopKIIf3rh5Xc3Vy9mFP4jQI4hV1FE5OaYt4LyQ0HkY5xaPtZKwJUDHd7SQOEKArh1f_zBMLPqPANC5ap9PMnG4jUehz5-t-0mpPkeLzS2XnSKLYW7YQ8EZ_L29R-aiWfhxMxbz_txLX1w5qV__DfE0puuXpP7qKvO2czOQVV65NO47yatnMB6IGfRRkQOhM2a8VL1KiTt4vvb_3dWd38NMCr5Aex2IPUt4v0AUMSpzpSCurnvgZHKKNrIhr5eibLurhjJXd8F0ToM7ejT3uezXhQ75UUCzZF0erpN6j3ONk0bgh7F2Zz_rSjAQy2bQHsKB7QOVsSXkwlcbawPhvIr3fT4SC3geXeb341OcsTxRCy5_SoNSGK3UT-k7U7qu5wlcqR6IcFdmwV-l06x2VOpik-XZWCjg%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D1567995846%26adf%3D724619058%26pi%3Dt.aa~a.1856579592~rp.4%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%26nras%3D3%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1208%26ady%3D2808%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D6%26uci%3Da!6%26btvi%3D3%26fsb%3D1%26xpc%3DZE5btzgJdW%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D17&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=6556199831092&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Content-Length: 0
Content-Type: application/javascript; charset=utf-8
Date: Sun, 24 Sep 2023 16:55:37 GMT
Host: pv.medialead.de
Proxy-Host: pv.medialead.de
Server: nginx
Strict-Transport-Security: max-age=15768000
Vary: Origin
X-IPLB-Instance: 40027
X-IPLB-Request-ID: D972D785:CD74_91EFC182:01BB_65106A09_180FE20A:22024

GET
H2 200 / Show response
adv.office-partner.de/ Frame BB39 930 B
931 B 64ms
22ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=af919057b9&subid=&uid=3e9eb985345dba0a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC14quB2oQZZrnOIWV9AOK-aCIBKblvaBpvZOcp8kP8C4QASD52-xGYJWCgICYB8gBCakCYTFGH3HfsT6oAwHIA5sEqgTtAU_QUPJyh-48wh0deqfoq1zlQuKvbfBRnSGR5OW1EiRwY6sq7FpGnSuKkvI_kooH9MjkCF36K6jBaygQSgoVHbNxNG8fiy12fy3l_ye14Y7LeC3hskAqF5-O3THgWpC1xl8Q0r24-b9PWB37BPvQnRbJKf_86dmAlo2BS_1j4uJaproE_a1KcrrXDxW2p1wKKNdWXvXkjW5zKj_rqwmsX7OzDZFvgim6Meku5YsZIHygc7Qfa_2_SeXcO0TGrO3BTo0bxOsC9K6CXK4bKwXPWlh9vdMYuPh0v-k7VS4duYAqk0cv3yPl8HlfZh_JvsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMI2oaer9vDgQMVhQp9Ch2KPAhBEAEYASAAEgL6DvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJWNr7Lq-steX9dQ184bASuqgBT31VX84gMnCIlcgJz5e9TAe7LgtBmItqcqDcM_XNk6WV5Ax9HGAE%26sig%3DAOD64_0A3rVdtBLk2CzCN0KMgT09X4bdsQ%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-BYnBvTXDrgorqf0CaXqB191iBQOGXUHDnafJdI3JlxpSebHCPG3hElXbGkXdkrFzR5V8ScyVHM_Y3KiLrhejCUqEtHdvoVJf3j4u-bWa0LVedJJNdV0DZfJKuxiVwelhx6NQwNfn1Y_MzLLR0DWtUVyFZBl8hGu8ZVHyRCEfUUeauW1n8%26cry%3D1%26dbm_d%3DAKAmf-BV3GIrPH5nFbrmP9-zAVL2HpG4SSyh8RWN6N16nc6MP8eiHc4A1SVUT8J3qYOw6lcMVmwxim6w3X7b8VOvF09uBhYkJNtqvXm8GjKeb4WNOiDfG8Ivk_2YWsU8f9jGmMwt5ZGo6a1FouVMaqJ7vig3H48BbGO-TBJep9zeEx9GYoebMBOCN3pACyvyXVnnvNcPaEFlp2g9DKSs-Ll8SkZ9A27ZzwWcWpCM17cl3MxTdka9EMAn4nFfN1ybqlTCm7Ngq6Xp6E8kKOI7QfC2D4fDYW35jPx4BiyqfjOmIGSamrmsScaS4kTmh5y7BqrJopKIIf3rh5Xc3Vy9mFP4jQI4hV1FE5OaYt4LyQ0HkY5xaPtZKwJUDHd7SQOEKArh1f_zBMLPqPANC5ap9PMnG4jUehz5-t-0mpPkeLzS2XnSKLYW7YQ8EZ_L29R-aiWfhxMxbz_txLX1w5qV__DfE0puuXpP7qKvO2czOQVV65NO47yatnMB6IGfRRkQOhM2a8VL1KiTt4vvb_3dWd38NMCr5Aex2IPUt4v0AUMSpzpSCurnvgZHKKNrIhr5eibLurhjJXd8F0ToM7ejT3uezXhQ75UUCzZF0erpN6j3ONk0bgh7F2Zz_rSjAQy2bQHsKB7QOVsSXkwlcbawPhvIr3fT4SC3geXeb341OcsTxRCy5_SoNSGK3UT-k7U7qu5wlcqR6IcFdmwV-l06x2VOpik-XZWCjg%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D1567995846%26adf%3D724619058%26pi%3Dt.aa~a.1856579592~rp.4%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%26nras%3D3%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1208%26ady%3D2808%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D6%26uci%3Da!6%26btvi%3D3%26fsb%3D1%26xpc%3DZE5btzgJdW%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D17&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=6556199831092&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Sun, 24 Sep 2023 16:55:37 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Sun, 01 Oct 2023 16:55:37 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 link.html Show response
track.webgains.com/ Frame A5D4 2 KB
2 KB 145ms
86ms Script
text/html 18.134.234.224
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=35726500116043204444994012457026&nw=1
Requested by: Host: docplayer.net
URL: http://docplayer.net/204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.134.234.224 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-134-234-224.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 33df91329483b378389b9c1efe462fde8423585ba91b9dea0b4c4118e74d9d91

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
last-modified: Sun, 24 Sep 2023 16:55:37 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Sun, 24 Sep 2023 16:56:37 GMT

GET
H2

200

activityi;dc_pre=CKm_-K_bw4EDFdLeOwId4CAFXg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3751566521091.7627 Show response
8019191.fls.doubleclick.net/ Frame D539
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3751566521091.7627?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CKm_-K_bw4EDFdLeOwId4CAFXg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3751566521091.7627?

392 B
285 B

65ms
65ms

Document
text/html

142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CKm_-K_bw4EDFdLeOwId4CAFXg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3751566521091.7627?

Requested by

Host: docplayer.net
URL: http://docplayer.net/204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-212-218-19.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

667ab349633ba1df8d25c84bc69c9e4da5678788a54837ea77b452c9d03619e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 218
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:37 GMT
expires: Sun, 24 Sep 2023 16:55:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:37 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CKm_-K_bw4EDFdLeOwId4CAFXg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3751566521091.7627?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900026.redintelligence.net/ Frame 5852 7 KB
2 KB 70ms
23ms Document
text/html 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900026.redintelligence.net/request_content.php?s=35726500116043204444994012457026&a=bed91e66
Requested by: Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=af919057b9&subid=&uid=3e9eb985345dba0a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC14quB2oQZZrnOIWV9AOK-aCIBKblvaBpvZOcp8kP8C4QASD52-xGYJWCgICYB8gBCakCYTFGH3HfsT6oAwHIA5sEqgTtAU_QUPJyh-48wh0deqfoq1zlQuKvbfBRnSGR5OW1EiRwY6sq7FpGnSuKkvI_kooH9MjkCF36K6jBaygQSgoVHbNxNG8fiy12fy3l_ye14Y7LeC3hskAqF5-O3THgWpC1xl8Q0r24-b9PWB37BPvQnRbJKf_86dmAlo2BS_1j4uJaproE_a1KcrrXDxW2p1wKKNdWXvXkjW5zKj_rqwmsX7OzDZFvgim6Meku5YsZIHygc7Qfa_2_SeXcO0TGrO3BTo0bxOsC9K6CXK4bKwXPWlh9vdMYuPh0v-k7VS4duYAqk0cv3yPl8HlfZh_JvsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMI2oaer9vDgQMVhQp9Ch2KPAhBEAEYASAAEgL6DvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJWNr7Lq-steX9dQ184bASuqgBT31VX84gMnCIlcgJz5e9TAe7LgtBmItqcqDcM_XNk6WV5Ax9HGAE%26sig%3DAOD64_0A3rVdtBLk2CzCN0KMgT09X4bdsQ%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-BYnBvTXDrgorqf0CaXqB191iBQOGXUHDnafJdI3JlxpSebHCPG3hElXbGkXdkrFzR5V8ScyVHM_Y3KiLrhejCUqEtHdvoVJf3j4u-bWa0LVedJJNdV0DZfJKuxiVwelhx6NQwNfn1Y_MzLLR0DWtUVyFZBl8hGu8ZVHyRCEfUUeauW1n8%26cry%3D1%26dbm_d%3DAKAmf-BV3GIrPH5nFbrmP9-zAVL2HpG4SSyh8RWN6N16nc6MP8eiHc4A1SVUT8J3qYOw6lcMVmwxim6w3X7b8VOvF09uBhYkJNtqvXm8GjKeb4WNOiDfG8Ivk_2YWsU8f9jGmMwt5ZGo6a1FouVMaqJ7vig3H48BbGO-TBJep9zeEx9GYoebMBOCN3pACyvyXVnnvNcPaEFlp2g9DKSs-Ll8SkZ9A27ZzwWcWpCM17cl3MxTdka9EMAn4nFfN1ybqlTCm7Ngq6Xp6E8kKOI7QfC2D4fDYW35jPx4BiyqfjOmIGSamrmsScaS4kTmh5y7BqrJopKIIf3rh5Xc3Vy9mFP4jQI4hV1FE5OaYt4LyQ0HkY5xaPtZKwJUDHd7SQOEKArh1f_zBMLPqPANC5ap9PMnG4jUehz5-t-0mpPkeLzS2XnSKLYW7YQ8EZ_L29R-aiWfhxMxbz_txLX1w5qV__DfE0puuXpP7qKvO2czOQVV65NO47yatnMB6IGfRRkQOhM2a8VL1KiTt4vvb_3dWd38NMCr5Aex2IPUt4v0AUMSpzpSCurnvgZHKKNrIhr5eibLurhjJXd8F0ToM7ejT3uezXhQ75UUCzZF0erpN6j3ONk0bgh7F2Zz_rSjAQy2bQHsKB7QOVsSXkwlcbawPhvIr3fT4SC3geXeb341OcsTxRCy5_SoNSGK3UT-k7U7qu5wlcqR6IcFdmwV-l06x2VOpik-XZWCjg%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D1567995846%26adf%3D724619058%26pi%3Dt.aa~a.1856579592~rp.4%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%26nras%3D3%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1208%26ady%3D2808%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D6%26uci%3Da!6%26btvi%3D3%26fsb%3D1%26xpc%3DZE5btzgJdW%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D17&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=6556199831092&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 22755ce1984005f055f1e0857d99d969ef1ae39d16b53ad70cd241a15e8d1d2a

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2108
Content-Type: text/html; charset=utf-8
Date: Sun, 24 Sep 2023 16:55:37 GMT
Expires: Sun, 24 Sep 2023 17:55:37 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame A5D4
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=35726500116043204444994012457026&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=35726500116043204444994012457026&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
483 B

1045ms
702ms

Image
image/gif

145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=35726500116043204444994012457026&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:38 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx
Host: pv.medialead.de
X-IPLB-Request-ID: D972D785:CD90_91EFC182:01BB_65106A09_180FE06A:22021
X-IPLB-Instance: 40027
Vary: Origin
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Access-Control-Allow-Credentials: true
Content-Length: 43
Proxy-Host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=35726500116043204444994012457026&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Sun, 24 Sep 2023 16:55:37 GMT
server: nginx
content-length: 154
content-type: text/html

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame A5D4 43 B
702 B 170ms
102ms Image
image/gif 23.212.218.19
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=35726500116043204444994012457026&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.212.218.19 , United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:37 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9125 1 KB
643 B 21ms
20ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 76128
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 19:46:49 GMT
etag: 48472445140208031
expires: Sun, 24 Sep 2023 19:46:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame A5D4 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 69f8c4372536479bb20451dfa7a2c90bb076e0b783cccc72c0bf2217d9118f93

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4408 42 B
64 B 169ms
127ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssOSgFxi_NUFotoqeHRVP8IYhYny77-BmPvEJZvGrwSgypTW3yd2n6ap2oMm-gq332SRGFJb6zLZW2RcUNy6kup-oKv7bsF9OA5WgyUAyrX44Cc55f4KCLA698IgrGNAGDOqe__kNHsUS2S&sai=AMfl-YQ-ugAyqixxKa9m-gMPllxU_hapbaMalHafxdXIOs7-rcxmfGGp5aeVRxXSOqu8jIo1ak_8U_adm37C&sig=Cg0ArKJSzN3nLa0tGD0oEAE&cid=CAQSGwBpAlJWkzEdv9naO-EOS4uniOZj1fRB8wPWHhgB&id=lidar2&mcvt=1077&p=0,0,600,160&mtos=1077,1077,1077,1077,1077&tos=1077,0,0,0,0&v=20230920&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=713883011&rs=2&la=0&cr=0&vs=4&r=v&rst=1695574535040&rpt=1199&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 928E 0
20 B 126ms
126ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BvGsgCGoQZaTSNueM3gP49Z7YCQAAAAA4AeAEAg&bg=!cXKlcj3NAAbbC4-Z-ws7ADQBe5WfOGC1MAwMGiffx7DO-oRCNtTJ7jT5iNmbKjUPCn_y2ICHoEqhOwoeJWPdOFnMlZjYAgAAAJBSAAAABWgBB5kDCwnnZlr9BugWwMfXriV62I_KN_rdojThaQ6mUSfGP8yICQM8JRR6KWTUq3Nr-dkVDfRj-iqCqF8LTn6ws8u-j9EgD5GtCSoAf7iUZe9aDRay4H5F8W5DZSOJuFy37tF3pHrtSlXoW1vvEYBDqmd3KXR8pYjGmJJknyfwaqyXSBvfOWIyAZkeyxK9b78wEjk1OP06ES_o7RMec7-cMEw_XaiD2UyrOub1V_H2OAy9x3DmP0hi0pXoSxnUUCM7SyHb-zkNn16w561S8at3FGFc0GK_bSvDO2TnaO1eDBJyP4cuNiXAjodFdiZPm0o5MGPswrsLTfgSnuDpVIWix6b6Z6XO-zqdxqmJp5rwPDg7gJGvRCGcZk9G-fEH5d6Y-NIDEAuOtvscep1QUOQKm8jhFgLD_WKdlm-2krZRQ1P9dAndmzb3eDSIDEsGToUT9Uv7sDCDm6_1JsvQLcD2MhVkYzo5p7gaWy5IqdOouDFGVU25oUL7uYoEcXfQwQ_Ceep9VWMFzPG2HStvgxAH982gqKeyL3UQ0WeNNT9KEgtXteMsj0aV8ql9rTOIkG_vfwoS0ITJ8Q4X_A_myneZcR_ER7uX-p5Bv4O_O4aa9UR-j0zLsH7Yu2PS2EAKgKlusyuWYVNpYcQh1RQK6aR-nWshNk3uHhst7jrkEH2H6ea33p3d_npIBA4n8yEd9wptTRK08pArIAyNPA0kYYfvE5gwUrlLNQrYFK5V0XAMyRJYqrrLyZHib8N6uYe_gHgGDRpLICeQ7hogY0esL7GQtPZFIRCYERJF7IGYhzPFiMaJE2FVwDt9P4brsshASG5a-b7x-zotKw6p7hEeKt2DlW7xLX1TkE6AdYaL0aPROIa9MGZD-v_TKiArdYhYLtSfZi9GCjlO2ODG2NjAcoKPk-hD8q6W8h-8hYvOkHTRRKviMUWFmiBAF1jAVS6FDc4cKtovLPgCugUg-o8oqz-hZNuRKBDfwqWmNnIjXggcCXee-X9VmW4s65hHAkSbz1KcoUBMg1MvgmmIflnAw8OY

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame CB52 5 KB
682 B 29ms
28ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900028.redintelligence.net
URL: https://hal900028.redintelligence.net/request_content.php?s=53980700112083004444994012457028&a=d25c6cc4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900028.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 24 Sep 2023 16:55:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 16:47:59 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 24 Sep 2023 16:55:37 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame CB52 17 KB
17 KB 78ms
27ms Image
image/png 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900028.redintelligence.net
URL: https://hal900028.redintelligence.net/request_content.php?s=53980700112083004444994012457028&a=d25c6cc4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 0fa91e7c3778d0fed46145cf32c069c6613a72ebf521ef7bbe886d166667642b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900028.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16982
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame CB52 16 KB
16 KB 77ms
26ms Image
image/png 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900028.redintelligence.net
URL: https://hal900028.redintelligence.net/request_content.php?s=53980700112083004444994012457028&a=d25c6cc4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 814cbd48106cc86885b9a988961d8e6a4613dbbdc660cb7f46bc28a81b3c0b6b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900028.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16515
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame CB52 11 KB
11 KB 78ms
27ms Image
image/png 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native2.png
Requested by: Host: hal900028.redintelligence.net
URL: https://hal900028.redintelligence.net/request_content.php?s=53980700112083004444994012457028&a=d25c6cc4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 18a86a8cf8a79d532955549c8613f4c3eb94476e871349da9180de68fbc1fe24

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900028.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10940
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK e99aace94e6e5873881d3400993e1e7e Show response
pv.medialead.de/trck/epv/ Frame 0819 0
467 B 331ms
289ms Document
application/javascript 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=54363700101959804444994012457014&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=5edfce6ec6&subid=&uid=fea81e04457db706&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCpewgB2oQZerDOfPBtOUPhKGW4Amm5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0Lq2c_RPT6KQhSmfjL3XrfFiStWduxcXiKuBfNsoZXNwGvkhV3prZuIv0qk84p6_MLN00bjZpKpwQhtoEtCeupfjTczpjPiDYQ4GJKLNIT16wIP4oABDbKLlRHc4vsP3P-sMFEyVfG1IxTGXJ-PH9ENr52xr_msFZ1-5vaIjl0Z9Df2sMtDpAWUklNvkuaKH5LQs-Ih82IUFedI0BvzzLBJe-r0bIFR1PHlD8bBf7bq5bnc9vQn8tu1YKeSGhtkwILPFDOCwxH-aLC9byMbiET7ARi2Z3zKOeCOp9u8QA-7rjR6Sn4yBxHVIElDABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIquOer9vDgQMV8yCtBh2EkAWcEAEYASAAEgKon_D_BwE%26num%3D1%26cid%3DCAQSOwDICaaNNKdirMATOjldqJn4SqzEIMwXt0RjxOEWzU1dPcImwNJ_2CW_VO5yAiiZjnfRwY48pV7U_9ufGAE%26sig%3DAOD64_1kwgR2Y6uskeiGe6f1Fn35-fYPEg%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-DpEEbCUSvcxkVCuzAlOLDzNVwYi6rfklNWhOWXApzZgA2_7TYh0AvL_o0HPZB_uAA8Fwr_mHDDwvlo-tZBb7Z09zatdZFXGnN8RNMyMfXWNW9rhi2TcTYRfpbEZViofcPkF7tjE_uYzWO2JXrG5ZIXxAXPviKs0PueV7ZWUhmBipINh1c%26cry%3D1%26dbm_d%3DAKAmf-CpUOShDQqqdTP8_rwqX6V29gcXKULGi2hV5rxklGGBg-wPJNRPsebxqI0yHLvYmupmMxWS5foKlp0j5G0eAGQD4rargYEip04b_Qyr74z88gc2-YD4nCmwAr9oiG9zpfLYwSgsCy_3lcgbpNSHQz_astDrZNK90RaFIQOGZBa7TEI0E9vWakaEI5MxyBUXM5YhJ3eBQ8h-q89t4fbAZLd4crW7A8ASALTsfqbfytRffrP8vp3CpxDV2AYI254KRrxYSN8utu3N250pCAHIiPiIHmB4sRKgESTgltX9zrgbRQG7Ek7J6LGudwiaruH8zKsPWCBnQLhbrfQGSpxaQ2Exhikqb9XazRSZ1nin5dxCq12uLpnNznj4mpJFieMj-c5_57BaOx0jKSSOo-2ANF0P0stb-XYtnJzRygbm79lVN1cR3qjInARuPHMpIL3SyErxXgTgt443OzIV2GF8dVVdl0BO2aVFf4UURyD9r9xrdyLI1O4wVJOVR9qErdP5H5MBaHOVqNBNzJcMD-6_eMQRPOyzn7giS5VdqfBlWJMPKuzhWQNlhG_7lxpKnkLblWIdtSJsvVpGlJd2FaFsm80m7JNpKhBUxVhntSiTN2I9CWwR7GeOvrCH0AQu9w_X0AR-1Nw25sKd8TXZuwoGxpkMqubP-0nFZaSw93wq8OYPyceoxAcD1GL3FvS6jF0cgaczSuxInClwErt8bOvm5wpHoFqxbA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D687377255%26adf%3D1097532353%26pi%3Dt.aa~a.1853940267~rp.4%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1456%26idt%3D1%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%252C368x280%252C368x280%252C368x280%26nras%3D6%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D15%26ady%3D3945%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D9%26uci%3Da!9%26btvi%3D6%26fsb%3D1%26xpc%3DQLB7WWkqKP%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D34&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=1168230154660&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Content-Length: 0
Content-Type: application/javascript; charset=utf-8
Date: Sun, 24 Sep 2023 16:55:37 GMT
Host: pv.medialead.de
Proxy-Host: pv.medialead.de
Server: nginx
Strict-Transport-Security: max-age=15768000
Vary: Origin
X-IPLB-Instance: 40027
X-IPLB-Request-ID: D972D785:CD86_91EFC182:01BB_65106A09_180E9B12:22023

GET
H2 200 / Show response
adv.office-partner.de/ Frame C0AB 930 B
931 B 20ms
20ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=5edfce6ec6&subid=&uid=fea81e04457db706&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCpewgB2oQZerDOfPBtOUPhKGW4Amm5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0Lq2c_RPT6KQhSmfjL3XrfFiStWduxcXiKuBfNsoZXNwGvkhV3prZuIv0qk84p6_MLN00bjZpKpwQhtoEtCeupfjTczpjPiDYQ4GJKLNIT16wIP4oABDbKLlRHc4vsP3P-sMFEyVfG1IxTGXJ-PH9ENr52xr_msFZ1-5vaIjl0Z9Df2sMtDpAWUklNvkuaKH5LQs-Ih82IUFedI0BvzzLBJe-r0bIFR1PHlD8bBf7bq5bnc9vQn8tu1YKeSGhtkwILPFDOCwxH-aLC9byMbiET7ARi2Z3zKOeCOp9u8QA-7rjR6Sn4yBxHVIElDABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIquOer9vDgQMV8yCtBh2EkAWcEAEYASAAEgKon_D_BwE%26num%3D1%26cid%3DCAQSOwDICaaNNKdirMATOjldqJn4SqzEIMwXt0RjxOEWzU1dPcImwNJ_2CW_VO5yAiiZjnfRwY48pV7U_9ufGAE%26sig%3DAOD64_1kwgR2Y6uskeiGe6f1Fn35-fYPEg%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-DpEEbCUSvcxkVCuzAlOLDzNVwYi6rfklNWhOWXApzZgA2_7TYh0AvL_o0HPZB_uAA8Fwr_mHDDwvlo-tZBb7Z09zatdZFXGnN8RNMyMfXWNW9rhi2TcTYRfpbEZViofcPkF7tjE_uYzWO2JXrG5ZIXxAXPviKs0PueV7ZWUhmBipINh1c%26cry%3D1%26dbm_d%3DAKAmf-CpUOShDQqqdTP8_rwqX6V29gcXKULGi2hV5rxklGGBg-wPJNRPsebxqI0yHLvYmupmMxWS5foKlp0j5G0eAGQD4rargYEip04b_Qyr74z88gc2-YD4nCmwAr9oiG9zpfLYwSgsCy_3lcgbpNSHQz_astDrZNK90RaFIQOGZBa7TEI0E9vWakaEI5MxyBUXM5YhJ3eBQ8h-q89t4fbAZLd4crW7A8ASALTsfqbfytRffrP8vp3CpxDV2AYI254KRrxYSN8utu3N250pCAHIiPiIHmB4sRKgESTgltX9zrgbRQG7Ek7J6LGudwiaruH8zKsPWCBnQLhbrfQGSpxaQ2Exhikqb9XazRSZ1nin5dxCq12uLpnNznj4mpJFieMj-c5_57BaOx0jKSSOo-2ANF0P0stb-XYtnJzRygbm79lVN1cR3qjInARuPHMpIL3SyErxXgTgt443OzIV2GF8dVVdl0BO2aVFf4UURyD9r9xrdyLI1O4wVJOVR9qErdP5H5MBaHOVqNBNzJcMD-6_eMQRPOyzn7giS5VdqfBlWJMPKuzhWQNlhG_7lxpKnkLblWIdtSJsvVpGlJd2FaFsm80m7JNpKhBUxVhntSiTN2I9CWwR7GeOvrCH0AQu9w_X0AR-1Nw25sKd8TXZuwoGxpkMqubP-0nFZaSw93wq8OYPyceoxAcD1GL3FvS6jF0cgaczSuxInClwErt8bOvm5wpHoFqxbA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D687377255%26adf%3D1097532353%26pi%3Dt.aa~a.1853940267~rp.4%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1456%26idt%3D1%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%252C368x280%252C368x280%252C368x280%26nras%3D6%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D15%26ady%3D3945%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D9%26uci%3Da!9%26btvi%3D6%26fsb%3D1%26xpc%3DQLB7WWkqKP%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D34&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=1168230154660&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Sun, 24 Sep 2023 16:55:37 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Sun, 01 Oct 2023 16:55:37 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 link.html Show response
track.webgains.com/ Frame EDB4 2 KB
2 KB 89ms
89ms Script
text/html 18.134.234.224
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=54363700101959804444994012457014&nw=1
Requested by: Host: docplayer.net
URL: http://docplayer.net/204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.134.234.224 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-134-234-224.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 8bd16262146d83606841dec63de50e79d38573ffaecc1de2af0a6a28015a1530

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
last-modified: Sun, 24 Sep 2023 16:55:37 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Sun, 24 Sep 2023 16:56:37 GMT

GET
H2

200

activityi;dc_pre=COfA-K_bw4EDFaXbOwId9HUDXg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4140701813131.018 Show response
8019191.fls.doubleclick.net/ Frame 2066
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4140701813131.018?
https://8019191.fls.doubleclick.net/activityi;dc_pre=COfA-K_bw4EDFaXbOwId9HUDXg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4140701813131.018?

391 B
285 B

101ms
100ms

Document
text/html

142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=COfA-K_bw4EDFaXbOwId9HUDXg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4140701813131.018?

Requested by

Host: docplayer.net
URL: http://docplayer.net/204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-212-218-19.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

fb0061d8ae16fe70e162fd88fd6d18aae52bfb792c2beb9d0765a7d5de8357fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:37 GMT
expires: Sun, 24 Sep 2023 16:55:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:37 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=COfA-K_bw4EDFaXbOwId9HUDXg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4140701813131.018?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900014.redintelligence.net/ Frame 1D61 7 KB
2 KB 76ms
25ms Document
text/html 176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/request_content.php?s=54363700101959804444994012457014&a=e16db843
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=5edfce6ec6&subid=&uid=fea81e04457db706&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCpewgB2oQZerDOfPBtOUPhKGW4Amm5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0Lq2c_RPT6KQhSmfjL3XrfFiStWduxcXiKuBfNsoZXNwGvkhV3prZuIv0qk84p6_MLN00bjZpKpwQhtoEtCeupfjTczpjPiDYQ4GJKLNIT16wIP4oABDbKLlRHc4vsP3P-sMFEyVfG1IxTGXJ-PH9ENr52xr_msFZ1-5vaIjl0Z9Df2sMtDpAWUklNvkuaKH5LQs-Ih82IUFedI0BvzzLBJe-r0bIFR1PHlD8bBf7bq5bnc9vQn8tu1YKeSGhtkwILPFDOCwxH-aLC9byMbiET7ARi2Z3zKOeCOp9u8QA-7rjR6Sn4yBxHVIElDABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIquOer9vDgQMV8yCtBh2EkAWcEAEYASAAEgKon_D_BwE%26num%3D1%26cid%3DCAQSOwDICaaNNKdirMATOjldqJn4SqzEIMwXt0RjxOEWzU1dPcImwNJ_2CW_VO5yAiiZjnfRwY48pV7U_9ufGAE%26sig%3DAOD64_1kwgR2Y6uskeiGe6f1Fn35-fYPEg%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-DpEEbCUSvcxkVCuzAlOLDzNVwYi6rfklNWhOWXApzZgA2_7TYh0AvL_o0HPZB_uAA8Fwr_mHDDwvlo-tZBb7Z09zatdZFXGnN8RNMyMfXWNW9rhi2TcTYRfpbEZViofcPkF7tjE_uYzWO2JXrG5ZIXxAXPviKs0PueV7ZWUhmBipINh1c%26cry%3D1%26dbm_d%3DAKAmf-CpUOShDQqqdTP8_rwqX6V29gcXKULGi2hV5rxklGGBg-wPJNRPsebxqI0yHLvYmupmMxWS5foKlp0j5G0eAGQD4rargYEip04b_Qyr74z88gc2-YD4nCmwAr9oiG9zpfLYwSgsCy_3lcgbpNSHQz_astDrZNK90RaFIQOGZBa7TEI0E9vWakaEI5MxyBUXM5YhJ3eBQ8h-q89t4fbAZLd4crW7A8ASALTsfqbfytRffrP8vp3CpxDV2AYI254KRrxYSN8utu3N250pCAHIiPiIHmB4sRKgESTgltX9zrgbRQG7Ek7J6LGudwiaruH8zKsPWCBnQLhbrfQGSpxaQ2Exhikqb9XazRSZ1nin5dxCq12uLpnNznj4mpJFieMj-c5_57BaOx0jKSSOo-2ANF0P0stb-XYtnJzRygbm79lVN1cR3qjInARuPHMpIL3SyErxXgTgt443OzIV2GF8dVVdl0BO2aVFf4UURyD9r9xrdyLI1O4wVJOVR9qErdP5H5MBaHOVqNBNzJcMD-6_eMQRPOyzn7giS5VdqfBlWJMPKuzhWQNlhG_7lxpKnkLblWIdtSJsvVpGlJd2FaFsm80m7JNpKhBUxVhntSiTN2I9CWwR7GeOvrCH0AQu9w_X0AR-1Nw25sKd8TXZuwoGxpkMqubP-0nFZaSw93wq8OYPyceoxAcD1GL3FvS6jF0cgaczSuxInClwErt8bOvm5wpHoFqxbA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D687377255%26adf%3D1097532353%26pi%3Dt.aa~a.1853940267~rp.4%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1456%26idt%3D1%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%252C368x280%252C368x280%252C368x280%26nras%3D6%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D15%26ady%3D3945%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D9%26uci%3Da!9%26btvi%3D6%26fsb%3D1%26xpc%3DQLB7WWkqKP%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D34&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=1168230154660&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.26.250 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: 0b577cf8362dded5e137fcd6fb597f7ce84b042c0552ed4f30abd9da0da1a944

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2096
Content-Type: text/html; charset=utf-8
Date: Sun, 24 Sep 2023 16:55:37 GMT
Expires: Sun, 24 Sep 2023 17:55:37 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame EDB4
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=54363700101959804444994012457014&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=54363700101959804444994012457014&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
482 B

1616ms
935ms

Image
image/gif

145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=54363700101959804444994012457014&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

HTTP/1.1

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:39 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx
Host: pv.medialead.de
X-IPLB-Request-ID: D972D785:CD92_91EFC182:01BB_65106A0A_182C1C51:B82A
X-IPLB-Instance: 40028
Vary: Origin
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Access-Control-Allow-Credentials: true
Content-Length: 43
Proxy-Host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=54363700101959804444994012457014&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Sun, 24 Sep 2023 16:55:37 GMT
server: nginx
content-length: 154
content-type: text/html

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame EDB4 43 B
702 B 138ms
93ms Image
image/gif 23.212.218.19
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=54363700101959804444994012457014&pv=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.212.218.19 , United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:37 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A148 1 KB
643 B 22ms
20ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 76128
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 19:46:49 GMT
etag: 48472445140208031
expires: Sun, 24 Sep 2023 19:46:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame EDB4 207 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0a8e99896d4a41a620e6b25e15336d95ef36757cf324c1f14160db1953f5274b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame 4D0E 0
467 B 364ms
320ms Document
application/javascript 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=25224300101959904444994012457014&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=42be7a0425&subid=&uid=e39df99d6e704b08&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCKy5VB2oQZe6sOeShi9YPvO79gAym5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0K4G8T5W3xghW6RgHru0eY51Ct2taW1eCRxJ5UwsguYduDOOMlsOsBjmfwE_iqnFcQInvSUCx5YNbo-QXbjbGuDHA2xsf2IEjF0QUc52q1yEBogjAdxuEKCFHguL3Nh-HzCpn1u0rQaiv6sdIz0oTdc1PFSrvnO5oIQNCUg9Ve8guaeFr-rmmk60Qof5rl0hW-XeDUhJ7OHDyOWeorAKDv_eMfQJMh008fNEnOUgiSB2USPb8tXBfct0uqdq6Lg4EzAenEJ8-PMQV1YDsGR1RUCzna1GGJFw4e5B4hMCHNO_nM7TWlnikSMTrQPABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIrsyer9vDgQMV5NDCBB08dx_AEAEYASAAEgLngPD_BwE%26num%3D1%26cid%3DCAQSOwDICaaNK7cDtYM2eQkkvSB_2qqYmG9TSTsDqoGLdpVO_8ZWi2Iz4okgXdK6f3KMiQr4PdRvFsm45JuDGAE%26sig%3DAOD64_2eQzHX0np56-KSRj0ZWfyv75otZw%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-DldoRQPAi2cD1Bbpn9diF8TT7hHMOhYyYereyjgxV4ezmk6bEeqM7K-chd-Ip9FEpWif9CP54rFv2gJ4Y-_1CGpErj7OatAYWjBezxni0GR5HdyV9SfhZD1VeBakjWfnA027XqIUdR_PL-ZlpajiO0-WUdtg4VjlomNHSBEmNJmTBL2Sk%26cry%3D1%26dbm_d%3DAKAmf-CKaTbAsbJmoeAAvTtU-AFMo6Wg_QtDuQfdEiQwlO2ToxGm47NVSfNmXPiz85aWPfhjZuC30e3-J_OzzqnbYqUc_O2_43I9UzL169w65eRb0oHskV2Zyz-1JUFZ_WMT9XkunQ3H9cxwZZ4Y8AqmQtImOLGFIbQIO_WLNTVD5lKoq-4iRYimrZf9EGuyloWfWtYgZAXwHvhwc8JzYFYaD-6Ns_rArkl_vJeMPwAtGkxyOlQtjwhArUV94qoBlg5dmnjNVo4lyJsWahaWkXFLCpIw4mhm0fijRviMuarD1EhAwihNo-nqJqcGZqI57aPY6i0Ek425yHXj9GoCjPpF9w0r0ujHoz2QhQaW-0u6jC9uOyYWuLjkIUvW3r_kngvJmDuT-ypxqGASZ4Zs1tTRPi1k5HZSvlss0GnK76dBjgMGjzUnRRfI2rCZC-BudjiuslAWjJzuuOYFwsHv9m_OXSGN5W9lJi9FMcUa97lwfXhUyET3n-PVdUL_9RFHPupcAzC30fp4TtOhMEwE4YTWU9sKFrkQmaysdnVm2p1dimhmf4r-f6IOVimp8VCrcy0bsJMKM0R5VGv3RbshSrFoi8mhS4q-oSRigXDrDSVusAZOW2wICTPpkQfatU955w5pvOdXMI_1sLW8ufX19t7-mkn8TAm9A8Z7LNqDiUhGjMPl51ganfqif7EddLZaUHlX6Qk8KaxQ0lUeORMScenN0kWAHHkmkA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D1567995846%26adf%3D1403646308%26pi%3Dt.aa~a.2652211261~rp.4%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%252C368x280%252C368x280%26nras%3D5%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1208%26ady%3D3773%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D8%26uci%3Da!8%26btvi%3D5%26fsb%3D1%26xpc%3DCX7ez5xCT1%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D30&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=781247138916&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Content-Length: 0
Content-Type: application/javascript; charset=utf-8
Date: Sun, 24 Sep 2023 16:55:37 GMT
Host: pv.medialead.de
Proxy-Host: pv.medialead.de
Server: nginx
Strict-Transport-Security: max-age=15768000
Vary: Origin
X-IPLB-Instance: 40027
X-IPLB-Request-ID: D972D785:CD90_91EFC182:01BB_65106A09_180FE03F:22021

GET
H2 200 / Show response
adv.office-partner.de/ Frame 0477 930 B
931 B 20ms
19ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=42be7a0425&subid=&uid=e39df99d6e704b08&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCKy5VB2oQZe6sOeShi9YPvO79gAym5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0K4G8T5W3xghW6RgHru0eY51Ct2taW1eCRxJ5UwsguYduDOOMlsOsBjmfwE_iqnFcQInvSUCx5YNbo-QXbjbGuDHA2xsf2IEjF0QUc52q1yEBogjAdxuEKCFHguL3Nh-HzCpn1u0rQaiv6sdIz0oTdc1PFSrvnO5oIQNCUg9Ve8guaeFr-rmmk60Qof5rl0hW-XeDUhJ7OHDyOWeorAKDv_eMfQJMh008fNEnOUgiSB2USPb8tXBfct0uqdq6Lg4EzAenEJ8-PMQV1YDsGR1RUCzna1GGJFw4e5B4hMCHNO_nM7TWlnikSMTrQPABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIrsyer9vDgQMV5NDCBB08dx_AEAEYASAAEgLngPD_BwE%26num%3D1%26cid%3DCAQSOwDICaaNK7cDtYM2eQkkvSB_2qqYmG9TSTsDqoGLdpVO_8ZWi2Iz4okgXdK6f3KMiQr4PdRvFsm45JuDGAE%26sig%3DAOD64_2eQzHX0np56-KSRj0ZWfyv75otZw%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-DldoRQPAi2cD1Bbpn9diF8TT7hHMOhYyYereyjgxV4ezmk6bEeqM7K-chd-Ip9FEpWif9CP54rFv2gJ4Y-_1CGpErj7OatAYWjBezxni0GR5HdyV9SfhZD1VeBakjWfnA027XqIUdR_PL-ZlpajiO0-WUdtg4VjlomNHSBEmNJmTBL2Sk%26cry%3D1%26dbm_d%3DAKAmf-CKaTbAsbJmoeAAvTtU-AFMo6Wg_QtDuQfdEiQwlO2ToxGm47NVSfNmXPiz85aWPfhjZuC30e3-J_OzzqnbYqUc_O2_43I9UzL169w65eRb0oHskV2Zyz-1JUFZ_WMT9XkunQ3H9cxwZZ4Y8AqmQtImOLGFIbQIO_WLNTVD5lKoq-4iRYimrZf9EGuyloWfWtYgZAXwHvhwc8JzYFYaD-6Ns_rArkl_vJeMPwAtGkxyOlQtjwhArUV94qoBlg5dmnjNVo4lyJsWahaWkXFLCpIw4mhm0fijRviMuarD1EhAwihNo-nqJqcGZqI57aPY6i0Ek425yHXj9GoCjPpF9w0r0ujHoz2QhQaW-0u6jC9uOyYWuLjkIUvW3r_kngvJmDuT-ypxqGASZ4Zs1tTRPi1k5HZSvlss0GnK76dBjgMGjzUnRRfI2rCZC-BudjiuslAWjJzuuOYFwsHv9m_OXSGN5W9lJi9FMcUa97lwfXhUyET3n-PVdUL_9RFHPupcAzC30fp4TtOhMEwE4YTWU9sKFrkQmaysdnVm2p1dimhmf4r-f6IOVimp8VCrcy0bsJMKM0R5VGv3RbshSrFoi8mhS4q-oSRigXDrDSVusAZOW2wICTPpkQfatU955w5pvOdXMI_1sLW8ufX19t7-mkn8TAm9A8Z7LNqDiUhGjMPl51ganfqif7EddLZaUHlX6Qk8KaxQ0lUeORMScenN0kWAHHkmkA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D1567995846%26adf%3D1403646308%26pi%3Dt.aa~a.2652211261~rp.4%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%252C368x280%252C368x280%26nras%3D5%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1208%26ady%3D3773%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D8%26uci%3Da!8%26btvi%3D5%26fsb%3D1%26xpc%3DCX7ez5xCT1%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D30&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=781247138916&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Sun, 24 Sep 2023 16:55:37 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Sun, 01 Oct 2023 16:55:37 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame D941 0
466 B 716ms
641ms Script
application/javascript 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=25224300101959904444994012457014&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=42be7a0425&subid=&uid=e39df99d6e704b08&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCKy5VB2oQZe6sOeShi9YPvO79gAym5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0K4G8T5W3xghW6RgHru0eY51Ct2taW1eCRxJ5UwsguYduDOOMlsOsBjmfwE_iqnFcQInvSUCx5YNbo-QXbjbGuDHA2xsf2IEjF0QUc52q1yEBogjAdxuEKCFHguL3Nh-HzCpn1u0rQaiv6sdIz0oTdc1PFSrvnO5oIQNCUg9Ve8guaeFr-rmmk60Qof5rl0hW-XeDUhJ7OHDyOWeorAKDv_eMfQJMh008fNEnOUgiSB2USPb8tXBfct0uqdq6Lg4EzAenEJ8-PMQV1YDsGR1RUCzna1GGJFw4e5B4hMCHNO_nM7TWlnikSMTrQPABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIrsyer9vDgQMV5NDCBB08dx_AEAEYASAAEgLngPD_BwE%26num%3D1%26cid%3DCAQSOwDICaaNK7cDtYM2eQkkvSB_2qqYmG9TSTsDqoGLdpVO_8ZWi2Iz4okgXdK6f3KMiQr4PdRvFsm45JuDGAE%26sig%3DAOD64_2eQzHX0np56-KSRj0ZWfyv75otZw%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-DldoRQPAi2cD1Bbpn9diF8TT7hHMOhYyYereyjgxV4ezmk6bEeqM7K-chd-Ip9FEpWif9CP54rFv2gJ4Y-_1CGpErj7OatAYWjBezxni0GR5HdyV9SfhZD1VeBakjWfnA027XqIUdR_PL-ZlpajiO0-WUdtg4VjlomNHSBEmNJmTBL2Sk%26cry%3D1%26dbm_d%3DAKAmf-CKaTbAsbJmoeAAvTtU-AFMo6Wg_QtDuQfdEiQwlO2ToxGm47NVSfNmXPiz85aWPfhjZuC30e3-J_OzzqnbYqUc_O2_43I9UzL169w65eRb0oHskV2Zyz-1JUFZ_WMT9XkunQ3H9cxwZZ4Y8AqmQtImOLGFIbQIO_WLNTVD5lKoq-4iRYimrZf9EGuyloWfWtYgZAXwHvhwc8JzYFYaD-6Ns_rArkl_vJeMPwAtGkxyOlQtjwhArUV94qoBlg5dmnjNVo4lyJsWahaWkXFLCpIw4mhm0fijRviMuarD1EhAwihNo-nqJqcGZqI57aPY6i0Ek425yHXj9GoCjPpF9w0r0ujHoz2QhQaW-0u6jC9uOyYWuLjkIUvW3r_kngvJmDuT-ypxqGASZ4Zs1tTRPi1k5HZSvlss0GnK76dBjgMGjzUnRRfI2rCZC-BudjiuslAWjJzuuOYFwsHv9m_OXSGN5W9lJi9FMcUa97lwfXhUyET3n-PVdUL_9RFHPupcAzC30fp4TtOhMEwE4YTWU9sKFrkQmaysdnVm2p1dimhmf4r-f6IOVimp8VCrcy0bsJMKM0R5VGv3RbshSrFoi8mhS4q-oSRigXDrDSVusAZOW2wICTPpkQfatU955w5pvOdXMI_1sLW8ufX19t7-mkn8TAm9A8Z7LNqDiUhGjMPl51ganfqif7EddLZaUHlX6Qk8KaxQ0lUeORMScenN0kWAHHkmkA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D1567995846%26adf%3D1403646308%26pi%3Dt.aa~a.2652211261~rp.4%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%252C368x280%252C368x280%26nras%3D5%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1208%26ady%3D3773%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D8%26uci%3Da!8%26btvi%3D5%26fsb%3D1%26xpc%3DCX7ez5xCT1%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D30&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=781247138916&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:38 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx
Host: pv.medialead.de
X-IPLB-Request-ID: D972D785:CD92_91EFC182:01BB_65106A09_182C1BF7:B82A
X-IPLB-Instance: 40028
Vary: Origin
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Access-Control-Allow-Credentials: true
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame D941 43 B
483 B 1021ms
728ms Image
image/gif 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=25224300101959904444994012457014&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=42be7a0425&subid=&uid=e39df99d6e704b08&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCKy5VB2oQZe6sOeShi9YPvO79gAym5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0K4G8T5W3xghW6RgHru0eY51Ct2taW1eCRxJ5UwsguYduDOOMlsOsBjmfwE_iqnFcQInvSUCx5YNbo-QXbjbGuDHA2xsf2IEjF0QUc52q1yEBogjAdxuEKCFHguL3Nh-HzCpn1u0rQaiv6sdIz0oTdc1PFSrvnO5oIQNCUg9Ve8guaeFr-rmmk60Qof5rl0hW-XeDUhJ7OHDyOWeorAKDv_eMfQJMh008fNEnOUgiSB2USPb8tXBfct0uqdq6Lg4EzAenEJ8-PMQV1YDsGR1RUCzna1GGJFw4e5B4hMCHNO_nM7TWlnikSMTrQPABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIrsyer9vDgQMV5NDCBB08dx_AEAEYASAAEgLngPD_BwE%26num%3D1%26cid%3DCAQSOwDICaaNK7cDtYM2eQkkvSB_2qqYmG9TSTsDqoGLdpVO_8ZWi2Iz4okgXdK6f3KMiQr4PdRvFsm45JuDGAE%26sig%3DAOD64_2eQzHX0np56-KSRj0ZWfyv75otZw%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-DldoRQPAi2cD1Bbpn9diF8TT7hHMOhYyYereyjgxV4ezmk6bEeqM7K-chd-Ip9FEpWif9CP54rFv2gJ4Y-_1CGpErj7OatAYWjBezxni0GR5HdyV9SfhZD1VeBakjWfnA027XqIUdR_PL-ZlpajiO0-WUdtg4VjlomNHSBEmNJmTBL2Sk%26cry%3D1%26dbm_d%3DAKAmf-CKaTbAsbJmoeAAvTtU-AFMo6Wg_QtDuQfdEiQwlO2ToxGm47NVSfNmXPiz85aWPfhjZuC30e3-J_OzzqnbYqUc_O2_43I9UzL169w65eRb0oHskV2Zyz-1JUFZ_WMT9XkunQ3H9cxwZZ4Y8AqmQtImOLGFIbQIO_WLNTVD5lKoq-4iRYimrZf9EGuyloWfWtYgZAXwHvhwc8JzYFYaD-6Ns_rArkl_vJeMPwAtGkxyOlQtjwhArUV94qoBlg5dmnjNVo4lyJsWahaWkXFLCpIw4mhm0fijRviMuarD1EhAwihNo-nqJqcGZqI57aPY6i0Ek425yHXj9GoCjPpF9w0r0ujHoz2QhQaW-0u6jC9uOyYWuLjkIUvW3r_kngvJmDuT-ypxqGASZ4Zs1tTRPi1k5HZSvlss0GnK76dBjgMGjzUnRRfI2rCZC-BudjiuslAWjJzuuOYFwsHv9m_OXSGN5W9lJi9FMcUa97lwfXhUyET3n-PVdUL_9RFHPupcAzC30fp4TtOhMEwE4YTWU9sKFrkQmaysdnVm2p1dimhmf4r-f6IOVimp8VCrcy0bsJMKM0R5VGv3RbshSrFoi8mhS4q-oSRigXDrDSVusAZOW2wICTPpkQfatU955w5pvOdXMI_1sLW8ufX19t7-mkn8TAm9A8Z7LNqDiUhGjMPl51ganfqif7EddLZaUHlX6Qk8KaxQ0lUeORMScenN0kWAHHkmkA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D1567995846%26adf%3D1403646308%26pi%3Dt.aa~a.2652211261~rp.4%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%252C368x280%252C368x280%26nras%3D5%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1208%26ady%3D3773%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D8%26uci%3Da!8%26btvi%3D5%26fsb%3D1%26xpc%3DCX7ez5xCT1%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D30&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=781247138916&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:38 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx
Host: pv.medialead.de
X-IPLB-Request-ID: D972D785:CD74_91EFC182:01BB_65106A09_180FE23D:22024
X-IPLB-Instance: 40027
Vary: Origin
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Access-Control-Allow-Credentials: true
Content-Length: 43
Proxy-Host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame D941 43 B
702 B 153ms
112ms Image
image/gif 23.212.218.19
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=25224300101959904444994012457014&pv=1

Requested by

Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=42be7a0425&subid=&uid=e39df99d6e704b08&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCKy5VB2oQZe6sOeShi9YPvO79gAym5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0K4G8T5W3xghW6RgHru0eY51Ct2taW1eCRxJ5UwsguYduDOOMlsOsBjmfwE_iqnFcQInvSUCx5YNbo-QXbjbGuDHA2xsf2IEjF0QUc52q1yEBogjAdxuEKCFHguL3Nh-HzCpn1u0rQaiv6sdIz0oTdc1PFSrvnO5oIQNCUg9Ve8guaeFr-rmmk60Qof5rl0hW-XeDUhJ7OHDyOWeorAKDv_eMfQJMh008fNEnOUgiSB2USPb8tXBfct0uqdq6Lg4EzAenEJ8-PMQV1YDsGR1RUCzna1GGJFw4e5B4hMCHNO_nM7TWlnikSMTrQPABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMIrsyer9vDgQMV5NDCBB08dx_AEAEYASAAEgLngPD_BwE%26num%3D1%26cid%3DCAQSOwDICaaNK7cDtYM2eQkkvSB_2qqYmG9TSTsDqoGLdpVO_8ZWi2Iz4okgXdK6f3KMiQr4PdRvFsm45JuDGAE%26sig%3DAOD64_2eQzHX0np56-KSRj0ZWfyv75otZw%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-DldoRQPAi2cD1Bbpn9diF8TT7hHMOhYyYereyjgxV4ezmk6bEeqM7K-chd-Ip9FEpWif9CP54rFv2gJ4Y-_1CGpErj7OatAYWjBezxni0GR5HdyV9SfhZD1VeBakjWfnA027XqIUdR_PL-ZlpajiO0-WUdtg4VjlomNHSBEmNJmTBL2Sk%26cry%3D1%26dbm_d%3DAKAmf-CKaTbAsbJmoeAAvTtU-AFMo6Wg_QtDuQfdEiQwlO2ToxGm47NVSfNmXPiz85aWPfhjZuC30e3-J_OzzqnbYqUc_O2_43I9UzL169w65eRb0oHskV2Zyz-1JUFZ_WMT9XkunQ3H9cxwZZ4Y8AqmQtImOLGFIbQIO_WLNTVD5lKoq-4iRYimrZf9EGuyloWfWtYgZAXwHvhwc8JzYFYaD-6Ns_rArkl_vJeMPwAtGkxyOlQtjwhArUV94qoBlg5dmnjNVo4lyJsWahaWkXFLCpIw4mhm0fijRviMuarD1EhAwihNo-nqJqcGZqI57aPY6i0Ek425yHXj9GoCjPpF9w0r0ujHoz2QhQaW-0u6jC9uOyYWuLjkIUvW3r_kngvJmDuT-ypxqGASZ4Zs1tTRPi1k5HZSvlss0GnK76dBjgMGjzUnRRfI2rCZC-BudjiuslAWjJzuuOYFwsHv9m_OXSGN5W9lJi9FMcUa97lwfXhUyET3n-PVdUL_9RFHPupcAzC30fp4TtOhMEwE4YTWU9sKFrkQmaysdnVm2p1dimhmf4r-f6IOVimp8VCrcy0bsJMKM0R5VGv3RbshSrFoi8mhS4q-oSRigXDrDSVusAZOW2wICTPpkQfatU955w5pvOdXMI_1sLW8ufX19t7-mkn8TAm9A8Z7LNqDiUhGjMPl51ganfqif7EddLZaUHlX6Qk8KaxQ0lUeORMScenN0kWAHHkmkA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D1567995846%26adf%3D1403646308%26pi%3Dt.aa~a.2652211261~rp.4%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%252C368x280%252C368x280%26nras%3D5%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D1208%26ady%3D3773%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D8%26uci%3Da!8%26btvi%3D5%26fsb%3D1%26xpc%3DCX7ez5xCT1%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D30&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=781247138916&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.212.218.19 , United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-212-218-19.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:37 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame 2FAC 0
467 B 336ms
294ms Document
application/javascript 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=84790000102752904444994012457002&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=5f22313682&subid=&uid=1ff882b731adf80e&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCD0rhB2oQZaO6OYGWtOUPhea4qA-m5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0HOE-rUuk54Q_33_el6ArlJwGuWwP-WvB03pIYEILtyZucP6V0M7bO8oq8Nbk05bXepYs5G8UVI6yn5MOHIKW0-74Q70d3SfRp8z0yPlxDtgoNPLn5z9QAeSE9be9BH-KZztuy092Y2em00c29Kgv7LxkC_RKQeys0llSw7c0khP9TSBsIHR_nwD0o2Jz-NLcxyD-u4oPfdc8SEoLT4LGwpKaBpW8zJ8N0g62e4T0j6Vv15Ejl7oxFo8SWl3mT9spwEqfHVCsFz5Zsv_b67gwdMxbh_0HbavMS51zVDk1J3Ex9wIGIMw48tBU0bABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMI49mer9vDgQMVAQutBh0FMw71EAEYASAAEgJz9PD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJWzja5vjlphRiTk1OcK_bRt4hNr1WLPRAPuQ-zRQIMwQUtVhW_B6rYDYqZLX4SJVDjXTxrAru9GAE%26sig%3DAOD64_3d81Yc-OLsKe-wOgT03yBiGW5kaA%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-BcD55aY-78ow02SmBQzf9bOzfmT_sxyM9SW8vZkklsAM6vSM-wOOLqxhsIo7ap6_tIVczvfb0Bpi6Cnziai-Xg1bdbcdxrMMBsgFiMQWcJyC26DA_a8XdL0mJo7bcLCda0naMTsKR7w77GPAvTogUOjU-r-8KkyZvHwPHe9Tjb2hiHhdc%26cry%3D1%26dbm_d%3DAKAmf-CCihGrMlYmY86yXIlUrmX2ApuqlEImZoP3RDO1v8iGNJIZ2BnDR0S3lnsudpY48JvHvSoDOARQ6oxdZXQMEqWMNoyJK5hvpoLufCcQLwxSmPtC5naaL1jCFlkHuRRFAti0Z3pBYw7yg5li7624H5KIvXJD-TIB6O2DdLA1omews7wMrjMgnQ3QbhtvZLB4xoxryPGS4gMYkmQyQcXRCZuRU8ioAc_E7eE6amDk1ZXrPlkTxlGHFjLQQnWx-Rt9fkNJWmWSuwD_E89YLcVRguFoIFxTKyH-GK_q2PPku0a6iBUKFk-0_Iw30OxLtujSuPndQl339hKk9EITsQPYo-_lyle3KU_XUbNnGoFMHBv6MDiu6HaOu9PE4dYa5zcBceBgoPzV6JKQz_LaJ2llvMbAktkb01_1dl2cRu-McLIvmUOWEf21NB5eu7Xf2xE-4nKnOUGscV-OCVm1L_iPTvKXGOiB-KLsBy5ur2-98JSFTicQdRR3KcjaJIc3IEALoO73zcZjjDJLJ0pK8Xo6N-B22ly-GifFJSvZyVfOn_v6PBzligpbebpJAP1rbp9pzmh8j-QAdlIJtFg_BqC8if3dpRheK__j_GiMjw2pI6QLYEukMpy23kZuO-uDDC2s0Jx8dvmT7esLGS7kAvEbHuai72VCQIUyND1Gwl5Km7SPrxFK7c9RTQ6p7yEQTY7dPiWRwnWB9cdeEUP21qlqoXPjugDEKw%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D687377255%26adf%3D4290548377%26pi%3Dt.aa~a.2429977064~rp.2%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%252C368x280%26nras%3D4%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D810%26ady%3D2988%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D7%26uci%3Da!7%26btvi%3D4%26fsb%3D1%26xpc%3DiVZjO70nvz%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D22&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=3790174192713&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Content-Length: 0
Content-Type: application/javascript; charset=utf-8
Date: Sun, 24 Sep 2023 16:55:37 GMT
Host: pv.medialead.de
Proxy-Host: pv.medialead.de
Server: nginx
Strict-Transport-Security: max-age=15768000
Vary: Origin
X-IPLB-Instance: 40027
X-IPLB-Request-ID: D972D785:CD94_91EFC182:01BB_65106A09_180FE03E:22021

GET
H2 200 / Show response
adv.office-partner.de/ Frame 7FF7 930 B
931 B 20ms
19ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=5f22313682&subid=&uid=1ff882b731adf80e&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCD0rhB2oQZaO6OYGWtOUPhea4qA-m5b2gab2TnKfJD_AuEAEg-dvsRmCVgoCAmAfIAQmpAmExRh9x37E-qAMByAObBKoE7QFP0HOE-rUuk54Q_33_el6ArlJwGuWwP-WvB03pIYEILtyZucP6V0M7bO8oq8Nbk05bXepYs5G8UVI6yn5MOHIKW0-74Q70d3SfRp8z0yPlxDtgoNPLn5z9QAeSE9be9BH-KZztuy092Y2em00c29Kgv7LxkC_RKQeys0llSw7c0khP9TSBsIHR_nwD0o2Jz-NLcxyD-u4oPfdc8SEoLT4LGwpKaBpW8zJ8N0g62e4T0j6Vv15Ejl7oxFo8SWl3mT9spwEqfHVCsFz5Zsv_b67gwdMxbh_0HbavMS51zVDk1J3Ex9wIGIMw48tBU0bABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGqDQJERcgNAbATzJzZEtATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26gclid%3DEAIaIQobChMI49mer9vDgQMVAQutBh0FMw71EAEYASAAEgJz9PD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJWzja5vjlphRiTk1OcK_bRt4hNr1WLPRAPuQ-zRQIMwQUtVhW_B6rYDYqZLX4SJVDjXTxrAru9GAE%26sig%3DAOD64_3d81Yc-OLsKe-wOgT03yBiGW5kaA%26client%3Dca-pub-6133583279631137%26dbm_c%3DAKAmf-BcD55aY-78ow02SmBQzf9bOzfmT_sxyM9SW8vZkklsAM6vSM-wOOLqxhsIo7ap6_tIVczvfb0Bpi6Cnziai-Xg1bdbcdxrMMBsgFiMQWcJyC26DA_a8XdL0mJo7bcLCda0naMTsKR7w77GPAvTogUOjU-r-8KkyZvHwPHe9Tjb2hiHhdc%26cry%3D1%26dbm_d%3DAKAmf-CCihGrMlYmY86yXIlUrmX2ApuqlEImZoP3RDO1v8iGNJIZ2BnDR0S3lnsudpY48JvHvSoDOARQ6oxdZXQMEqWMNoyJK5hvpoLufCcQLwxSmPtC5naaL1jCFlkHuRRFAti0Z3pBYw7yg5li7624H5KIvXJD-TIB6O2DdLA1omews7wMrjMgnQ3QbhtvZLB4xoxryPGS4gMYkmQyQcXRCZuRU8ioAc_E7eE6amDk1ZXrPlkTxlGHFjLQQnWx-Rt9fkNJWmWSuwD_E89YLcVRguFoIFxTKyH-GK_q2PPku0a6iBUKFk-0_Iw30OxLtujSuPndQl339hKk9EITsQPYo-_lyle3KU_XUbNnGoFMHBv6MDiu6HaOu9PE4dYa5zcBceBgoPzV6JKQz_LaJ2llvMbAktkb01_1dl2cRu-McLIvmUOWEf21NB5eu7Xf2xE-4nKnOUGscV-OCVm1L_iPTvKXGOiB-KLsBy5ur2-98JSFTicQdRR3KcjaJIc3IEALoO73zcZjjDJLJ0pK8Xo6N-B22ly-GifFJSvZyVfOn_v6PBzligpbebpJAP1rbp9pzmh8j-QAdlIJtFg_BqC8if3dpRheK__j_GiMjw2pI6QLYEukMpy23kZuO-uDDC2s0Jx8dvmT7esLGS7kAvEbHuai72VCQIUyND1Gwl5Km7SPrxFK7c9RTQ6p7yEQTY7dPiWRwnWB9cdeEUP21qlqoXPjugDEKw%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6133583279631137%26output%3Dhtml%26h%3D280%26adk%3D687377255%26adf%3D4290548377%26pi%3Dt.aa~a.2429977064~rp.2%26w%3D368%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695567335%26rafmt%3D1%26to%3Dqs%26pwprc%3D9847977745%26format%3D368x280%26url%3Dhttp%253A%252F%252Fdocplayer.net%252F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26dt%3D1695574535801%26bpp%3D1%26bdt%3D1455%26idt%3D-M%26shv%3Dr20230920%26mjsv%3Dm202309200101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D29c4fac1d07e5768-22225a0e8ade0054%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA%26gpic%3DUID%253D00000c833d9aefdb%253AT%253D1695574535%253ART%253D1695574535%253AS%253DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg%26prev_fmts%3D0x0%252C1200x280%252C160x600%252C320x100%252C348x280%252C368x280%26nras%3D4%26correlator%3D4297469723446%26frm%3D20%26pv%3D1%26ga_vid%3D1098509612.1695574535%26ga_sid%3D1695574535%26ga_hid%3D1519572728%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D810%26ady%3D2988%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759837%252C44759876%252C44759927%252C31077701%252C31077969%252C44795921%252C31078114%26oid%3D2%26pvsid%3D4260123361248868%26tmod%3D1780058952%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D23%26ifi%3D7%26uci%3Da!7%26btvi%3D4%26fsb%3D1%26xpc%3DiVZjO70nvz%26p%3Dhttp%253A%2F%2Fdocplayer.net%26dtd%3D22&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fdocplayer.net&random=3790174192713&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Sun, 24 Sep 2023 16:55:37 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Sun, 01 Oct 2023 16:55:37 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame 8AD1 0
467 B 750ms
631ms Script
application/javascript 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=84790000102752904444994012457002&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:38 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx
Host: pv.medialead.de
X-IPLB-Request-ID: D972D785:CD6A_91EFC182:01BB_65106A09_180FE04E:22021
X-IPLB-Instance: 40027
Vary: Origin
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Access-Control-Allow-Credentials: true
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame 8AD1 43 B
483 B 1005ms
706ms Image
image/gif 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=84790000102752904444994012457002&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:38 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx
Host: pv.medialead.de
X-IPLB-Request-ID: D972D785:CD86_91EFC182:01BB_65106A09_180E9B36:22023
X-IPLB-Instance: 40027
Vary: Origin
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Access-Control-Allow-Credentials: true
Content-Length: 43
Proxy-Host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 8AD1 43 B
702 B 147ms
94ms Image
image/gif 23.212.218.19
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=84790000102752904444994012457002&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.212.218.19 , United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-212-218-19.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:37 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H2 200 dpixel
cms.quantserve.com/ Frame 68FC 35 B
464 B 79ms
21ms Image
image/gif 2620:116:800d:21:7eb1:3826:be7e:d981
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEPjaYGXZFqGc2u78uDGEVEI&google_cver=1&google_push=AXcoOmScuQI_cUA9lBt25CUDEUlvjAHaEu5SnqJ33CZlfsbPX8VDwNvjVBcdJ7Z7OmxvJBN6BCopWQz7Y7ffLQ9ORGAjma5dDrYAP98

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:7eb1:3826:be7e:d981 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 68FC 0
105 B 203ms
77ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEFw6qjfuBVv1IFolugQU8E0&google_cver=1&google_push=AXcoOmQdKoEqZlHldvu22EXKR_8GukBfNEkRjDoq-rVmbkKt7aN4Jnaszc09bznKkkzobHKOSQXWKdjxf_aLzNKBiSNx1V9GwwU2-BA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=10950491&adf=3202966620&pi=t.aa~a.1856536719~rp.2&w=348&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=348x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100&nras=2&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1218&ady=1855&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Jli3MZYwUS&p=http%3A//docplayer.net&dtd=12
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Sweden, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 68FC
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEAAm5u0sBZV6pPdx3XXGdFw&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEAAm5u0sBZV6pPdx3XXGdFw&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RE9vMzhmT3ExUUtzb3A1&google_gid=CAESEAAm5u0sBZV6pPdx3XXGdFw&google_cver=1&google_push=AXcoOmRJTFBpGbv7TK3oLKqFSY1lDOBZ5VJH0_m-ZH3KwYe...

170 B
188 B

31ms
31ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RE9vMzhmT3ExUUtzb3A1&google_gid=CAESEAAm5u0sBZV6pPdx3XXGdFw&google_cver=1&google_push=AXcoOmRJTFBpGbv7TK3oLKqFSY1lDOBZ5VJH0_m-ZH3KwYe4srB9i2OlAgn5d9nAkDsiCe7wqwDsBhovJpdEU4mS6k2yq6tHmssgDsw

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:36 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-789-g976496f#rel-ec2-master i-09020254b0ff1bdd0@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RE9vMzhmT3ExUUtzb3A1&google_gid=CAESEAAm5u0sBZV6pPdx3XXGdFw&google_cver=1&google_push=AXcoOmRJTFBpGbv7TK3oLKqFSY1lDOBZ5VJH0_m-ZH3KwYe4srB9i2OlAgn5d9nAkDsiCe7wqwDsBhovJpdEU4mS6k2yq6tHmssgDsw
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 68FC
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEIJ-e_UAf1V6rIL85eebBs0&google_cver=1&google_push=AXcoOmTd8iV1rA1QYu90PU0vgHZ-3Xh4cbBTGI8sYNwbufeSa2RxCYywNVJYU4-W-6P83VwsNiDaNKTjV-bFyTK42wF-nM-wSxEZ0...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEIJ-e_UAf1V6rIL85eebBs0&google_cver=1&google_push=AXcoOmTd8iV1rA1QYu90PU0vgHZ-3Xh4cbBTGI8sYNwbufeSa2RxCYywNVJYU4-W-6P83VwsNiDaNKTjV-bFyTK42wF-nM-wSxE...

43 B
424 B

201ms
176ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEIJ-e_UAf1V6rIL85eebBs0&google_cver=1&google_push=AXcoOmTd8iV1rA1QYu90PU0vgHZ-3Xh4cbBTGI8sYNwbufeSa2RxCYywNVJYU4-W-6P83VwsNiDaNKTjV-bFyTK42wF-nM-wSxEZ0Q&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTd8iV1rA1QYu90PU0vgHZ-3Xh4cbBTGI8sYNwbufeSa2RxCYywNVJYU4-W-6P83VwsNiDaNKTjV-bFyTK42wF-nM-wSxEZ0Q%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=10950491&adf=3202966620&pi=t.aa~a.1856536719~rp.2&w=348&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=348x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100&nras=2&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1218&ady=1855&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Jli3MZYwUS&p=http%3A//docplayer.net&dtd=12
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 80bc8e5c9da4bb7d-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 244
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEIJ-e_UAf1V6rIL85eebBs0&google_cver=1&google_push=AXcoOmTd8iV1rA1QYu90PU0vgHZ-3Xh4cbBTGI8sYNwbufeSa2RxCYywNVJYU4-W-6P83VwsNiDaNKTjV-bFyTK42wF-nM-wSxEZ0Q&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTd8iV1rA1QYu90PU0vgHZ-3Xh4cbBTGI8sYNwbufeSa2RxCYywNVJYU4-W-6P83VwsNiDaNKTjV-bFyTK42wF-nM-wSxEZ0Q%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 80bc8e5b3be0bb7d-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 68FC
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEDLah8r5zP56AyBabBliEmM&google_cver=1&google_push=AXcoOmQ9sx3meIrRR2hSw-WUcnFZQf3M8EBepnn7pU3HyDQPYxy-bnsahfFTjnAhpQVdSy2rzG1gOw6DBxyEhtYL5eCTKaO14i03BVQ
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4D889B559DD74294B909034FDEE7BD27&google_push=AXcoOmQ9sx3meIrRR2hSw-WUcnFZQf3M8EBepnn7pU3HyDQPYxy-bnsahfFTjnAhpQVdSy2rzG1gOw6DBxyEhtY...

170 B
188 B

34ms
32ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4D889B559DD74294B909034FDEE7BD27&google_push=AXcoOmQ9sx3meIrRR2hSw-WUcnFZQf3M8EBepnn7pU3HyDQPYxy-bnsahfFTjnAhpQVdSy2rzG1gOw6DBxyEhtYL5eCTKaO14i03BVQ

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 24 Sep 2023 16:55:37 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4D889B559DD74294B909034FDEE7BD27&google_push=AXcoOmQ9sx3meIrRR2hSw-WUcnFZQf3M8EBepnn7pU3HyDQPYxy-bnsahfFTjnAhpQVdSy2rzG1gOw6DBxyEhtYL5eCTKaO14i03BVQ
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sat, 23 Sep 2023 16:55:37 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 68FC 70 B
149 B 149ms
46ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEGWifkb9zDCjdDc2aBKzTOc&google_cver=1&google_push=AXcoOmTAX7vt-d9Pvn91kTKwjx72Q3b7WQ6cnqKfkSmOPc5VZlakgP4K2dv3XU4ecW5_FPWPfukFn0IO5_uFR6D6s0VM3MNHy3tXavM
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=10950491&adf=3202966620&pi=t.aa~a.1856536719~rp.2&w=348&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=348x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100&nras=2&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1218&ady=1855&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Jli3MZYwUS&p=http%3A//docplayer.net&dtd=12
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 68FC
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEKHcx_zOGrALAGvSLFnc1B8&google_cver=1&google_push=AXcoOmRqj0ABQcsfKO0Aw5R6bV6LCtHe_IowlVSkpApYsmOlq92By_JTPIjiAZ3fZrBtKOX8tr55wrErtGN2...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRqj0ABQcsfKO0Aw5R6bV6LCtHe_IowlVSkpApYsmOlq92By_JTPIjiAZ3fZrBtKOX8tr55wrErtGN2xQNJ0No7xttFrjjJmQ

170 B
188 B

32ms
31ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRqj0ABQcsfKO0Aw5R6bV6LCtHe_IowlVSkpApYsmOlq92By_JTPIjiAZ3fZrBtKOX8tr55wrErtGN2xQNJ0No7xttFrjjJmQ

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRqj0ABQcsfKO0Aw5R6bV6LCtHe_IowlVSkpApYsmOlq92By_JTPIjiAZ3fZrBtKOX8tr55wrErtGN2xQNJ0No7xttFrjjJmQ
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 68FC 0
12 B 29ms
29ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LyovO3XPgcYqSdI8Ni7DxD2HEduN7LoRc-TyjtfLNKpaVixtWEu37h1H-2HpLNndTpN1ZS

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 css
fonts.googleapis.com/ Frame 5852 5 KB
682 B 29ms
29ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request_content.php?s=35726500116043204444994012457026&a=bed91e66

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900026.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 24 Sep 2023 16:55:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 16:51:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 24 Sep 2023 16:55:37 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 5852 17 KB
17 KB 79ms
27ms Image
image/png 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request_content.php?s=35726500116043204444994012457026&a=bed91e66
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 0fa91e7c3778d0fed46145cf32c069c6613a72ebf521ef7bbe886d166667642b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900026.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16982
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 5852 16 KB
16 KB 78ms
26ms Image
image/png 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request_content.php?s=35726500116043204444994012457026&a=bed91e66
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 814cbd48106cc86885b9a988961d8e6a4613dbbdc660cb7f46bc28a81b3c0b6b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900026.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16515
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 5852 11 KB
11 KB 80ms
27ms Image
image/png 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native2.png
Requested by: Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request_content.php?s=35726500116043204444994012457026&a=bed91e66
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 18a86a8cf8a79d532955549c8613f4c3eb94476e871349da9180de68fbc1fe24

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900026.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10940
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 dpixel
cms.quantserve.com/ Frame 9125 35 B
464 B 65ms
21ms Image
image/gif 2620:116:800d:21:7eb1:3826:be7e:d981
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEBDM4yvUikONA-BajFs0RMo&google_cver=1&google_push=AXcoOmS_9eMPOnAHPoghrT6V0GQjfqlQkF2yUuBGIwcz3N0p6v8mkHxymibJ2eCUhwJwl_H-qWsJl9L7xMzXmt3xCjpZkgbI3rVrvP0

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:7eb1:3826:be7e:d981 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 9125 0
104 B 190ms
78ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEJJ-zAezdLHnySn8BXVuoe4&google_cver=1&google_push=AXcoOmSVFQTKw7tP8xCs1LLJKk-OvKdi_gNLeu9-RBU_JMWqW4ZNilSWkjf2S1lIXY_Tlk7RWJLiu4t2OwJoJ4oAcy5CxXckowdPJrk
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=724619058&pi=t.aa~a.1856579592~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280&nras=3&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=2808&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ZE5btzgJdW&p=http%3A//docplayer.net&dtd=17
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Sweden, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9125
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEA_yFolLqdLFz7Srn3aHCdI&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEA_yFolLqdLFz7Srn3aHCdI&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RE9vMzhmT3ExUUtzb3A1&google_gid=CAESEA_yFolLqdLFz7Srn3aHCdI&google_cver=1&google_push=AXcoOmQWqpV0aFkGJN6gWyGweGqEaMourm4Em0HkABKZWRc...

170 B
188 B

31ms
31ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RE9vMzhmT3ExUUtzb3A1&google_gid=CAESEA_yFolLqdLFz7Srn3aHCdI&google_cver=1&google_push=AXcoOmQWqpV0aFkGJN6gWyGweGqEaMourm4Em0HkABKZWRc4zedmHo5icFA2rk7nNdqEnmjOqZV7nLtlmDjq9ns6IibhbKfTckgTGg

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:37 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-789-g976496f#rel-ec2-master i-0848f2daa11a85918@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RE9vMzhmT3ExUUtzb3A1&google_gid=CAESEA_yFolLqdLFz7Srn3aHCdI&google_cver=1&google_push=AXcoOmQWqpV0aFkGJN6gWyGweGqEaMourm4Em0HkABKZWRc4zedmHo5icFA2rk7nNdqEnmjOqZV7nLtlmDjq9ns6IibhbKfTckgTGg
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 9125 70 B
150 B 135ms
45ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEFTNmPzVIzk4vem8461MVQc&google_cver=1&google_push=AXcoOmQaKGzq4scPUztHqx_Sp5oSpBNfx_L_m61UFEGLHGT1J1vQbyoIt87Eagl8wF968wTC7O_ozDTowNNhf3OYpgfYfG4KmW67o-s
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=724619058&pi=t.aa~a.1856579592~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280&nras=3&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=2808&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ZE5btzgJdW&p=http%3A//docplayer.net&dtd=17
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9125
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEAmEBV178Bjyf3Rf0VBYu6I&google_cver=1&google_push=AXcoOmToYWoO8mBUwvGhAjuWjnhwzpwH5YD_aZOkyi_7QhMETh1DQpU1nCkbGnsMyksI2o3sHuTqV27a5CD8eL05SS-52hD...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmToYWoO8mBUwvGhAjuWjnhwzpwH5YD_aZOkyi_7QhMETh1DQpU1nCkbGnsMyksI2o3sHuTqV27a5CD8eL05SS-52hDmKMG87HQ&google_hm=eS1IQlR6aUJwRTJwRkV...

170 B
188 B

33ms
33ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmToYWoO8mBUwvGhAjuWjnhwzpwH5YD_aZOkyi_7QhMETh1DQpU1nCkbGnsMyksI2o3sHuTqV27a5CD8eL05SS-52hDmKMG87HQ&google_hm=eS1IQlR6aUJwRTJwRkV4bEw5cE5LVHpZX2prMmQydXdqT35B

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 24 Sep 2023 16:55:37 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmToYWoO8mBUwvGhAjuWjnhwzpwH5YD_aZOkyi_7QhMETh1DQpU1nCkbGnsMyksI2o3sHuTqV27a5CD8eL05SS-52hDmKMG87HQ&google_hm=eS1IQlR6aUJwRTJwRkV4bEw5cE5LVHpZX2prMmQydXdqT35B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 9125 43 B
363 B 87ms
27ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQXxOrr8FhJVQp1uwYJOLk1RD_au3KbYXbFH_H8JtP4JHVE_5n8P_M_jSF86mQ-f-7TgFM3s7v0p-nyjMSB8LS1QJTCrUK4agc&google_gid=CAESEJPzuGjwVKBFXwt-sQXhn08&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 177614
expires: Sun, 24 Sep 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9125
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEFt9h0CcNE_Io2DBuCBK5QE&google_cver=1&google_push=AXcoOmQArtY5CSd5xn29PEB0ZL1dbg_qVV50WEa9Au0LxfGSimdNoteIoCStDrDPuQrFThpk168_Tl0k_udc...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQArtY5CSd5xn29PEB0ZL1dbg_qVV50WEa9Au0LxfGSimdNoteIoCStDrDPuQrFThpk168_Tl0k_udcDXuBOrWgXvAp6JoMr4k

170 B
188 B

33ms
32ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQArtY5CSd5xn29PEB0ZL1dbg_qVV50WEa9Au0LxfGSimdNoteIoCStDrDPuQrFThpk168_Tl0k_udcDXuBOrWgXvAp6JoMr4k

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQArtY5CSd5xn29PEB0ZL1dbg_qVV50WEa9Au0LxfGSimdNoteIoCStDrDPuQrFThpk168_Tl0k_udcDXuBOrWgXvAp6JoMr4k
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 9125 0
12 B 32ms
31ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KHD31ryHQvz3aY-ISdnToa6SWILYNlBMlz3aG0Jwpg6CFe7adepDmj6jYdFVLfUc83rAIi

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame 9EEB 171 KB
62 KB 29ms
29ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

05ccd746e65bf07b3882e4dfde5d8b4d7f07d9ee6605a0dcb914d991e0853be3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63320
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 24 Sep 2023 16:55:37 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame BB39 171 KB
62 KB 32ms
30ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

aa36c8464b2f1f0f420ec485ac2334a0714829d17cdea168fcd47e6ebabfec11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63317
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 24 Sep 2023 16:55:37 GMT

GET
H/1.1 200
OK viewability Show response
hal900028.redintelligence.net/ Frame CB52 0
150 B 82ms
30ms Script
text/html 88.99.165.19
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900028.redintelligence.net/viewability?s=53980700112083004444994012457028&a=fc0dee05&vb=m
Requested by: Host: hal900028.redintelligence.net
URL: https://hal900028.redintelligence.net/request_content.php?s=53980700112083004444994012457028&a=d25c6cc4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.165.19 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.19.165.99.88.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900028.redintelligence.net/request_content.php?s=53980700112083004444994012457028&a=d25c6cc4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:37 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame C0AB 171 KB
62 KB 32ms
31ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

05ccd746e65bf07b3882e4dfde5d8b4d7f07d9ee6605a0dcb914d991e0853be3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63320
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 24 Sep 2023 16:55:37 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 9219 0
46 B 175ms
174ms Ping
image/gif 2607:f8b0:400a:805::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&puid=4~lmxpatgz&c=5110886411321&slotId=2555443205660.5&qqid=CJj57K7bw4EDFYkVrQYd69QESA&fb=outstream-lima&gpm_i=6&gpm_c=6&gpm_a=6&smb=1000&br=984&mt=video%2Fmp4&vs=640x360&msm=1&aits=0%2C18%2C59%2C342%2C343%2C345%2C346&webm=0&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4&hvmf=false&vms=1&bit=343&vsrc=web_video_ads&hcn=0&met.4=arp_a_e.11r~vil.1f1&ua_e=1&ape=1&ple=0&umsem=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20230802_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400a:805::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 1D61 5 KB
682 B 31ms
30ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=54363700101959804444994012457014&a=e16db843

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 24 Sep 2023 16:55:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 16:48:51 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 24 Sep 2023 16:55:37 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 1D61 17 KB
17 KB 75ms
26ms Image
image/png 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=54363700101959804444994012457014&a=e16db843
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 0fa91e7c3778d0fed46145cf32c069c6613a72ebf521ef7bbe886d166667642b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16982
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 1D61 16 KB
16 KB 78ms
26ms Image
image/png 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=54363700101959804444994012457014&a=e16db843
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 814cbd48106cc86885b9a988961d8e6a4613dbbdc660cb7f46bc28a81b3c0b6b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16515
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 1D61 11 KB
11 KB 81ms
26ms Image
image/png 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native2.png
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=54363700101959804444994012457014&a=e16db843
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 18a86a8cf8a79d532955549c8613f4c3eb94476e871349da9180de68fbc1fe24

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:37 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10940
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame 0477 171 KB
62 KB 29ms
29ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

aa36c8464b2f1f0f420ec485ac2334a0714829d17cdea168fcd47e6ebabfec11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63317
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 24 Sep 2023 16:55:37 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 7FF7 171 KB
62 KB 33ms
33ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9a14b16d660a739cce0412966557e3262533be56445620b47f4632a6432d0c7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63326
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 24 Sep 2023 16:55:37 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A148
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEMdR3wmSmMEWYxlXNmr-S28&google_cver=1&google_push=AXcoOmS1yZ-_Ay-DwWrp5E9f2shjSh_KHTCb7t5GVm0-FRDbAWRyrxKXLpx_7RjxYQfL4MF8i6MbJxTxIzkfKOarH0BjIilS7HukvX...
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=D25DB5B8B5234CAE8F22848EDACE3E7E&google_push=AXcoOmS1yZ-_Ay-DwWrp5E9f2shjSh_KHTCb7t5GVm0-FRDbAWRyrxKXLpx_7RjxYQfL4MF8i6MbJxTxIzkfKOa...

170 B
188 B

32ms
31ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=D25DB5B8B5234CAE8F22848EDACE3E7E&google_push=AXcoOmS1yZ-_Ay-DwWrp5E9f2shjSh_KHTCb7t5GVm0-FRDbAWRyrxKXLpx_7RjxYQfL4MF8i6MbJxTxIzkfKOarH0BjIilS7HukvX3PaWsOEQ4dDyMXqnlM6PQZqLHH5Ddr48qNXQaWiDdIQYbhEasda6eiBK8

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 24 Sep 2023 16:55:37 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=D25DB5B8B5234CAE8F22848EDACE3E7E&google_push=AXcoOmS1yZ-_Ay-DwWrp5E9f2shjSh_KHTCb7t5GVm0-FRDbAWRyrxKXLpx_7RjxYQfL4MF8i6MbJxTxIzkfKOarH0BjIilS7HukvX3PaWsOEQ4dDyMXqnlM6PQZqLHH5Ddr48qNXQaWiDdIQYbhEasda6eiBK8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sat, 23 Sep 2023 16:55:37 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame A148 70 B
149 B 60ms
46ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEHDt_3gbdyCTOjkfP37nNLc&google_cver=1&google_push=AXcoOmRkXvXVH9n2my6XdSpnP9WY0b2lTImuN2xc--u93iq3revc2SxOE_h8I3HlgAfrk7Hur7LBmIoKAr9Lr2eL_Kj5Bw-4ZhMObeVjthquyUF-UmKZh0ogGNx_6K1p2gxNGW3qDja6DKR17pqgUbui75aNXlI
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2 204 sync
x.bidswitch.net/ Frame A148 0
73 B 83ms
24ms Image
text/plain 3.121.203.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEEhO2iTabTtrdlZmo78qvxY&google_cver=1&google_push=AXcoOmS9BeotgjKKn-Hz7uSjnmYipBtLHJ6g0AnXVVweE3GQt3E4bRV_N9TP062u5aCOtGHnNzpmuk3AfJzhFYwlMD-FldZy5Osr1_sv-SW88twUSTxApNT3AKkx49Ittoh1b4tkkSaG9501SGMvlwCYSs5ZT3I
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.121.203.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-121-203-109.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
cache-control: no-cache, no-store, must-revalidate

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A148
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEGlMP7RkPt4uxMISRUVjQmw&google_cver=1&google_push=AXcoOmRiYAKv-74cHKtp2s32T4Y5mP2sihJjLnsvsXJtnvavkBoN8M9mJSl9KaMI6C6mKBSh16n7sryVINUSgQM3VP70aXk...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRiYAKv-74cHKtp2s32T4Y5mP2sihJjLnsvsXJtnvavkBoN8M9mJSl9KaMI6C6mKBSh16n7sryVINUSgQM3VP70aXk06FIa-zB-5yxc8w8CanmMQi-7VMLh7RcaRk6In...

170 B
188 B

32ms
32ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRiYAKv-74cHKtp2s32T4Y5mP2sihJjLnsvsXJtnvavkBoN8M9mJSl9KaMI6C6mKBSh16n7sryVINUSgQM3VP70aXk06FIa-zB-5yxc8w8CanmMQi-7VMLh7RcaRk6IndiRSfz7fOH6_ameZhM69RENiWc&google_hm=eS1lT3NOQm9SRTJwRldkZkk0djRIQzVWMEZxeW1vMmVUT35B

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 24 Sep 2023 16:55:37 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRiYAKv-74cHKtp2s32T4Y5mP2sihJjLnsvsXJtnvavkBoN8M9mJSl9KaMI6C6mKBSh16n7sryVINUSgQM3VP70aXk06FIa-zB-5yxc8w8CanmMQi-7VMLh7RcaRk6IndiRSfz7fOH6_ameZhM69RENiWc&google_hm=eS1lT3NOQm9SRTJwRldkZkk0djRIQzVWMEZxeW1vMmVUT35B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame A148 43 B
362 B 30ms
25ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQEsoDSV1kvo4HCBVw8tK33BoCawvlyEQ-bgGFeiKu3xYgPKnSAGAaxfARdc85wWbiyuOR6BGh5AmYFQbvjRfA_acthcvsm31Da11GgzcFKszT1khjA72WxlmungaLyv5NT7oycNPVUqNHp9C7YVAhDGmc&google_gid=CAESEDjNgos0XIzPvtEGAo2yBl0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:36 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 266039
expires: Sun, 24 Sep 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A148
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEIMJNTqn0QCgLB-J1Z2iTaE&google_cver=1&google_push=AXcoOmRou1EPCxUDwxkLQKoFJo6pOw0AFHZnyaFiyLkHAHmVIfFIMffjVj7mH0bx6hp4IO7ZPPUgkvtc...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEIMJNTqn0QCgLB-J1Z2iTaE&google_cver=1&google_push=AXcoOmRou1EPCxUDwxkLQKoFJo6pOw0AFHZnyaFiyLkHAHmVIfFIMffjVj7mH0bx6hp4IO7ZPPU...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzU0Nzc3MzcxMDUwNDU3NDI1Mw&google_push=AXcoOmRou1EPCxUDwxkLQKoFJo6pOw0AFHZnyaFiyLkHAHmVIfFIMffjVj7mH0bx6hp4IO7ZPPUgkv...

170 B
188 B

33ms
33ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzU0Nzc3MzcxMDUwNDU3NDI1Mw&google_push=AXcoOmRou1EPCxUDwxkLQKoFJo6pOw0AFHZnyaFiyLkHAHmVIfFIMffjVj7mH0bx6hp4IO7ZPPUgkvtcJ8EW3R-NJZXAlsdhxRQC1366mEbzJJkkJI81HEqiuTuzo8YxctC-WHGD0qbbQ7Y2WTEoyapluHT7Br4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzU0Nzc3MzcxMDUwNDU3NDI1Mw&google_push=AXcoOmRou1EPCxUDwxkLQKoFJo6pOw0AFHZnyaFiyLkHAHmVIfFIMffjVj7mH0bx6hp4IO7ZPPUgkvtcJ8EW3R-NJZXAlsdhxRQC1366mEbzJJkkJI81HEqiuTuzo8YxctC-WHGD0qbbQ7Y2WTEoyapluHT7Br4
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A148
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEGJowyMKTglc5AXQy-Vn8XQ&google_cver=1&google_push=AXcoOmQOKoXAYzCpTRZPR7h1np1MLFbVjt6zRD3UKTGBF1wTmbFcz5BrO7gi2u-dSb1O_7i0qoYZVaA7qP9n...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQOKoXAYzCpTRZPR7h1np1MLFbVjt6zRD3UKTGBF1wTmbFcz5BrO7gi2u-dSb1O_7i0qoYZVaA7qP9njhKUjSA5NoQ80halVpGOF9f32LXoUxtJMO9W...

170 B
188 B

33ms
31ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQOKoXAYzCpTRZPR7h1np1MLFbVjt6zRD3UKTGBF1wTmbFcz5BrO7gi2u-dSb1O_7i0qoYZVaA7qP9njhKUjSA5NoQ80halVpGOF9f32LXoUxtJMO9WNw14P9svdV2BdDSHeZNzX3VLNbGO_FCswPT9W3U

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQOKoXAYzCpTRZPR7h1np1MLFbVjt6zRD3UKTGBF1wTmbFcz5BrO7gi2u-dSb1O_7i0qoYZVaA7qP9njhKUjSA5NoQ80halVpGOF9f32LXoUxtJMO9WNw14P9svdV2BdDSHeZNzX3VLNbGO_FCswPT9W3U
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame A148 0
12 B 35ms
31ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LAGAnuTIE9eWemlGNF6MyvS7oA3-FRK6YleL9vVUlqX31XrntONK2wxa5yT0siijqBg6Ax

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK viewability Show response
hal900026.redintelligence.net/ Frame 5852 0
150 B 73ms
24ms Script
text/html 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900026.redintelligence.net/viewability?s=35726500116043204444994012457026&a=2948172d&vb=m
Requested by: Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request_content.php?s=35726500116043204444994012457026&a=bed91e66
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900026.redintelligence.net/request_content.php?s=35726500116043204444994012457026&a=bed91e66
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:37 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame CB52 14 KB
15 KB 26ms
20ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900028.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 23:04:46 GMT
x-content-type-options: nosniff
age: 150651
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 23:04:46 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame CB52 15 KB
15 KB 33ms
27ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900028.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 03:41:01 GMT
x-content-type-options: nosniff
age: 220476
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 03:41:01 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame A5D4 51 KB
18 KB 122ms
31ms Script
text/javascript 52.222.139.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=35726500116043204444994012457026&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.139.14 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-139-14.ams50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 43c969dd91796954ee5b0d995fddf5dc9b008844db541a4103c1d95b28ef2f74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 02:14:38 GMT
content-encoding: gzip
via: 1.1 12ab600b22d5c2eb1f2192b1156c2fd0.cloudfront.net (CloudFront)
last-modified: Mon, 07 Aug 2023 14:11:27 GMT
server: AmazonS3
x-amz-cf-pop: AMS50-C1
age: 52865
etag: W/"cb7accb6a6fc086cd831549a78a2fe42"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: XBCeNCOXCKqHxUCKtuNFWiNYfLQv0Ev5eksTDYxLqZh1wjbPFcnjdA==

GET
H2 200 1x1_0.png
cdn.track.production.webgains.team/7121/ Frame A5D4 3 KB
3 KB 96ms
26ms Image
image/png 18.239.50.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1_0.png?Expires=1695574837&Signature=LyxVcIQIE8elrcGgpwi74vqrtfijZqjZ6wPeAMie0E40sHcdyjFTJGF-GNhKD4FOHB-f1do71QOtqeEHGhgXFmdE3W1TCRmPNJn2xHmS8vj~PU16d0Y9QMkR6jEewTXxv-IvOw-1qgtASIkAjHOGTtV3x6f3~OSKz7ujl2KPRem9CUhi21qsWuvmP5HNloungzqQQKY4vrgsm2ac6T16GaGFmxMvrEJp04Kp8lHuvk0Hid6wxD2O0juwkTzNHimowvptYnPxTSgEsum3Oh~PaFobrtJ~CHnaXPpaOO-In6SAqYZKhz1cjyEU7DsQq1l3BfDRp3dn5aVtfTdbwuc10A__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=724619058&pi=t.aa~a.1856579592~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280&nras=3&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=2808&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ZE5btzgJdW&p=http%3A//docplayer.net&dtd=17
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.50.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-50-87.ams58.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

x-amz-version-id: null
date: Sun, 24 Sep 2023 07:42:30 GMT
via: 1.1 5090b605a7b968781de55827dd170bf2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: AMS58-P3
age: 33192
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: LUdLoPPZeRPcKGc6V8zKgt85auermCzFz9XiNIAfqxtoBWc5wBmyWg==

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 8E22 51 KB
18 KB 145ms
54ms Script
text/javascript 52.222.139.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=53980700112083004444994012457028&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.139.14 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-139-14.ams50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 43c969dd91796954ee5b0d995fddf5dc9b008844db541a4103c1d95b28ef2f74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 02:14:38 GMT
content-encoding: gzip
via: 1.1 12ab600b22d5c2eb1f2192b1156c2fd0.cloudfront.net (CloudFront)
last-modified: Mon, 07 Aug 2023 14:11:27 GMT
server: AmazonS3
x-amz-cf-pop: AMS50-C1
age: 52865
etag: W/"cb7accb6a6fc086cd831549a78a2fe42"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: 9iDtWFdfExdxI0WL3XjHgvQyZ-hHFdRcEjGypX7gIi83BJTIrxwCIA==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame 8E22 3 KB
3 KB 98ms
27ms Image
image/png 18.239.50.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1695574837&Signature=SllFIvQO041GNlsS28YrucF~Z2DZqIHmbHvlPUV9eMAypeyiNbq6rqz2wSc0CohjDnwXXiT1lYA981h2crrbA9L8VaLshvSUCnfVYE0jUJ2bUE6jrIWw9ZEHZvOr7NV5kWG37RUDCx6XxLDWCtyuj5HlUk~QERhQFHgYFvfd5wq8xFB6s4JbaF7R851SIRIPsseeOkCVB7VXOECr8eO7IHV2opoeej6Q-cxc065jwhVkZ~~pgx86is-F9BCaMofL1c2bnzy~VQPYlGvyAIz13czYpXNyv4HXcIgO05zgMphjZNoT52f2J2Xqh3BdjclvJje5Ie~PI8~RriWVcx17GA__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=10950491&adf=3202966620&pi=t.aa~a.1856536719~rp.2&w=348&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=348x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100&nras=2&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1218&ady=1855&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=Jli3MZYwUS&p=http%3A//docplayer.net&dtd=12
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.50.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-50-87.ams58.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

x-amz-version-id: null
date: Sun, 24 Sep 2023 09:16:29 GMT
via: 1.1 5090b605a7b968781de55827dd170bf2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: AMS58-P3
age: 27581
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: -8HdZKaLyYfru7Trhtts-BqlmmnDLdySwG-D4XuKqrjelTaCNHStxg==

GET
H2 200 dc_pre=CK-s9q_bw4EDFTPUOwIdLXwAJQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1100649423509.4055
adservice.google.com/ddm/fls/z/ Frame 94EB 42 B
402 B 110ms
58ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CK-s9q_bw4EDFTPUOwIdLXwAJQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1100649423509.4055

Requested by

Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=CK-s9q_bw4EDFTPUOwIdLXwAJQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1100649423509.4055?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8019191.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CKm_-K_bw4EDFdLeOwId4CAFXg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3751566521091.7627
adservice.google.com/ddm/fls/z/ Frame D539 42 B
108 B 104ms
59ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CKm_-K_bw4EDFdLeOwId4CAFXg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3751566521091.7627

Requested by

Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=CKm_-K_bw4EDFdLeOwId4CAFXg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3751566521091.7627?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8019191.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame EDB4 51 KB
18 KB 101ms
35ms Script
text/javascript 52.222.139.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=54363700101959804444994012457014&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.139.14 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-139-14.ams50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 43c969dd91796954ee5b0d995fddf5dc9b008844db541a4103c1d95b28ef2f74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 02:14:38 GMT
content-encoding: gzip
via: 1.1 12ab600b22d5c2eb1f2192b1156c2fd0.cloudfront.net (CloudFront)
last-modified: Mon, 07 Aug 2023 14:11:27 GMT
server: AmazonS3
x-amz-cf-pop: AMS50-C1
age: 52865
etag: W/"cb7accb6a6fc086cd831549a78a2fe42"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: 4IZWxUFUfs7WyicJL2CCnDOKQVFgeGmQSquH6ug3OVBLEWmYEZp08w==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame EDB4 3 KB
3 KB 72ms
27ms Image
image/png 18.239.50.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1695574837&Signature=SllFIvQO041GNlsS28YrucF~Z2DZqIHmbHvlPUV9eMAypeyiNbq6rqz2wSc0CohjDnwXXiT1lYA981h2crrbA9L8VaLshvSUCnfVYE0jUJ2bUE6jrIWw9ZEHZvOr7NV5kWG37RUDCx6XxLDWCtyuj5HlUk~QERhQFHgYFvfd5wq8xFB6s4JbaF7R851SIRIPsseeOkCVB7VXOECr8eO7IHV2opoeej6Q-cxc065jwhVkZ~~pgx86is-F9BCaMofL1c2bnzy~VQPYlGvyAIz13czYpXNyv4HXcIgO05zgMphjZNoT52f2J2Xqh3BdjclvJje5Ie~PI8~RriWVcx17GA__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=54363700101959804444994012457014&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.50.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-50-87.ams58.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

x-amz-version-id: null
date: Sun, 24 Sep 2023 09:16:29 GMT
via: 1.1 5090b605a7b968781de55827dd170bf2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: AMS58-P3
age: 27581
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: IjgL_T3yrtCPydyiiE8UiWlOoAzV0csDS9FYoSc5AisnKILzSfZzhw==

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A7FD 0
20 B 131ms
126ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BHIL_CGoQZZikO8yXjuwP-_WE8A8AAAAAOAHgBAI&bg=!4uGl4a7NAAbbC4-Z-ws7ADQBe5WfON2aXKkjo1shRpvHssg4GELYQaGfzrDEm-vbEKG7a5m2jo2PJmeWMzXb3ngyFX9uAgAAAThSAAAABWgBB5kC_8eNwRNA8xQH1CT-33PqfVqvTxUdobd4Rsrvl_SD6MD2OujRJchA2GRS-XeiT__dweldu1SnaiaywWB0pvvpYKixLTUuMls5vaUrJ3Iqz_VfmuV5yM14mxiANWa3TkPu0ITfFHSIAxiyG6wJhe34OOtSzUZX14Fgf7BgR7FuIGvOeC4wdtAq93rx0ehevgnduKIgO2UvDKNIT69ae_WYZST3yjIoBQCJcBof51l5Y9ZzElfmGr4LTW_TeqG3jpyrqbgkYZOHmRU-R4_D1HNvvXOjFBPOMXxVvlU7hAqJBws39t10lMurOqd0UdHlo-mufnml4w6gki38079mWMqjzbMs2yyqyUOUPng2_KXQvrmZm1mZZernKBkwj_bR2J8bFgFeytg4b8bDiEL4VASJHf1SWdke8ptOjTqEHVdOjM60qMAX__eY_NiTt5306cTI4GYzxQV2cJGnGJAk7HQ_qCKKQ_S_0vLS9XUTFET_e8xZHKmjUhwgOG2t1Ya_4uLNhymW9Wdr4Nkf8nJkdlIKXT6iZoZdKn7zHSy_Fh5lllF7cUbpmxxY-5jAGRMWMUiTTC9Rke63J6NGuwChlQPbKA08qaaxN7zyii6nY6LCV4zzUrwa5Tze2gunllNVGmonvZc_pdRhqpgzLjYx4xMi1pAQnAL7Uy6ccoWOVFzlwp-2YHYbC_3i6j_N9rWfbMjmvLA8Shwu_CTDmcCwtkpTOiyEKkUXNObegLnTkUwmqE9ppKoTSXtSd7NZWq07AuX_3yyPn4i-f7EStrVrIlCQmFEDwr5BubUrLiXRXoTL74VikRhJZVSDZVQTMTl9tnnjPOurfpbauXrY__KI0_qTuUzAe_c5VttVxS-0dL6tsdo4c9KWI3pv6foBZ7U7KWXQG0nJESrePKG2ZQM-1t63QY-iIi393eaKXdRKa0UEjExGaaEYfqaDl_p9N8SUvbozzLZSc4217o-CnZb2NXOOkvCK1eVAD2AyQuJ_7w5S4QDgIujokdjDtZag22T75vUt

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=1097532353&pi=t.aa~a.1853940267~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1456&idt=1&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280%2C368x280&nras=6&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=15&ady=3945&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=QLB7WWkqKP&p=http%3A//docplayer.net&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 5852 14 KB
15 KB 20ms
19ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900026.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 23:04:46 GMT
x-content-type-options: nosniff
age: 150651
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 23:04:46 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 5852 15 KB
15 KB 22ms
21ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900026.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 03:41:01 GMT
x-content-type-options: nosniff
age: 220476
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 03:41:01 GMT

GET
H/1.1 200
OK viewability Show response
hal900014.redintelligence.net/ Frame 1D61 0
150 B 78ms
27ms Script
text/html 176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/viewability?s=54363700101959804444994012457014&a=15b90075&vb=m
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=54363700101959804444994012457014&a=e16db843
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.26.250 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/request_content.php?s=54363700101959804444994012457014&a=e16db843
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:37 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 dc_pre=COfA-K_bw4EDFaXbOwId9HUDXg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4140701813131.018
adservice.google.com/ddm/fls/z/ Frame 2066 42 B
108 B 66ms
59ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=COfA-K_bw4EDFaXbOwId9HUDXg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4140701813131.018

Requested by

Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=COfA-K_bw4EDFaXbOwId9HUDXg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4140701813131.018?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8019191.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 1D61 14 KB
15 KB 20ms
19ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900014.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 23:04:46 GMT
x-content-type-options: nosniff
age: 150651
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 23:04:46 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 1D61 15 KB
15 KB 21ms
20ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900014.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 03:41:01 GMT
x-content-type-options: nosniff
age: 220476
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 03:41:01 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 9EEB 271 KB
91 KB 30ms
29ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

57829a9ab0eed330dccb3cf5b998cfc60bee73151469209644ad3d2b07ac0a7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92720
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 24 Sep 2023 16:55:37 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame BB39 271 KB
91 KB 34ms
34ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b52724ab0686937deaa968cd78ba0bb2ac1ae5b14343592dde1a1befcc341321

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92814
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 24 Sep 2023 16:55:37 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F5E2 0
20 B 126ms
126ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BBvm0CGoQZY6gNpSD1PIPsqOfqAsAAAAAOAHgBAI&bg=!l5SllNvNAAbbC4-Z-ws7ADQBe5WfOEmrvdBvrrMXbzpOYkbs_uz96iA2Gq5hcBGx8G-phpO610yUhoJ-j5xWYzIHhXhiAgAAAUhSAAAABmgBB5kDAduepWG7_d4QAhafNHN6aU6gE7eQboIhI7g7QFizxU89VEFLVJmlJYRPbTISXOXnR2gYjhyDMiP2TxUyYMlnx6EVsVnHX3sa30ebkTwB-ZRjfTid13bz7-kGRLaFNkeJMc8y_AJ1fUKMHdWKnznlca2eTcTbY8H1QhdQZ0hcUiXnJV-B5Xi1lfBUZXRbuDnRZH8t1Jo_GCj5CQZang_6KUOsZ5w1_8c2b4kN9ClASDzD17u0af38vW0ZW_VcASxlyjbO1J7TgOLwoFEfTcKfLFFDcBoy8phSKYfxHjYSavDkzNm_0YyNGMmbbi-skC3a1LAHvAmkHW6v1MdHEixxL_drS7lzd6ZgnrCDpm8ZGnpapbhjDcauf0I02hf9jqFNhHB_9Q8iAg9-0keX-Mb0AHCJCx-LzvPYLn5HNVW77RI6JlzQcH3ydlFP5HpAqXP-99hNEEUrKYDrdgqSgCnaWBJkMPnsGmsmJQJXGfs-2TIKWt2PvFiU5blBI9E5jpZczYktzOERWMkz6Fns5Hb4eJnSfCsXzWpiT3GRYdBNPD8aOIIisbjBmuZKaAOL91kner2BrzzIbE0bgrzAaHNyDsr88H8e7R8AlU2AsWpxnWKyojkPL7w9hENdFGFv_PZdQsRN5rlx6Bjv5Xn2n_LkfvbAHoocaooOKjU3uu_Srjf51ohKIWksoqMsce5t-t_0BqLcyiuvX3VLuH_hO_7y4SjJItDWKIx_ndSCE47TBKxb0o0a5o9sK6ZmVLxX9PEeyzDmuxwHlPcf8D93_CyBNcBMPum1l4ZUxVo0hAUSCuVRc2IqVeeq1vNnwXbKA8cDlsgfkFg6_7sModwjo7MedpTalo92vfMmMoWKJEgfFVnh2T-v3cXgr2tbUz9cKh9mithtjr1NyGY_NQ7VAwueLphzE9h0IZskudKV_HXZVOa9E7l6lq1KC5OM0axv4LLN9bV1Uw4uaWhZeH25TmCqn4SGjYgjuzotvUn8jMfvix2jp2nizsEUjPwEn_0ip1rk5-A

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame C0AB 271 KB
91 KB 36ms
36ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f468cc05207b416435b35433e0ab00822521f6a61fa2698e58ac00f908b6510b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92814
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 24 Sep 2023 16:55:37 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 0477 271 KB
91 KB 40ms
40ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d1c80ad3e404904e2304844335e7c12be4d6047df4feae69abe59802173f8639

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92815
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 24 Sep 2023 16:55:37 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 7FF7 271 KB
91 KB 46ms
46ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1ad285e3f91378337f86ad2c20d72c225841bf6753d4f381878617463cdf44d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92714
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 24 Sep 2023 16:55:37 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame EEB3 42 B
64 B 126ms
126ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst8cJop5FKOAAOayQYOoNglJE-grubP15U4-FRqAUYiItBk0zBQ2FoNKn_qdGzVqHXOTDH3bYm485d4vd17aqJAF-dLHtK7kUlwhSxc058eY3jIqmcwnzj_ietIDCmbEZg5Xi1li_a4wLRx&sai=AMfl-YSpttIOBQ50Q8P6wCfcMllBjQY2VYDAOKf4B_TSl9a7RT1muGrh2qwVCFkeWGMspfXuuxUwtGNXkE95&sig=Cg0ArKJSzGi_78xaSwAwEAE&cid=CAQSGwBpAlJW2ClcnodFpedo8VyfWtSxwxy6JprxchgB&id=lidar2&mcvt=1034&p=0,0,280,1200&mtos=1034,1034,1034,1034,1034&tos=1034,0,0,0,0&v=20230920&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=2565328533&rs=2&la=1&cr=0&vs=4&r=v&rst=1695574535031&rpt=1648&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 link.html Show response
track.webgains.com/ Frame D941 2 KB
2 KB 92ms
91ms Script
text/html 18.134.234.224
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=25224300101959904444994012457014&nw=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.134.234.224 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-134-234-224.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 4f89e207bfd639e19bf57567110f4d64fd3b653412a77abcaae085c14da3d164

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:38 GMT
last-modified: Sun, 24 Sep 2023 16:55:38 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Sun, 24 Sep 2023 16:56:38 GMT

GET
H3

200

activityi;dc_pre=CPPap7Dbw4EDFdTQOwIdkrQLKQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5675694559888.354 Show response
8019191.fls.doubleclick.net/ Frame AFF5
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5675694559888.354?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CPPap7Dbw4EDFdTQOwIdkrQLKQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5675694559888.354?

391 B
240 B

66ms
65ms

Document
text/html

142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CPPap7Dbw4EDFdTQOwIdkrQLKQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5675694559888.354?

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b586876dd86245afce63bbe169727bc66096918c65f6d3108cd801113a3aec40

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 217
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:38 GMT
expires: Sun, 24 Sep 2023 16:55:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:38 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CPPap7Dbw4EDFdTQOwIdkrQLKQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5675694559888.354?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900014.redintelligence.net/ Frame D094 7 KB
2 KB 79ms
26ms Document
text/html 176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/request_content.php?s=25224300101959904444994012457014&a=c789276d
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.26.250 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: 8513a113c74888a2f24e1922243dd904bbaaf8708c8892c681821379b8992ec4

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2099
Content-Type: text/html; charset=utf-8
Date: Sun, 24 Sep 2023 16:55:38 GMT
Expires: Sun, 24 Sep 2023 17:55:38 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame CB7B 1 KB
643 B 25ms
20ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 76129
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 19:46:49 GMT
etag: 48472445140208031
expires: Sun, 24 Sep 2023 19:46:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame D941 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5312a297ed1cb09db8aa30abe9d7b8df489d22e6608a3e652dcf94f26fc7c08

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 link.html Show response
track.webgains.com/ Frame 8AD1 2 KB
2 KB 91ms
90ms Script
text/html 18.134.234.224
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=84790000102752904444994012457002&nw=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=4290548377&pi=t.aa~a.2429977064~rp.2&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280&nras=4&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=810&ady=2988&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=iVZjO70nvz&p=http%3A//docplayer.net&dtd=22
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.134.234.224 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-134-234-224.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 2df84f2fd0816ee40fe7b2b709de3c44363a6a7020fa43b14b648bf5467fe237

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:38 GMT
last-modified: Sun, 24 Sep 2023 16:55:38 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Sun, 24 Sep 2023 16:56:38 GMT

GET
H3

200

activityi;dc_pre=CK_9t7Dbw4EDFVGqmgodJ_sC2g;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2364022604629.8984 Show response
8019191.fls.doubleclick.net/ Frame 94E1
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2364022604629.8984?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CK_9t7Dbw4EDFVGqmgodJ_sC2g;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2364022604629.8984?

392 B
239 B

66ms
66ms

Document
text/html

142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CK_9t7Dbw4EDFVGqmgodJ_sC2g;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2364022604629.8984?

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d6c8272c48a8b608ef5f27411079e0e39391cbb06368d17aa5b034b24e9300b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 216
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:38 GMT
expires: Sun, 24 Sep 2023 16:55:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:38 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CK_9t7Dbw4EDFVGqmgodJ_sC2g;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2364022604629.8984?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90002.redintelligence.net/ Frame 9C6F 7 KB
2 KB 74ms
25ms Document
text/html 46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/request_content.php?s=84790000102752904444994012457002&a=8e36bfd6
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=4290548377&pi=t.aa~a.2429977064~rp.2&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280&nras=4&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=810&ady=2988&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=iVZjO70nvz&p=http%3A//docplayer.net&dtd=22
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.47 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 2c61197de99ca76a350d4719cc96a1351acc2903e2e42d9aabe75ae181de80a5

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2095
Content-Type: text/html; charset=utf-8
Date: Sun, 24 Sep 2023 16:55:38 GMT
Expires: Sun, 24 Sep 2023 17:55:38 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 131C 1 KB
643 B 21ms
20ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 76129
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Sep 2023 19:46:49 GMT
etag: 48472445140208031
expires: Sun, 24 Sep 2023 19:46:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 8AD1 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 87149123dacd07c168e4c67a57797ea11ad4125da54037d2b69eaaacce20f962

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame D094 5 KB
682 B 29ms
28ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=25224300101959904444994012457014&a=c789276d

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 24 Sep 2023 16:55:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 16:43:00 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 24 Sep 2023 16:55:38 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame D094 17 KB
17 KB 75ms
26ms Image
image/png 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=25224300101959904444994012457014&a=c789276d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 0fa91e7c3778d0fed46145cf32c069c6613a72ebf521ef7bbe886d166667642b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:38 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16982
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame D094 16 KB
16 KB 75ms
25ms Image
image/png 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=25224300101959904444994012457014&a=c789276d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 814cbd48106cc86885b9a988961d8e6a4613dbbdc660cb7f46bc28a81b3c0b6b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:38 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16515
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame D094 11 KB
11 KB 77ms
26ms Image
image/png 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native2.png
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=25224300101959904444994012457014&a=c789276d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 18a86a8cf8a79d532955549c8613f4c3eb94476e871349da9180de68fbc1fe24

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:38 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10940
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 dc_pre=CPPap7Dbw4EDFdTQOwIdkrQLKQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5675694559888.354
adservice.google.com/ddm/fls/z/ Frame AFF5 42 B
108 B 61ms
59ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CPPap7Dbw4EDFdTQOwIdkrQLKQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5675694559888.354

Requested by

Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=CPPap7Dbw4EDFdTQOwIdkrQLKQ;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5675694559888.354?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8019191.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 9C6F 5 KB
682 B 29ms
29ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=84790000102752904444994012457002&a=8e36bfd6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 24 Sep 2023 16:55:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 24 Sep 2023 16:46:39 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 24 Sep 2023 16:55:38 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9C6F 17 KB
17 KB 79ms
27ms Image
image/png 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=84790000102752904444994012457002&a=8e36bfd6
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 0fa91e7c3778d0fed46145cf32c069c6613a72ebf521ef7bbe886d166667642b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:38 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16982
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9C6F 16 KB
16 KB 79ms
28ms Image
image/png 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=84790000102752904444994012457002&a=8e36bfd6
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 814cbd48106cc86885b9a988961d8e6a4613dbbdc660cb7f46bc28a81b3c0b6b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:38 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16515
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9C6F 11 KB
11 KB 78ms
26ms Image
image/png 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native2.png
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=84790000102752904444994012457002&a=8e36bfd6
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 18a86a8cf8a79d532955549c8613f4c3eb94476e871349da9180de68fbc1fe24

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:38 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10940
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame D941 51 KB
18 KB 29ms
29ms Script
text/javascript 52.222.139.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=25224300101959904444994012457014&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.139.14 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-139-14.ams50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 43c969dd91796954ee5b0d995fddf5dc9b008844db541a4103c1d95b28ef2f74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 02:14:38 GMT
content-encoding: gzip
via: 1.1 12ab600b22d5c2eb1f2192b1156c2fd0.cloudfront.net (CloudFront)
last-modified: Mon, 07 Aug 2023 14:11:27 GMT
server: AmazonS3
x-amz-cf-pop: AMS50-C1
age: 52866
etag: W/"cb7accb6a6fc086cd831549a78a2fe42"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: ssrvIeE9BAtW5DGnjfoHI1_d-J3U61gJ3oEExuTTerhfATEBToO30w==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame D941 3 KB
3 KB 26ms
26ms Image
image/png 18.239.50.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1695574838&Signature=Vo3qYkhyB1VcEI~DVedS7JBHmOwhIwsdYviNfmNkF8QUelW5HL70Bm70hFAKapetS3kT6cYRPhu9iY1DgKGZYiBaxcDFttOYS9EutpNknEs8zUTanJGHjf4WtHMLMZPMCp7GkQ8-EozSgvjDcMWXwnHoz41hRa74vwHiXdGFKgb9ZSh-l~ImWrA7H1gUdFcfnsYK7NzNKwsavN3Zt4QwYOHOZMGYwxrDDnJj~yMCq3rvFxZLFsT8sfb~DqMcop-ARRbTzrZrdQMH7Mhlj7lXW8XNjHCHwKEsqsNI7xS2k3jGiL7PHhfS5oChhX9Zb1-y6pnvUjeTMEMltgciaJ1Cjg__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.50.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-50-87.ams58.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

x-amz-version-id: null
date: Sun, 24 Sep 2023 09:16:29 GMT
via: 1.1 5090b605a7b968781de55827dd170bf2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: AMS58-P3
age: 27582
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: T2FgqU2eYA1b4nq36SCMkQgOgGUO80C3RPcS7koNqIXAhBt3SxDR3Q==

GET
H3 200 dc_pre=CK_9t7Dbw4EDFVGqmgodJ_sC2g;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2364022604629.8984
adservice.google.com/ddm/fls/z/ Frame 94E1 42 B
63 B 59ms
59ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CK_9t7Dbw4EDFVGqmgodJ_sC2g;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2364022604629.8984

Requested by

Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=CK_9t7Dbw4EDFVGqmgodJ_sC2g;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2364022604629.8984?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8019191.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame A5D4 16 B
210 B 87ms
87ms Fetch
application/json 13.41.44.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.41.44.87 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 24 Sep 2023 16:55:38 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 130ms
35ms Preflight 13.41.44.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.41.44.87 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-41-44-87.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Sun, 24 Sep 2023 16:55:38 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame EDB4 16 B
210 B 82ms
81ms Fetch
application/json 13.41.44.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.41.44.87 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 24 Sep 2023 16:55:38 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 114ms
34ms Preflight 13.41.44.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.41.44.87 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-41-44-87.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Sun, 24 Sep 2023 16:55:38 GMT
server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CB7B
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEFkEmJr88GTEE2p0erFWvso&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RE9vMzhmT3ExUUtzb3A1&google_gid=CAESEFkEmJr88GTEE2p0erFWvso&google_cver=1&google_push=AXcoOmQ0AoiyMgzmUXCBmuKiwBRI8GFU0HQWE9wlIVjqic5...

170 B
188 B

33ms
31ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RE9vMzhmT3ExUUtzb3A1&google_gid=CAESEFkEmJr88GTEE2p0erFWvso&google_cver=1&google_push=AXcoOmQ0AoiyMgzmUXCBmuKiwBRI8GFU0HQWE9wlIVjqic5uc4Pke7sMBP6fXOIz07u0GCrZ_jwQAOMpHZNVyKnoRH1FkJxwpXRhTNA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:38 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-789-g976496f#rel-ec2-master i-0848f2daa11a85918@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RE9vMzhmT3ExUUtzb3A1&google_gid=CAESEFkEmJr88GTEE2p0erFWvso&google_cver=1&google_push=AXcoOmQ0AoiyMgzmUXCBmuKiwBRI8GFU0HQWE9wlIVjqic5uc4Pke7sMBP6fXOIz07u0GCrZ_jwQAOMpHZNVyKnoRH1FkJxwpXRhTNA
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CB7B
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEFZwpTGJaCxUcehES11av8I&google_cver=1&google_push=AXcoOmS7r9tzjkwg5NBGcYsfp8FsY-QaKCGnFn7oI9RLLKlZjgqOu-V2mFB0AHGM_C70g7LmuBWpdZ4xhPgFuyIxevrLaU4F2AGkTpU
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=D25DB5B8B5234CAE8F22848EDACE3E7E&google_push=AXcoOmS7r9tzjkwg5NBGcYsfp8FsY-QaKCGnFn7oI9RLLKlZjgqOu-V2mFB0AHGM_C70g7LmuBWpdZ4xhPgFuyI...

170 B
188 B

33ms
33ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=D25DB5B8B5234CAE8F22848EDACE3E7E&google_push=AXcoOmS7r9tzjkwg5NBGcYsfp8FsY-QaKCGnFn7oI9RLLKlZjgqOu-V2mFB0AHGM_C70g7LmuBWpdZ4xhPgFuyIxevrLaU4F2AGkTpU

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 24 Sep 2023 16:55:38 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=D25DB5B8B5234CAE8F22848EDACE3E7E&google_push=AXcoOmS7r9tzjkwg5NBGcYsfp8FsY-QaKCGnFn7oI9RLLKlZjgqOu-V2mFB0AHGM_C70g7LmuBWpdZ4xhPgFuyIxevrLaU4F2AGkTpU
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sat, 23 Sep 2023 16:55:38 GMT

GET
H2 200 sync
x.bidswitch.net/ Frame CB7B 43 B
146 B 25ms
23ms Image
image/gif 3.121.203.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESENpqjBneBYUQXUj6lMhvAqs&google_cver=1&google_push=AXcoOmR1uBQGy8nASHMn5aUHIQ7oUGw2na2Dlr4HDO8xBVhFgYbxPDAfOdlAB3oy6etwm7tCxzPG2YmKg8jp63dYdECzzd8xO3tOcvw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.121.203.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-121-203-109.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:38 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CB7B
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAXcoOmSy-kN_...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAXcoOmSy-kN_...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMzA5MjQxNjU1MzkwMDA4MDY0ODY1NTM0Mg%3D%3D&google_push=AXcoOmSy-kN_Fo_E93zUES8YrCkQz3JD1Cr9AyoSbhDp1LSCmKhwl0UN2GpGslyew3ar3X...

170 B
188 B

43ms
41ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMzA5MjQxNjU1MzkwMDA4MDY0ODY1NTM0Mg%3D%3D&google_push=AXcoOmSy-kN_Fo_E93zUES8YrCkQz3JD1Cr9AyoSbhDp1LSCmKhwl0UN2GpGslyew3ar3XrwdzcycB91kjVeRbj-XfFxD7tgwMR5ulk

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMzA5MjQxNjU1MzkwMDA4MDY0ODY1NTM0Mg%3D%3D&google_push=AXcoOmSy-kN_Fo_E93zUES8YrCkQz3JD1Cr9AyoSbhDp1LSCmKhwl0UN2GpGslyew3ar3XrwdzcycB91kjVeRbj-XfFxD7tgwMR5ulk
pragma: no-cache
date: Sun, 24 Sep 2023 16:55:39 GMT
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=2628000
content-length: 0
expires: Sun, 24 Sep 2023 16:55:39 GMT

GET
H2 200 trk
ag.innovid.com/ Frame CB7B 43 B
297 B 228ms
36ms Image
image/gif 2a05:d01c:1d8:8101:3bd9:9d77:3fca:c929
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEJxG5wNFKp3v0sEvQddztbM&google_cver=1&google_push=AXcoOmRq0HFXhYuUzWANA4RG1iq3N8B9rUiTRPAEzlftaJYt85QXRi9sj3GbA_pZRzi8uOm1xDWC1MjvZVktuh6r508V5ViTG-RDDVY
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8101:3bd9:9d77:3fca:c929 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sun, 24 Sep 2023 16:55:38 GMT
cache-control: no-cache
content-length: 43
request-time: 1
expires: -1

GET googleredir
googlecm.hit.gemius.pl/ Frame CB7B 0
0

GET
H2

200

report
sync.teads.tv/um/ Frame CB7B
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEIuTVnS--iKi...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmQrnSuq81fzqE8dQQA-aR9osgremgYVw2ENxm7EbtTvCR3sdvf8YquiDjQqlWDKolsXZcPZE04epRyX9CnqsOYx4sisNjb295h8
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
165 B

44ms
44ms

Image
image/gif

2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: docplayer.net
URL: http://docplayer.net/204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html
Protocol: H2
Server: 2.16.97.41 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

expires: Sun, 24 Sep 2023 16:55:38 GMT
pragma: no-cache
date: Sun, 24 Sep 2023 16:55:38 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:38 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame CB7B 0
12 B 29ms
29ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KD5uwkylA5hLiteeNR9L6pui_NC3s92L9E6Ri34ghRGbI_A3nOB4RS5nki2zmNP3G2tKlNJWc

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=1567995846&adf=1403646308&pi=t.aa~a.2652211261~rp.4&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280%2C368x280&nras=5&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1208&ady=3773&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=8&uci=a!8&btvi=5&fsb=1&xpc=CX7ez5xCT1&p=http%3A//docplayer.net&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:38 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK viewability Show response
hal900014.redintelligence.net/ Frame D094 0
150 B 79ms
27ms Script
text/html 176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/viewability?s=25224300101959904444994012457014&a=53d122f5&vb=m
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=25224300101959904444994012457014&a=c789276d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.26.250 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/request_content.php?s=25224300101959904444994012457014&a=c789276d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:38 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 8E22 16 B
210 B 74ms
74ms Fetch
application/json 13.41.44.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.41.44.87 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 24 Sep 2023 16:55:38 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 98ms
35ms Preflight 13.41.44.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.41.44.87 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-41-44-87.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Sun, 24 Sep 2023 16:55:38 GMT
server: nginx

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 131C 0
104 B 44ms
41ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEJgNPpCMXCDN8QjdVmTWFok&google_cver=1&google_push=AXcoOmS4DsRMdURYbqnjRPk0ofnU-i2C9qgicDJaLaFjFhenXNw_w_3jVJ1xh18yZuCNitai5GdKkLxHl3xoQRvd3S2sKrpGZcTKJuxNVoF_9bbSCCPMsUi_Z062UJbdQ3ol-KH-nSfthhrC1pq1iUBIwdxrzw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=4290548377&pi=t.aa~a.2429977064~rp.2&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280&nras=4&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=810&ady=2988&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=iVZjO70nvz&p=http%3A//docplayer.net&dtd=22
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Sweden, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:38 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 131C
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEFWeomt8evY3yJRg_wfd-8E&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RE9vMzhmT3ExUUtzb3A1&google_gid=CAESEFWeomt8evY3yJRg_wfd-8E&google_cver=1&google_push=AXcoOmTGzcy7nmLFVBQrmO8opBH6hThGf4rx6HZsT2-RgFH...

170 B
188 B

31ms
31ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RE9vMzhmT3ExUUtzb3A1&google_gid=CAESEFWeomt8evY3yJRg_wfd-8E&google_cver=1&google_push=AXcoOmTGzcy7nmLFVBQrmO8opBH6hThGf4rx6HZsT2-RgFHn_QoIQEE7d8ZJXqRDlKzpys-O1eNY14Fk2VpaO2DevBEg008rrygK_wCpXF_SzfTH_aUYR1JC2GQZoDFi4Tx7TXpOG4QmSMsFqKaUb9MzuOflWi4

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 24 Sep 2023 16:55:37 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-789-g976496f#rel-ec2-master i-0f37db6ac3f837baf@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RE9vMzhmT3ExUUtzb3A1&google_gid=CAESEFWeomt8evY3yJRg_wfd-8E&google_cver=1&google_push=AXcoOmTGzcy7nmLFVBQrmO8opBH6hThGf4rx6HZsT2-RgFHn_QoIQEE7d8ZJXqRDlKzpys-O1eNY14Fk2VpaO2DevBEg008rrygK_wCpXF_SzfTH_aUYR1JC2GQZoDFi4Tx7TXpOG4QmSMsFqKaUb9MzuOflWi4
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 131C
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEETtBGpG6kW96PVlfADk4I4&google_cver=1&google_push=AXcoOmST6rggOxIzKdp8a0ulzQgnsn6Xbqu-Md9Px91fQzrrVZ1RKQdqW0cTGIass0NrNdlxVjKnV-pORDWtbcujJERfiFdookM9Np...
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=D25DB5B8B5234CAE8F22848EDACE3E7E&google_push=AXcoOmST6rggOxIzKdp8a0ulzQgnsn6Xbqu-Md9Px91fQzrrVZ1RKQdqW0cTGIass0NrNdlxVjKnV-pORDWtbcu...

170 B
188 B

31ms
31ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=D25DB5B8B5234CAE8F22848EDACE3E7E&google_push=AXcoOmST6rggOxIzKdp8a0ulzQgnsn6Xbqu-Md9Px91fQzrrVZ1RKQdqW0cTGIass0NrNdlxVjKnV-pORDWtbcujJERfiFdookM9NpU-BxW_9KXt-s04FwcKOvTP7QcVbIOaNv7hQGIliInsyLDznf62DLVl0nI

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 24 Sep 2023 16:55:38 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=D25DB5B8B5234CAE8F22848EDACE3E7E&google_push=AXcoOmST6rggOxIzKdp8a0ulzQgnsn6Xbqu-Md9Px91fQzrrVZ1RKQdqW0cTGIass0NrNdlxVjKnV-pORDWtbcujJERfiFdookM9NpU-BxW_9KXt-s04FwcKOvTP7QcVbIOaNv7hQGIliInsyLDznf62DLVl0nI
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sat, 23 Sep 2023 16:55:38 GMT

GET
H2 200 sync
x.bidswitch.net/ Frame 131C 43 B
146 B 24ms
22ms Image
image/gif 3.121.203.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEMixfm8BeufQv9Nh8S-tICk&google_cver=1&google_push=AXcoOmSh5NLV2vo7-mF5kG4na5v3ms8p-Xdkw-F1uu5ZeiFWM5JzUtlcl8P3YYZuxJzkzPKisYoTWmtXn5-hreMZmjSzau5QQzl0Q9nhwJ8nz64hzn9oT1-BNIFmsXNfec_793FO-ln1k--1p5D0uphgSFXJavY
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6133583279631137&output=html&h=280&adk=687377255&adf=4290548377&pi=t.aa~a.2429977064~rp.2&w=368&fwrn=4&fwrnh=100&lmt=1695567335&rafmt=1&to=qs&pwprc=9847977745&format=368x280&url=http%3A%2F%2Fdocplayer.net%2F204614173-The-folder-user-appdata-local-packages-microsoft-windows-cortana_cw5n1h2txyewy-settings-has-a-settings-dat-file.html&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1695574535801&bpp=1&bdt=1455&idt=-M&shv=r20230920&mjsv=m202309200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D29c4fac1d07e5768-22225a0e8ade0054%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZMtmmnU9gULzJYM0VBXkj74CzkEA&gpic=UID%3D00000c833d9aefdb%3AT%3D1695574535%3ART%3D1695574535%3AS%3DALNI_MZp63AsQJyFVcUQj0z0DEOBIFibpg&prev_fmts=0x0%2C1200x280%2C160x600%2C320x100%2C348x280%2C368x280&nras=4&correlator=4297469723446&frm=20&pv=1&ga_vid=1098509612.1695574535&ga_sid=1695574535&ga_hid=1519572728&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=810&ady=2988&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31077701%2C31077969%2C44795921%2C31078114&oid=2&pvsid=4260123361248868&tmod=1780058952&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=iVZjO70nvz&p=http%3A//docplayer.net&dtd=22
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.121.203.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-121-203-109.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:38 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 131C
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEHwYcblh95CV2RJOHyZcBuc&google_cver=1&google_push=AXcoOmRNsTf-TeZAADknHGAgUirJCtNdF9ODIg2pCi6w9ciDVCBbGenedx-WBjKQ3QkGlD4Cv_PJRtH9VCZAU_klE92y3Se...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRNsTf-TeZAADknHGAgUirJCtNdF9ODIg2pCi6w9ciDVCBbGenedx-WBjKQ3QkGlD4Cv_PJRtH9VCZAU_klE92y3SeWDGQM3MIkQicO4LiREov4wpZGA8s4npUBwU9SZ...

170 B
188 B

31ms
31ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRNsTf-TeZAADknHGAgUirJCtNdF9ODIg2pCi6w9ciDVCBbGenedx-WBjKQ3QkGlD4Cv_PJRtH9VCZAU_klE92y3SeWDGQM3MIkQicO4LiREov4wpZGA8s4npUBwU9SZ7kIoTSCXTUZcsUPliNX5Uhl04w&google_hm=eS1IQlR6aUJwRTJwRkV4bEw5cE5LVHpZX2prMmQydXdqT35B

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 24 Sep 2023 16:55:38 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRNsTf-TeZAADknHGAgUirJCtNdF9ODIg2pCi6w9ciDVCBbGenedx-WBjKQ3QkGlD4Cv_PJRtH9VCZAU_klE92y3SeWDGQM3MIkQicO4LiREov4wpZGA8s4npUBwU9SZ7kIoTSCXTUZcsUPliNX5Uhl04w&google_hm=eS1IQlR6aUJwRTJwRkV4bEw5cE5LVHpZX2prMmQydXdqT35B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 131C 43 B
362 B 29ms
27ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQjrAbNDpM2cdBFnUNDvspVAbJ2bZNyvdamYtVz6juzeuWcXr9K2w5EK1BtanneWnJDc28ZvRoMMKvl0mo-m_44oEsM-es9_v_AXpHSLZ5Di9RvTNH1e41V71Qy3xoG9IwfmzaAEQO1A1ynvDwAr3MWHb0&google_gid=CAESEGuvJgqRbLeYPnHWgq9EPCc&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:38 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 159798
expires: Sun, 24 Sep 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 131C
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGU5Eguq1mZyqYOvHDfVE3Q&google_cver=1&google_push=AXcoOmQwJGLBHbuG2CSgZjztB6s-0SuMSQkoPXEXukIwInvVqMSL45w192W1Q7QW--rtbtife8yojutb...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzU0Nzc3MzcxMDUwNDU3NDI1Mw&google_push=AXcoOmQwJGLBHbuG2CSgZjztB6s-0SuMSQkoPXEXukIwInvVqMSL45w192W1Q7QW--rtbtife8yoju...

170 B
188 B

34ms
34ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzU0Nzc3MzcxMDUwNDU3NDI1Mw&google_push=AXcoOmQwJGLBHbuG2CSgZjztB6s-0SuMSQkoPXEXukIwInvVqMSL45w192W1Q7QW--rtbtife8yojutbJ0fIsszjRUFw_BHT5_VKuBQcXWZJfuDoOfJVw6IOIyGOPjb0z3SQ679c7gVp-IPeW1nuovdsV9WSZjk

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzU0Nzc3MzcxMDUwNDU3NDI1Mw&google_push=AXcoOmQwJGLBHbuG2CSgZjztB6s-0SuMSQkoPXEXukIwInvVqMSL45w192W1Q7QW--rtbtife8yojutbJ0fIsszjRUFw_BHT5_VKuBQcXWZJfuDoOfJVw6IOIyGOPjb0z3SQ679c7gVp-IPeW1nuovdsV9WSZjk
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 131C 0
12 B 32ms
31ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Lt1lZD9qeC6lvRTjXO8kZ0rWd1Wjljg-dgn95IvNKikILbX2iDAMUToO7tU90jMqkaeHAC

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:38 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 8AD1 51 KB
18 KB 30ms
29ms Script
text/javascript 52.222.139.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=84790000102752904444994012457002&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.139.14 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-139-14.ams50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 43c969dd91796954ee5b0d995fddf5dc9b008844db541a4103c1d95b28ef2f74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 02:14:38 GMT
content-encoding: gzip
via: 1.1 12ab600b22d5c2eb1f2192b1156c2fd0.cloudfront.net (CloudFront)
last-modified: Mon, 07 Aug 2023 14:11:27 GMT
server: AmazonS3
x-amz-cf-pop: AMS50-C1
age: 52866
etag: W/"cb7accb6a6fc086cd831549a78a2fe42"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: lPAJsLT9ZE4a9usJJqfnP5Sldl7iCrTut6jaJ04zM38tIwvgijV99A==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame 8AD1 3 KB
3 KB 26ms
26ms Image
image/png 18.239.50.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1695574838&Signature=Vo3qYkhyB1VcEI~DVedS7JBHmOwhIwsdYviNfmNkF8QUelW5HL70Bm70hFAKapetS3kT6cYRPhu9iY1DgKGZYiBaxcDFttOYS9EutpNknEs8zUTanJGHjf4WtHMLMZPMCp7GkQ8-EozSgvjDcMWXwnHoz41hRa74vwHiXdGFKgb9ZSh-l~ImWrA7H1gUdFcfnsYK7NzNKwsavN3Zt4QwYOHOZMGYwxrDDnJj~yMCq3rvFxZLFsT8sfb~DqMcop-ARRbTzrZrdQMH7Mhlj7lXW8XNjHCHwKEsqsNI7xS2k3jGiL7PHhfS5oChhX9Zb1-y6pnvUjeTMEMltgciaJ1Cjg__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=84790000102752904444994012457002&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.50.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-50-87.ams58.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

x-amz-version-id: null
date: Sun, 24 Sep 2023 09:16:29 GMT
via: 1.1 5090b605a7b968781de55827dd170bf2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: AMS58-P3
age: 27582
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: GbP8PSSO613ATm44XC0eqpFZ8EmDRHrBgPswH7lhVOkBGFNyfJY-uA==

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame D094 14 KB
15 KB 20ms
19ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900014.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 23:04:46 GMT
x-content-type-options: nosniff
age: 150652
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 23:04:46 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame D094 15 KB
15 KB 20ms
19ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900014.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 03:41:01 GMT
x-content-type-options: nosniff
age: 220477
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 03:41:01 GMT

GET
H/1.1 200
OK viewability Show response
hal90002.redintelligence.net/ Frame 9C6F 0
150 B 71ms
24ms Script
text/html 46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/viewability?s=84790000102752904444994012457002&a=164e8a2e&vb=m
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=84790000102752904444994012457002&a=8e36bfd6
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.47 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/request_content.php?s=84790000102752904444994012457002&a=8e36bfd6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Sun, 24 Sep 2023 16:55:38 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 9C6F 14 KB
15 KB 22ms
19ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90002.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 23:04:46 GMT
x-content-type-options: nosniff
age: 150652
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 23:04:46 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 9C6F 15 KB
15 KB 26ms
23ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90002.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 03:41:01 GMT
x-content-type-options: nosniff
age: 220477
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 03:41:01 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 74ms
73ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230920&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5e6c8eed605fa47c8c6a7ab21c6c50f27421b7983b442e3a31b3cde07a89cc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://docplayer.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:39 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12086
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 32ms
31ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://docplayer.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sun, 24 Sep 2023 16:55:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 24 Sep 2023 16:55:39 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame A4E3 13 KB
5 KB 28ms
22ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://docplayer.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1306
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:33:53 GMT
expires: Mon, 23 Sep 2024 16:33:53 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame A3A0 829 B
560 B 34ms
31ms Document
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d8f081cc27afa24af74c5ca144a07bdc7b4ec52b6221404ae1257935e3ede2c5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-vj5UF-oRDiv7kkY4LtiHGg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://docplayer.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-vj5UF-oRDiv7kkY4LtiHGg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 16:55:39 GMT
expires: Sun, 24 Sep 2023 16:55:39 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A5D4 0
20 B 121ms
120ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8756042628703&version=m202309120101&ct=77&x=1&cor=16600164269326141000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8E22 0
20 B 121ms
121ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=5511103408843&version=m202309120101&ct=77&x=1&cor=13835048498425477000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame D941 16 B
210 B 72ms
71ms Fetch
application/json 13.41.44.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.41.44.87 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 24 Sep 2023 16:55:39 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 35ms
35ms Preflight 13.41.44.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.41.44.87 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-41-44-87.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Sun, 24 Sep 2023 16:55:39 GMT
server: nginx

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D941 0
20 B 121ms
121ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=5179565353031&version=m202309120101&ct=77&x=1&cor=17820813235555064000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8AD1 0
20 B 121ms
121ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=7344199783998&version=m202309120101&ct=77&x=1&cor=101004284237522380

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Sep 2023 16:55:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 8AD1 16 B
210 B 98ms
97ms Fetch
application/json 13.41.44.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.41.44.87 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS