cybernews.com Open in urlscan Pro
2606:4700:3108::ac42:2bc5 Public Scan

URL: https://www.facebook.com/cybernewscom/

URL: https://www.youtube.com/c/CyberNews

URL: https://www.linkedin.com/company/cybernews

URL: https://www.tiktok.com/@cybernewscom

URL: https://flipboard.com/@CyberNews_com

URL: https://t.me/iran_EXPOSED
Title: IRAN EXPOSED

URL: https://careers.cybernews.com/
Title: Careers

ns31532338.ip-162-19-138.eu

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 79

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 81

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEGTw6ytLg9Xkg7Gk4eeWc8Y&google_cver=1&google_push=AXcoOmRrZElBHl6l4Ka-wPhFFUyrsxkXZMEKlJPPnPeO_1xCmLmEkYBiv6m3j9G1g7_qF0G_pnS5o4upQbF3eFhSJRKlAbrMivRxO2A HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEGTw6ytLg9Xkg7Gk4eeWc8Y&google_push=AXcoOmRrZElBHl6l4Ka-wPhFFUyrsxkXZMEKlJPPnPeO_1xCmLmEkYBiv6m3j9G1g7_qF0G_pnS5o4upQbF3eFhSJRKlAbrMivRxO2A

Request Chain 82

https://um.simpli.fi/gp_match?google_gid=CAESEPyLWM-sozO5yb_MzwwHipI&google_cver=1&google_push=AXcoOmQ63v_KSdiQJ8U-ogHfYHO1Wx4ji-VzopEaIBRDxkO1ksVA4W5RmrIw73pUTtd8MKleyZWMAAoqJX2fYSkg2kvSKQNmdX9tjsE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmQ63v_KSdiQJ8U-ogHfYHO1Wx4ji-VzopEaIBRDxkO1ksVA4W5RmrIw73pUTtd8MKleyZWMAAoqJX2fYSkg2kvSKQNmdX9tjsE

Request Chain 85

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEOwCQnzAKDqEz5sDSBYMvd4&google_cver=1&google_push=AXcoOmQ_lW1W_wqwXPxZ8zPNptVbI6NnLCe0rwtguBntS3VoLNou7g3QwqIVEwK9PlF4LDN_Pt_nEE3YCuVRn_0mAELieJUVNqp6ag HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEOwCQnzAKDqEz5sDSBYMvd4&google_cver=1&google_push=AXcoOmQ_lW1W_wqwXPxZ8zPNptVbI6NnLCe0rwtguBntS3VoLNou7g3QwqIVEwK9PlF4LDN_Pt_nEE3YCuVRn_0mAELieJUVNqp6ag HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMjQ4ODk4MzMxMzc3NjgyNA&google_push=AXcoOmQ_lW1W_wqwXPxZ8zPNptVbI6NnLCe0rwtguBntS3VoLNou7g3QwqIVEwK9PlF4LDN_Pt_nEE3YCuVRn_0mAELieJUVNqp6ag

Request Chain 86

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEF68YPVf-kszXq1QSC8TYT8&google_cver=1&google_push=AXcoOmRnhvkZrUV-9IZmVMaUuHyI5cPa28bwkxZiwrWEwJINjCC10v4uXdQkvy5plHrOo6B4m_nGO3NOuXcteWxMk0mcebFsxEbIdNo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRnhvkZrUV-9IZmVMaUuHyI5cPa28bwkxZiwrWEwJINjCC10v4uXdQkvy5plHrOo6B4m_nGO3NOuXcteWxMk0mcebFsxEbIdNo

Request Chain 87

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEAR7sggaqql1TJOJPt0pHqM&google_cver=1&google_push=AXcoOmS8ObKIo5fVro1hhf307cDggh6qsQ1HZnKHPs89j-ubYoahS2SZmx-KeiiWDhIj4Six6gDl1G-UXIy4e2aJv6QpD7pnc_excFTJ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmS8ObKIo5fVro1hhf307cDggh6qsQ1HZnKHPs89j-ubYoahS2SZmx-KeiiWDhIj4Six6gDl1G-UXIy4e2aJv6QpD7pnc_excFTJ HTTP 302
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

Request Chain 138

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&C=1

Request Chain 139

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZUuxC3IQQP-Km.B4CnTlUwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&google_hm=2

Request Chain 140

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESENS47Hvb5SdoRQmdJAf4KWw&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESENS47Hvb5SdoRQmdJAf4KWw%26google_cver%3D1

Request Chain 141

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA3MjI1NzA3MjU0OTA3Nzk0NA%3D%3D

Request Chain 143

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&C=1

Request Chain 144

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZUuxC3IQQP-Km.B4CnTlUwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&google_hm=2

Request Chain 145

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESENS47Hvb5SdoRQmdJAf4KWw&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESENS47Hvb5SdoRQmdJAf4KWw%26google_cver%3D1

Request Chain 146

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA3MjI1NzA3MjU0OTA3Nzk0NA%3D%3D

Request Chain 147

https://googleads.g.doubleclick.net/pagead/adview?ai=CMlAECrFLZe6YD5iMtwflpa2wAYiN9Yx0t4yOqvQR2dkeEAEgttfpe2CVgoCAoAegAYPArpUCyAECqAMByAPJBKoEqgJP0F96vWyZxGQNC2Mlyrmg7s3EIXscBWUjFdffNHE0HS7ElYeSK6DWYyycsjkL42-ZpT1r2tAQ52oO2a9Xn1Uv3ZPUg7tYTGgmEaQJPMCiXo94j2x7YLcstkElwPaBEf305rZP5eDVbZtFiKLOUSKk3MNc0dOCwJe2myPVZ6jjaSWy84DBbM-Zot5eBFndvEdg9JA8NH1egwfp-YXOvuFluo-DEIRc1fGqjMWT0613SyAo-X5FsJC4D94dYDhy1X0KpaLXEKc_7Udjy9Uy9Adm_6DebKiWWZQejwrSoo7XZOK7SKBOuEFNdKQIPSUgpTouo5Hj9f_lm5t3aRG8aWL7FyVmJSkxN7f1w8U5eyxQ5bH_COhVlEH1hmlgKDgfWHk7S2heaNvzH3EdwASgj4WK1ASIBeLwzuhMkgUECAQYAZIFBAgFGASgBgKAB-W_0eoBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQu8EH0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOpoJ0AFodHRwczovL3d3dy5jb3Rvc2VuLmNvbS9hY3Rpdml0eS9ob3Qtc2FsZS02ODExLz90c3B1PVNQMjMxMTAzTzVHVCxTUDIzMTEwMldNSE0sU1AyMzA5MTNVQlkzLFNQMjExMjE1VE5TVixTUDIzMTAyMzM1T1QsU1AyMjEyMTNPQUtWLFNQMjMxMDExMElFNSxTUDIzMTEwMTFJVkYsU1AyMjEyMjJRRE1ELFNQMjMxMDEyV0QzNixTUDIyMTAxMkRQTU8sU1AyMzA5MjFQV0lMgAoByAsB2BMM0BUBmBYBgBcBshccChoIABIUcHViLTU5MjgxNjEwNzQ3NzkzODAYAA&sigh=xgt2Omvu0Rg&uach_m=[UACH]&ase=2&nis=4&cid=CAQSOwDICaaNZ1i1PoagFybewxYsXN8X1CsCdAN_lyNWl7EAxaXqir86pw9CrAD6kocGsEHe4X8yVGH9hbXxGAE&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%221271557475478652936%22,%22debug_reporting%22:true,%22destination%22:%22https://cotosen.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22581672963%22],%224%22:[%2211-08%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225282313274206199873%22}&andc=true

Request Chain 158

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFnUygyHT_pzqgRfItPCf3I&google_cver=1

Request Chain 160

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESECDUHyTRf7rcQ5ADFaC_Gz0&google_cver=1

Request Chain 171

https://gcdn.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995338/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signature/802D4C56A6B87B013980E47CFB5694D7193236A2.AC24020CDE7BE63680948CFE8A7D01C6C8762C69/key/ck2/file/file.mp4 HTTP 302
https://r2---sn-4g5lzned.c.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995338/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/6845708EA129D97682FC62BA5175E0FA93EED76E.60AF5C84B5BD1AF6C91437E7151EEF810F06EF9A/key/cms1/cms_redirect/yes/mh/98/mip/2001:1b60:2:240:3247::6/mm/42/mn/sn-4g5lzned/ms/onc/mt/1699457892/mv/u/mvi/2/pl/36/file/file.mp4

Request Chain 174

https://gcdn.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995339/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signature/AC6F00DC52C15AD0AD47CB2AAD53DCA6C494E0DA.58FFC49D075E6B1BF8DC3376034841E1A44943A6/key/ck2/file/file.mp4 HTTP 302
https://r2---sn-4g5lzned.c.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995339/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/4571E5A1B001EC9FEDA1CA7BF704B1B2B935DCD0.26CB6E65D34A500486339F22DAB5EF8D55AC8288/key/cms1/cms_redirect/yes/mh/98/mip/2001:1b60:2:240:3247::6/mm/42/mn/sn-4g5lzned/ms/onc/mt/1699457892/mv/u/mvi/2/pl/36/file/file.mp4

Request Chain 181

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEGD906BJIhLRqYJ_dv2FI9c&google_cver=1&google_push=AXcoOmRUFTvHg7SqgdeSzlCMDjxZJ0sok1l-PPW_37aRUMRxPTaPGCV-mJZ5TA2vxq80smPaRJJguDe34TPJhS1rs4AhpfCzGJ4WhLw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mzc3Mjk2MzUzMTkzMjY3OTU1NA==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDwFDaKmWikuqVyVd8q4q_M&google_cver=1

Request Chain 182

https://a.tribalfusion.com/i.match?p=b6&u=CAESEPaufe2z3fYfOitOc0lg2E0&google_cver=1&google_push=AXcoOmSbpVZpqzaqvRf8Ley559A2B_1udlsr3QV1aPQj5NSkOo-s3cbJws2FbqOP3G3M6lpjDJRP1HhwxtiTy80i5lPqPqezq2bXsw&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSbpVZpqzaqvRf8Ley559A2B_1udlsr3QV1aPQj5NSkOo-s3cbJws2FbqOP3G3M6lpjDJRP1HhwxtiTy80i5lPqPqezq2bXsw%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEPaufe2z3fYfOitOc0lg2E0&google_cver=1&google_push=AXcoOmSbpVZpqzaqvRf8Ley559A2B_1udlsr3QV1aPQj5NSkOo-s3cbJws2FbqOP3G3M6lpjDJRP1HhwxtiTy80i5lPqPqezq2bXsw&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSbpVZpqzaqvRf8Ley559A2B_1udlsr3QV1aPQj5NSkOo-s3cbJws2FbqOP3G3M6lpjDJRP1HhwxtiTy80i5lPqPqezq2bXsw%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 184

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESELKFVIJGh84YzL7_cCo0d8g&google_cver=1&google_push=AXcoOmSj9wxflaXcjtCFw-rzROyPh78k6f68NNBtpuDn2RiERrwj2Yjc8w531JGvJpSz_jK9-9fVEFICrev4NP1cAF91Fggcn-tRhw4 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI5OTEyMjI4MTkwNTQ1MzE5OA%3D%3D&google_push=AXcoOmSj9wxflaXcjtCFw-rzROyPh78k6f68NNBtpuDn2RiERrwj2Yjc8w531JGvJpSz_jK9-9fVEFICrev4NP1cAF91Fggcn-tRhw4

Request Chain 185

https://ads.travelaudience.com/google_pixel?google_gid=CAESEE6IvyDEYF48cNqazBu-VzU&google_cver=1&google_push=AXcoOmQceTli2b46DKa8_Z2aysrR83QFvgZsASWMEhdaXMe22cizJ9OhVSXxR7qfBwGcEJu4gXC2KLSIt6Hu1MwPVM_ZSkX5pRM3Wg8 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4f5q8xuyThAOtoh_ej3JUQ&google_push=AXcoOmQceTli2b46DKa8_Z2aysrR83QFvgZsASWMEhdaXMe22cizJ9OhVSXxR7qfBwGcEJu4gXC2KLSIt6Hu1MwPVM_ZSkX5pRM3Wg8

Request Chain 187

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMOBqq_4Zvei4knImAEIgLA&google_cver=1&google_push=AXcoOmRV_eLvBBXnSg4AZteF_Ygw7ApsLDymToTzMY-68k5rjlwKzJg2Bm4QhcadbU2Z1q8-MZoR4j1iyrO4s1CqVTQ3hKRH8kj0kkk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMjQ4ODk4MzMxMzc3NjgyNA&google_push=AXcoOmRV_eLvBBXnSg4AZteF_Ygw7ApsLDymToTzMY-68k5rjlwKzJg2Bm4QhcadbU2Z1q8-MZoR4j1iyrO4s1CqVTQ3hKRH8kj0kkk

Request Chain 192

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEAXunFfiru-LYeQoSctfnMk&google_cver=1&google_push=AXcoOmRsunc9najVIZA27abyhxokdo8H8Yg6miJsp9quPF5INXi913KeopBWi_6VL5mipvNfmQ05MrCgRQR2ijlTV0x-RsWiqmO_3g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlV1eENnQUFBUHJQblFBag==&google_gid=CAESEAXunFfiru-LYeQoSctfnMk&google_cver=1&google_push=AXcoOmRsunc9najVIZA27abyhxokdo8H8Yg6miJsp9quPF5INXi913KeopBWi_6VL5mipvNfmQ05MrCgRQR2ijlTV0x-RsWiqmO_3g

Request Chain 193

https://um.simpli.fi/gp_match?google_gid=CAESEOL48nYlDFxmcVq-UKzjZvA&google_cver=1&google_push=AXcoOmTBHkvwbpRn-A82x-f0P9qiJkGRO7MSqmlj_KR1K-OYQvDJXuEXuVs3Ivk-qDt5zZjAWCw8B81gFZ__PRZkLGEUVmmXWV1mUA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmTBHkvwbpRn-A82x-f0P9qiJkGRO7MSqmlj_KR1K-OYQvDJXuEXuVs3Ivk-qDt5zZjAWCw8B81gFZ__PRZkLGEUVmmXWV1mUA

Request Chain 195

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEDXLSYBDMRNkpiZtXq36zxw&google_cver=1&google_push=AXcoOmRb-tzrfNsYWjkXmuWct2cuekLSePTodGt5SNkTSL0_N9KEA9N6yMpVz3QIUZwNVpK2VL_zax-nyv3q1OFYZ0nQ-MVooDS6d4g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI5OTEyMjI4MTkwNDkyODkxOA%3D%3D&google_push=AXcoOmRb-tzrfNsYWjkXmuWct2cuekLSePTodGt5SNkTSL0_N9KEA9N6yMpVz3QIUZwNVpK2VL_zax-nyv3q1OFYZ0nQ-MVooDS6d4g

Request Chain 208

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFCB7wScQeENPnwL1fOrhM0&google_cver=1&google_push=AXcoOmSBFMMt-sOyrifUfGIdJl11z1ewlbE1089FhHYeSz3yDMzfwS4niDxNfg3N3wQgkZrfBaKzVLiQYoAe2MoQ1vv8lUs8rA2847U HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmSBFMMt-sOyrifUfGIdJl11z1ewlbE1089FhHYeSz3yDMzfwS4niDxNfg3N3wQgkZrfBaKzVLiQYoAe2MoQ1vv8lUs8rA2847U&google_hm=PKxmLsPsqU5vTenrquudTg

Request Chain 210

https://um.simpli.fi/gp_match?google_gid=CAESEOL48nYlDFxmcVq-UKzjZvA&google_cver=1&google_push=AXcoOmSEiTaMQfFntkHInNEuIu24kJzP7gGAv7pZa2nvcncwQ-7yI3TLzowkPTcGDpNq2eH2bwUzYYC1Rewr3xIM_0lhPCpwp-Na0wY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmSEiTaMQfFntkHInNEuIu24kJzP7gGAv7pZa2nvcncwQ-7yI3TLzowkPTcGDpNq2eH2bwUzYYC1Rewr3xIM_0lhPCpwp-Na0wY

Request Chain 212

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEHkJAUL1bXrcz9vbQq3mUcA&google_cver=1&google_push=AXcoOmRu86UNLe3vBuHiXwyBnHMKgxQ4LRKiE9xPASSC_1LlN2oiiicCBphDhZFOE0-mZdF6X6Mgdr5uriud7Jj8fhwKdHqsq7TZIN8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRu86UNLe3vBuHiXwyBnHMKgxQ4LRKiE9xPASSC_1LlN2oiiicCBphDhZFOE0-mZdF6X6Mgdr5uriud7Jj8fhwKdHqsq7TZIN8&google_hm=eS0wX1pMMEkxRTJwR181cXBwaHFBd1hURUw5UF9ZWGE4TX5B

Request Chain 213

https://d5p.de17a.com/cookies/google?google_gid=CAESEOCCPIXjaQCWy3G1z-Lwe20&google_cver=1&google_push=AXcoOmSSUR9lEoW4CKYW5_FG4hUFL4jRNbKdDE8PcuHwmrUBfv_HeS6lueoWEcePfnd-KEISEd-y_a4dln3Fzk99PxxPjiNYWwg8U-8 HTTP 302
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEOCCPIXjaQCWy3G1z-Lwe20&google_cver=1&google_push=AXcoOmSSUR9lEoW4CKYW5_FG4hUFL4jRNbKdDE8PcuHwmrUBfv_HeS6lueoWEcePfnd-KEISEd-y_a4dln3Fzk99PxxPjiNYWwg8U-8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmSSUR9lEoW4CKYW5_FG4hUFL4jRNbKdDE8PcuHwmrUBfv_HeS6lueoWEcePfnd-KEISEd-y_a4dln3Fzk99PxxPjiNYWwg8U-8

Request Chain 214

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEAHByvUFgTpxdlo29FvaLLc&google_cver=1&google_push=AXcoOmTtL5_gFiImA_A8csvoUSO3eXy7KsLkHBrT7fZHVp3GR_QG7T2J3k77GFDMZk6dr9FHEnf9uT-00tY4PjieukHMIVd7Cw9vPQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMjQ4ODk4MzMxMzc3NjgyNA&google_push=AXcoOmTtL5_gFiImA_A8csvoUSO3eXy7KsLkHBrT7fZHVp3GR_QG7T2J3k77GFDMZk6dr9FHEnf9uT-00tY4PjieukHMIVd7Cw9vPQ

Request Chain 226

https://hal90002.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=7d97f2ce26&subid=&uid=9f6e7c32aa6b81c5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC2mbzCrFLZfWYDv-PwuIPup-7gA6m5b2gaZ2cnKfJD_AuEAEgttfpe2CVgoCAoAfIAQmpAjT2-VDP5LE-qAMByAObBKoEnwJP0MoBeZvo7q_ta-PBIcStN11S7fuqLtTkXfzAAzP-6qQsUIpUQqSAyT6y1qL_fFOfPkhM1b4rck6eRqpgFWMW8icz96RJq2v4EMJrk_HDherbztz2YbOvTgM-Ms3CbcH60kRzeafHA0nHP_qHMuoUR8-AUqIsjtRQJN8VBU9fBxlAVruoBKXzPXma0awllY_eBcpgKtad5QMojAHQGGBbWt_-BVpy3oY766hQfhFgDQ6mLTqgJJrtsXd5u6vgoduOQP1vAOLXQA56Zcrbp633djLpIcUJ6Eqd298jxfarI9C4kW45u6kihhh9_3HZAhxtxh7eRqtNtvaX8J3vvBrvgOKBw-S-pRUfdcy_s1-42eQfVOn5DJfH52Hwe-CLTMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB%26sig%3DAOD64_2LLfF4xeUB9JCobCAu67Mhmn4jog%26client%3Dca-pub-5928161074779380%26dbm_c%3DAKAmf-DeIfZHGoWnT06yeo4Yma5TpKGSCw3X6kh3Fa2bt2z65h2RedDoGdnht7HvW8NY8ZKqyu75ap1vg2B9WuMPuUu-gnQ7rzzxQw5gfmjrMGczm8QDb2SDw2QgUf3aGqr0IYjKrrVn73340AuUoEOIty6GQZy-3lvv-O3e3WVjZzNE_gTWvrE%26cry%3D1%26dbm_d%3DAKAmf-BglPN-28nuaf72W07dZhhuZA85jxWTYJYg-pa1YEnFTYwDVDbNhGs-x39k5oCjX18Q7jCICdqU8Bljh_L4KxEMFObWvwMX2LcoDjUCrYtl_vDdgyzRQBd3xnZBCINCT6ENa2LnyogsQ45XsdOPeNDOpj-GV9bpj4fDrgyMpaJSxxWuO3BGis75eKkYyRV5NkRlY5cCHLZ63BU97YrQsQPuGHMauXSqUDeshFlt_JCntykMMcTlkQG_uz-UA5yZpg-rER72m9HewB3D1Wm2VWhULAk3edRluOd34fgNcYP7relSeAElveaCS3ufufJnOp_MOxC7yJOK8tXuUDj-uGVwyBloNdCPVGD1GR6Jgf65r7zbsv2bwHEMFXUzFtWUGJJvA2cbinP2v6d_V5KJtzn240fvQgFwwjjCzv-mdyQxk83b9AFFW5mOSbgTojoIm9Zd1J-yRtkCtutODFZ1Zm3qz-qooUuT-dxpkYg9xI-HZGkYidxZkwly0tsp7qwAf9dkeHwrKxKW3RQ6SV9Q5Y7ay3tU8S51X_OLpQTinHfyDz91oDl02m7BmpH-GLZygwHVtsu6fStdLOwHiqLAMCBE4GUtSilHabKzwg_KvcAOx65U-zg%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231106%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-1-%26adk%3D1812271804%26client%3Dca-pub-5928161074779380%26fa%3D4%26ifi%3D8%26uci%3Da!8%26btvi%3D4%26xpc%3DeKeosRUNgx%26p%3Dhttps%253A%2F%2Fcybernews.com&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fcybernews.com&random=7167401521338&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0 HTTP 302
https://hal90002.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=7d97f2ce26&subid=&uid=9f6e7c32aa6b81c5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC2mbzCrFLZfWYDv-PwuIPup-7gA6m5b2gaZ2cnKfJD_AuEAEgttfpe2CVgoCAoAfIAQmpAjT2-VDP5LE-qAMByAObBKoEnwJP0MoBeZvo7q_ta-PBIcStN11S7fuqLtTkXfzAAzP-6qQsUIpUQqSAyT6y1qL_fFOfPkhM1b4rck6eRqpgFWMW8icz96RJq2v4EMJrk_HDherbztz2YbOvTgM-Ms3CbcH60kRzeafHA0nHP_qHMuoUR8-AUqIsjtRQJN8VBU9fBxlAVruoBKXzPXma0awllY_eBcpgKtad5QMojAHQGGBbWt_-BVpy3oY766hQfhFgDQ6mLTqgJJrtsXd5u6vgoduOQP1vAOLXQA56Zcrbp633djLpIcUJ6Eqd298jxfarI9C4kW45u6kihhh9_3HZAhxtxh7eRqtNtvaX8J3vvBrvgOKBw-S-pRUfdcy_s1-42eQfVOn5DJfH52Hwe-CLTMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB%26sig%3DAOD64_2LLfF4xeUB9JCobCAu67Mhmn4jog%26client%3Dca-pub-5928161074779380%26dbm_c%3DAKAmf-DeIfZHGoWnT06yeo4Yma5TpKGSCw3X6kh3Fa2bt2z65h2RedDoGdnht7HvW8NY8ZKqyu75ap1vg2B9WuMPuUu-gnQ7rzzxQw5gfmjrMGczm8QDb2SDw2QgUf3aGqr0IYjKrrVn73340AuUoEOIty6GQZy-3lvv-O3e3WVjZzNE_gTWvrE%26cry%3D1%26dbm_d%3DAKAmf-BglPN-28nuaf72W07dZhhuZA85jxWTYJYg-pa1YEnFTYwDVDbNhGs-x39k5oCjX18Q7jCICdqU8Bljh_L4KxEMFObWvwMX2LcoDjUCrYtl_vDdgyzRQBd3xnZBCINCT6ENa2LnyogsQ45XsdOPeNDOpj-GV9bpj4fDrgyMpaJSxxWuO3BGis75eKkYyRV5NkRlY5cCHLZ63BU97YrQsQPuGHMauXSqUDeshFlt_JCntykMMcTlkQG_uz-UA5yZpg-rER72m9HewB3D1Wm2VWhULAk3edRluOd34fgNcYP7relSeAElveaCS3ufufJnOp_MOxC7yJOK8tXuUDj-uGVwyBloNdCPVGD1GR6Jgf65r7zbsv2bwHEMFXUzFtWUGJJvA2cbinP2v6d_V5KJtzn240fvQgFwwjjCzv-mdyQxk83b9AFFW5mOSbgTojoIm9Zd1J-yRtkCtutODFZ1Zm3qz-qooUuT-dxpkYg9xI-HZGkYidxZkwly0tsp7qwAf9dkeHwrKxKW3RQ6SV9Q5Y7ay3tU8S51X_OLpQTinHfyDz91oDl02m7BmpH-GLZygwHVtsu6fStdLOwHiqLAMCBE4GUtSilHabKzwg_KvcAOx65U-zg%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231106%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-1-%26adk%3D1812271804%26client%3Dca-pub-5928161074779380%26fa%3D4%26ifi%3D8%26uci%3Da!8%26btvi%3D4%26xpc%3DeKeosRUNgx%26p%3Dhttps%253A%2F%2Fcybernews.com&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fcybernews.com&random=7167401521338&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1

Request Chain 227

https://hal900024.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=67ea83ffd7&subid=&uid=11ea180b3bc46cb2&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLgwLCrFLZfaYDv-PwuIPup-7gA6m5b2gaZ2cnKfJD_AuEAEgttfpe2CVgoCAoAfIAQmpAjT2-VDP5LE-qAMByAObBKoEoAJP0Nrx9IyKj8xDNVrnTtXa3dyVd9xz2797OPyq0jEOpBYMQeyAgCssRWGZz1TcY-0vgBcLeFOmoUNUAkh1X1fdiAK8fNzwOi370tjpHhq3bb6O2Dv4l9XlgGzjq22-sVFDsJ__2z8A-YtcXQ9CNVWefRDoYvUM8kg7QhNA7pc2Lbc99eZvNqIGBs080SaHz-Ubv6oC-SxEmhPORIMvuZroVu2MCokR33pJXMMaWRxUh0FMOu9LY9j7_FSv26MQ3ZCdqPBbGxyfm-a8isESgBUXiHQOPAGYpOrtayRIZr2s2rpbyiSB7PZGi9Z0aEhMLi0j516VqANJZY8b8od2aK51IWuLvh8p7Dzv6FekvIgSM_1e4s9uCb--sKSm3ooOrL_ABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGiDAwqCgoI5LSxAu61sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB%26sig%3DAOD64_0xkGm96nyt1VC0ckM1_q4f1opEIw%26client%3Dca-pub-5928161074779380%26dbm_c%3DAKAmf-Da2jXNEj4sL32OPJnRP6IHI3x2tl122lLVaJ9gQqvjQ_I0vxKEsMVfkNFPp0rX42mvooUfCYXoaj8QunzsbtGMl6cf1_5mqF_YUoe0rKjSt-m1GUbd9W5UYkx62JHpF-RyDh1r7N4aScG0hh7rD6FpJvGDzya3-oDoNgosWtavoh-EbLc%26cry%3D1%26dbm_d%3DAKAmf-CTERzenVEW1ab8SajXHftPrvKrsAU9Llgw-gHE-REeHDtBfRE6N4Oe9mRm2nkTkCYQDrA1uJ_9v-cwyI3W1VQP485xNX_ujlJTrTZ0YRjUOq24vh8lVOyP0RDnhvwuoj7VVTDzlYnH3CLb7vOGX-J1rA87HuKCv5NaFImR_RBd_XoxkbT9OtzT6qqic8n7Lk6_Tx9XAuISL5LptYoLGw8RlUnqSKbwUeTsF4mQY8Ol75BmoDPD3NrHIaPN8eecTcMBHqae_09znaaKTfc0XDIKCLVVDaZkvMn7Zeagy5ZRes94T7tJ6AgCS5BowNdYY6AFT5XOEmPjfvasIJbRumKIwAeD3-vIUIz6pcEHxMQ1Pz6p1Yp5GRjusS59Ud46H4H--FKBBH73AcL2D2VRMzQjsq2qx8eVVNNXexoIbgfQ5G9hSY5FCCQA5Bs2vYyPCbl_p11YhtBz3EtHVBf6VypNSk4R0fWd_FtWnH6gZpEDpRSXzmze4MWaNrfrunepAzsMJ0gPX00KZQ-aunWKS3FfAq72OX__ipYtc9-4B18TA6oM-JhtBo_yeAiPjzzCT8GDbCQwBVULFGlwoxoz0On1FF6jzC1sP3L983TNJ8BeEff9UzA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231106%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-2-%26adk%3D1812271803%26client%3Dca-pub-5928161074779380%26fa%3D3%26ifi%3D9%26uci%3Da!9%26btvi%3D5%26xpc%3DCe9LLCwpQW%26p%3Dhttps%253A%2F%2Fcybernews.com&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fcybernews.com&random=8682864036725&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0 HTTP 302
https://hal900024.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=67ea83ffd7&subid=&uid=11ea180b3bc46cb2&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLgwLCrFLZfaYDv-PwuIPup-7gA6m5b2gaZ2cnKfJD_AuEAEgttfpe2CVgoCAoAfIAQmpAjT2-VDP5LE-qAMByAObBKoEoAJP0Nrx9IyKj8xDNVrnTtXa3dyVd9xz2797OPyq0jEOpBYMQeyAgCssRWGZz1TcY-0vgBcLeFOmoUNUAkh1X1fdiAK8fNzwOi370tjpHhq3bb6O2Dv4l9XlgGzjq22-sVFDsJ__2z8A-YtcXQ9CNVWefRDoYvUM8kg7QhNA7pc2Lbc99eZvNqIGBs080SaHz-Ubv6oC-SxEmhPORIMvuZroVu2MCokR33pJXMMaWRxUh0FMOu9LY9j7_FSv26MQ3ZCdqPBbGxyfm-a8isESgBUXiHQOPAGYpOrtayRIZr2s2rpbyiSB7PZGi9Z0aEhMLi0j516VqANJZY8b8od2aK51IWuLvh8p7Dzv6FekvIgSM_1e4s9uCb--sKSm3ooOrL_ABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGiDAwqCgoI5LSxAu61sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB%26sig%3DAOD64_0xkGm96nyt1VC0ckM1_q4f1opEIw%26client%3Dca-pub-5928161074779380%26dbm_c%3DAKAmf-Da2jXNEj4sL32OPJnRP6IHI3x2tl122lLVaJ9gQqvjQ_I0vxKEsMVfkNFPp0rX42mvooUfCYXoaj8QunzsbtGMl6cf1_5mqF_YUoe0rKjSt-m1GUbd9W5UYkx62JHpF-RyDh1r7N4aScG0hh7rD6FpJvGDzya3-oDoNgosWtavoh-EbLc%26cry%3D1%26dbm_d%3DAKAmf-CTERzenVEW1ab8SajXHftPrvKrsAU9Llgw-gHE-REeHDtBfRE6N4Oe9mRm2nkTkCYQDrA1uJ_9v-cwyI3W1VQP485xNX_ujlJTrTZ0YRjUOq24vh8lVOyP0RDnhvwuoj7VVTDzlYnH3CLb7vOGX-J1rA87HuKCv5NaFImR_RBd_XoxkbT9OtzT6qqic8n7Lk6_Tx9XAuISL5LptYoLGw8RlUnqSKbwUeTsF4mQY8Ol75BmoDPD3NrHIaPN8eecTcMBHqae_09znaaKTfc0XDIKCLVVDaZkvMn7Zeagy5ZRes94T7tJ6AgCS5BowNdYY6AFT5XOEmPjfvasIJbRumKIwAeD3-vIUIz6pcEHxMQ1Pz6p1Yp5GRjusS59Ud46H4H--FKBBH73AcL2D2VRMzQjsq2qx8eVVNNXexoIbgfQ5G9hSY5FCCQA5Bs2vYyPCbl_p11YhtBz3EtHVBf6VypNSk4R0fWd_FtWnH6gZpEDpRSXzmze4MWaNrfrunepAzsMJ0gPX00KZQ-aunWKS3FfAq72OX__ipYtc9-4B18TA6oM-JhtBo_yeAiPjzzCT8GDbCQwBVULFGlwoxoz0On1FF6jzC1sP3L983TNJ8BeEff9UzA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231106%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-2-%26adk%3D1812271803%26client%3Dca-pub-5928161074779380%26fa%3D3%26ifi%3D9%26uci%3Da!9%26btvi%3D5%26xpc%3DCe9LLCwpQW%26p%3Dhttps%253A%2F%2Fcybernews.com&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fcybernews.com&random=8682864036725&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1

Request Chain 228

https://hal90007.redintelligence.net/request.php?zone=jf2y0amzcvu0&nw=20&renderingType=javascript&namespace=3531c86597&subid=&uid=206017a8460e277d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x600&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvANlCrFLZeyEIsWwgAe29oqYCKblvaBpvZicp8kP8C4QASDP0NudAWCVgoCAoAfIAQmpAkgBjp9_57E-qAMByAObBKoEpAJP0McVoeSXTz_57FqOng-_RGPjyokY0Vu_iS949zEcPA8s39TlEyh8PfXeFJF56NEeyKSGJ77-cVoJGuF1_eqvhNj7IcpEeBEeDRxjibEMTmH3Gu2UldDp_jtUmiuIfaEul3LSXdU9ZL3H80jHd4a4wQ7zK12X15VPGELFDqqavT9AuL-ncS2f0GNfbT15P8ciNMUs_jdgvU-NFuiwfdOygLawBPG0amJF9T6H0pVb0q0DW9wj_Qdx9wkzea25U57aS4WZWolDVOuExSmDsLB090kBQG1dnqpaoZMRs7uBxrs4fRNCSFLoR8vN9KjA6rNc8rq7u-F8wg-Kt9xwkFz0pyYFO9GhMACZ42KpZiXf3614Jh1KtW5M0r0HykDUzG3fWaDFwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwMKgoKCOS0sQLutbECqg0CREXiDRMI9b-8seO0ggMVRRjgCh02uwKDsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26num%3D1%26cid%3DCAQSOwDICaaNyd8AMPD2TzTvMtd0QMYAEK_sgy_fE6YlOvuUmyjM2AKdL98Ey2XaEazXLZWSEytdyCzAm9oHGAE%26sig%3DAOD64_0G-9PJghANpC-NtSxHxMZhO6Mq_w%26client%3Dca-pub-4647811890505995%26dbm_c%3DAKAmf-C7TIuuhkPfLPhFrxRD81wuHmMKqG52ybxl0yVyx07B6CTy9w6OyR1hdqy6RcLksTQlJxd8U4Du1IDDxPkR8KgFotFkssOeJvY_DfB42LEAH4sX6n5F5Rx6Hd3zMxR-bBVTjxU33p0VnOLJXEXbZAjdLzjLWzVMx0eLouFOA5megs7Nd3w%26cry%3D1%26dbm_d%3DAKAmf-D-MdKVUE7u_8I-1YEF6NBwheLpa9Z8PNWsxD9LRNIwUe3GSY3Yo41NJXrg-UFb8pCwNvVtjVsNaulbFArc2AgFTIaEMSRIj5wp90aiLcGYB0zxoGh2Qpvu6k6hyXA4tw-KcAviKbobQm39xwD44fCf683wVfKj5KYhhp01cZ8GkukM5Q6zQDr57dA3a6UXg_N4mNnRJ_JMFvOt_l2n5jEqAU9R-ta48b3REKlRUQkKN0WHK4tvvP-zpFwQLX5rYL57QdJDhofqNiHgvB69rX5uHI4U7NCIe1DSx-MlMOeWml4noryrOpDWEoP1_AMa5yuwVFvch7O8aKqn0MKX7c3I6ImmiJGRAJIfLrVUD2OMibMMwUCawPhqSncBqvf0bUv5aPYYTGTFrLMl5uBY9oz7CGTjmPBnlGPovnZTtQFjkwfVvXd2e5N-Gy_vAfH1B_oaoue1XE9zTESLdIjxv1jBwLOnjBVr8ROtDaSRau0uVeCWBwbB34qbWu10k41zFU6NrzABq4yQxq5V8THfYUNH6usXCWEd40i183D0QEqfakd-_1n-emxzYjnSyRpnXuMve3rLgdcNjCogRwydhXfjxJFQN7kOXgIrfa1KQOfcy9LGybo%26adurl%3D&documentReferer=https%3A%2F%2F108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fcybernews.com&random=3066871059774&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal90007.redintelligence.net/request.php?zone=jf2y0amzcvu0&nw=20&renderingType=javascript&namespace=3531c86597&subid=&uid=206017a8460e277d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x600&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvANlCrFLZeyEIsWwgAe29oqYCKblvaBpvZicp8kP8C4QASDP0NudAWCVgoCAoAfIAQmpAkgBjp9_57E-qAMByAObBKoEpAJP0McVoeSXTz_57FqOng-_RGPjyokY0Vu_iS949zEcPA8s39TlEyh8PfXeFJF56NEeyKSGJ77-cVoJGuF1_eqvhNj7IcpEeBEeDRxjibEMTmH3Gu2UldDp_jtUmiuIfaEul3LSXdU9ZL3H80jHd4a4wQ7zK12X15VPGELFDqqavT9AuL-ncS2f0GNfbT15P8ciNMUs_jdgvU-NFuiwfdOygLawBPG0amJF9T6H0pVb0q0DW9wj_Qdx9wkzea25U57aS4WZWolDVOuExSmDsLB090kBQG1dnqpaoZMRs7uBxrs4fRNCSFLoR8vN9KjA6rNc8rq7u-F8wg-Kt9xwkFz0pyYFO9GhMACZ42KpZiXf3614Jh1KtW5M0r0HykDUzG3fWaDFwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwMKgoKCOS0sQLutbECqg0CREXiDRMI9b-8seO0ggMVRRjgCh02uwKDsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26num%3D1%26cid%3DCAQSOwDICaaNyd8AMPD2TzTvMtd0QMYAEK_sgy_fE6YlOvuUmyjM2AKdL98Ey2XaEazXLZWSEytdyCzAm9oHGAE%26sig%3DAOD64_0G-9PJghANpC-NtSxHxMZhO6Mq_w%26client%3Dca-pub-4647811890505995%26dbm_c%3DAKAmf-C7TIuuhkPfLPhFrxRD81wuHmMKqG52ybxl0yVyx07B6CTy9w6OyR1hdqy6RcLksTQlJxd8U4Du1IDDxPkR8KgFotFkssOeJvY_DfB42LEAH4sX6n5F5Rx6Hd3zMxR-bBVTjxU33p0VnOLJXEXbZAjdLzjLWzVMx0eLouFOA5megs7Nd3w%26cry%3D1%26dbm_d%3DAKAmf-D-MdKVUE7u_8I-1YEF6NBwheLpa9Z8PNWsxD9LRNIwUe3GSY3Yo41NJXrg-UFb8pCwNvVtjVsNaulbFArc2AgFTIaEMSRIj5wp90aiLcGYB0zxoGh2Qpvu6k6hyXA4tw-KcAviKbobQm39xwD44fCf683wVfKj5KYhhp01cZ8GkukM5Q6zQDr57dA3a6UXg_N4mNnRJ_JMFvOt_l2n5jEqAU9R-ta48b3REKlRUQkKN0WHK4tvvP-zpFwQLX5rYL57QdJDhofqNiHgvB69rX5uHI4U7NCIe1DSx-MlMOeWml4noryrOpDWEoP1_AMa5yuwVFvch7O8aKqn0MKX7c3I6ImmiJGRAJIfLrVUD2OMibMMwUCawPhqSncBqvf0bUv5aPYYTGTFrLMl5uBY9oz7CGTjmPBnlGPovnZTtQFjkwfVvXd2e5N-Gy_vAfH1B_oaoue1XE9zTESLdIjxv1jBwLOnjBVr8ROtDaSRau0uVeCWBwbB34qbWu10k41zFU6NrzABq4yQxq5V8THfYUNH6usXCWEd40i183D0QEqfakd-_1n-emxzYjnSyRpnXuMve3rLgdcNjCogRwydhXfjxJFQN7kOXgIrfa1KQOfcy9LGybo%26adurl%3D&documentReferer=https%3A%2F%2F108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fcybernews.com&random=3066871059774&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 245

https://um.simpli.fi/gp_match?google_gid=CAESEOL48nYlDFxmcVq-UKzjZvA&google_cver=1&google_push=AXcoOmQRKlLR8XW-6LQFLcAXtRIYdMsa40XKl8pFBHh_g6MsxeE-jBCli5xmz0-9bXvBIqbo2xJiQjpko0rXr3Uu172aqkkAKbZtS18 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmQRKlLR8XW-6LQFLcAXtRIYdMsa40XKl8pFBHh_g6MsxeE-jBCli5xmz0-9bXvBIqbo2xJiQjpko0rXr3Uu172aqkkAKbZtS18

Request Chain 247

https://ads.travelaudience.com/google_pixel?google_gid=CAESEBpHGy41RtWFB18_fSLyxX0&google_cver=1&google_push=AXcoOmRCyY_c_fBV1TRgPY6UOaEF8gkwxnQ0lPAGVA3sbrwIpgjN63RQeFt5t4Ul07EGiF2fXXOg6t9Uv08jaScMV_gz65e2B4_J6uY HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4f5q8xuyThAOtoh_ej3JUQ&google_push=AXcoOmRCyY_c_fBV1TRgPY6UOaEF8gkwxnQ0lPAGVA3sbrwIpgjN63RQeFt5t4Ul07EGiF2fXXOg6t9Uv08jaScMV_gz65e2B4_J6uY

Request Chain 249

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEHkJAUL1bXrcz9vbQq3mUcA&google_cver=1&google_push=AXcoOmRpPPlXUHIYDClCwSg3t3EKSz-xLLc55gIVY2Nw0h0WeK3u6F_5llq7MLFYKDLC_HV5cR9sxeAqRbGi_CUMt4IuT6_Phe4PXWM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRpPPlXUHIYDClCwSg3t3EKSz-xLLc55gIVY2Nw0h0WeK3u6F_5llq7MLFYKDLC_HV5cR9sxeAqRbGi_CUMt4IuT6_Phe4PXWM&google_hm=eS0wX1pMMEkxRTJwR181cXBwaHFBd1hURUw5UF9ZWGE4TX5B

Request Chain 251

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEPzstINqtWcTcPQ_Q6gpr00&google_cver=1&google_push=AXcoOmSJObn6jyp-K9i2Jyh8JM5gAe3i-TsjfmecIkliMtU2JVIXtNeQh7_L-AArPLuKhGqnPcOy82aKeZt-UhUKvAAG5KOwA4J9W0w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSJObn6jyp-K9i2Jyh8JM5gAe3i-TsjfmecIkliMtU2JVIXtNeQh7_L-AArPLuKhGqnPcOy82aKeZt-UhUKvAAG5KOwA4J9W0w

Request Chain 253

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=11589600104350404444978012502007&t=htlp&gdpr=1&consent=1&gdpr_consent= HTTP 302
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=11589600104350404444978012502007&actionid=879111&produktid=ratenkredit&dt_url=

Request Chain 255

https://pv.medialead.de/trck/epv/89f7480c0afa0150827cf163f8728151?subid=11589600104350404444978012502007&t=htlp&gdpr=1&consent=1&gdpr_consent= HTTP 302
https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=654bb10ce042321e092f456c&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=

Request Chain 258

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=11589600104350404444978012502007&t=htlp&gdpr=1&consent=1&gdpr_consent= HTTP 302
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=11589600104350404444978012502007&t=htlp&gdpr=1&consent=1&gdpr_consent=

Request Chain 266

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=81530600115245104444556012502002&t=htlp&gdpr=1&consent=1&gdpr_consent= HTTP 302
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=81530600115245104444556012502002&actionid=879111&produktid=ratenkredit&dt_url=

Request Chain 268

https://pv.medialead.de/trck/epv/89f7480c0afa0150827cf163f8728151?subid=81530600115245104444556012502002&t=htlp&gdpr=1&consent=1&gdpr_consent= HTTP 302
https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=654bb10ce042321e092f45bc&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=

Request Chain 269

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=81530600115245104444556012502002&t=htlp&gdpr=1&consent=1&gdpr_consent= HTTP 302
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=81530600115245104444556012502002&actionid=879111&produktid=ratenkredit&dt_url=

Request Chain 278

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEDwFDaKmWikuqVyVd8q4q_M&google_cver=1&google_push=AXcoOmTu3_9jb9Eh6gCrpc0au5Py3qFxCQt8HN5KEkC1I4GxNFGOoa-HzE6yKiREMb_pMpkCvuJ_0RsHONZoZArgQ6C-C8Y3fPPipg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mzc3Mjk2MzUzMTkzMjY3OTU1NA==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDwFDaKmWikuqVyVd8q4q_M&google_cver=1

Request Chain 280

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEE04w_YyWC3sDnm35VWgJP4&google_cver=1&google_push=AXcoOmSzwmLkThUHtNM1PhdrYWdY0r8C_HayNUoaDqNXtJeBM0hSrvSX999-wsd2R99vu_Pb0yMjK3i6hfqpw4QlY-h-pVFHZgwF2Q HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlV1eENnQUFBUHJQblFBag==&google_gid=CAESEE04w_YyWC3sDnm35VWgJP4&google_cver=1&google_push=AXcoOmSzwmLkThUHtNM1PhdrYWdY0r8C_HayNUoaDqNXtJeBM0hSrvSX999-wsd2R99vu_Pb0yMjK3i6hfqpw4QlY-h-pVFHZgwF2Q

Request Chain 281

https://d5p.de17a.com/cookies/google?google_gid=CAESELyWjRviIVlMrn5RPXjxrwc&google_cver=1&google_push=AXcoOmShfwdKlzGfOStnfaD-EShXe3LGNfg0eWMIh4UiX9zJcSgtJIYJXznvrSbY0CFVhhCr5_IpraMwHAUQacdp3f4BjCDcDGTwdQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmShfwdKlzGfOStnfaD-EShXe3LGNfg0eWMIh4UiX9zJcSgtJIYJXznvrSbY0CFVhhCr5_IpraMwHAUQacdp3f4BjCDcDGTwdQ

Request Chain 282

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESELiS35P1ZzrpumPijNkgaCM&google_cver=1&google_push=AXcoOmSEJISlHOC5LsyOTOfLDTZPu9aKDsV03MjL7rHt2x283xAn_bRCAcdsHo7LIjLp_4k0jpNKf8nqJ9mp_SeH4Iz0P_CTiKwN HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESELiS35P1ZzrpumPijNkgaCM&google_hm=ZUuxC3IQQP_Km-B4CnTlUwAAFKEAAAAB&google_nid=index&google_push=AXcoOmSEJISlHOC5LsyOTOfLDTZPu9aKDsV03MjL7rHt2x283xAn_bRCAcdsHo7LIjLp_4k0jpNKf8nqJ9mp_SeH4Iz0P_CTiKwN

Request Chain 283

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEHe8Ts_0y3BRJJuonSQQYtY&google_cver=1&google_push=AXcoOmR9dgXmxjRUyju86rUrIBjGyG2UHuAzt1ZxR926np8QremhZe2i3_R-YbKm8iIFGJLzTdoDk0ln-mEjifgwbQLT_RHr4mN1CKM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmR9dgXmxjRUyju86rUrIBjGyG2UHuAzt1ZxR926np8QremhZe2i3_R-YbKm8iIFGJLzTdoDk0ln-mEjifgwbQLT_RHr4mN1CKM HTTP 302
https://onetag-sys.com/match/?int_id=19&google_error=5

Request Chain 284

https://csync.loopme.me/?pubid=11537&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_109}&redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dloopme_eb_%26google_hm%3D{viewer_token}&google_gid=CAESEB1oeWKkKR2-rBN_ykjOIg8&google_cver=1&google_push=AXcoOmRBU0tGaELEYWRjQGLsM10Wu7i-WIWgDcWQG5a82-AEea2Pe8Gi252Hdmc4pIilVsVa3MavnVDCZaEPZRe4gmVgOu-H4VAs910 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=a5e18942-624f-499c-bb05-4e1b6db4986c&google_cver=1&google_gid=CAESEB1oeWKkKR2-rBN_ykjOIg8&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmRBU0tGaELEYWRjQGLsM10Wu7i-WIWgDcWQG5a82-AEea2Pe8Gi252Hdmc4pIilVsVa3MavnVDCZaEPZRe4gmVgOu-H4VAs910&gdpr=${GDPR}

Request Chain 303

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEGFcaASaqHMU9hvIxYAYc08&google_cver=1&google_push=AXcoOmRn2KYFIRBV36XmaBus1M1lc5EgzerSurifR9IhMm5WbIlhDqGpzHS-0fm8JWBDU483nMDCQphbAT_xbLbmf2tnJVAr2ePt44E HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mzc3Mjk2MzUzMTkzMjY3OTU1NA==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDwFDaKmWikuqVyVd8q4q_M&google_cver=1

Request Chain 304

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEDOIoDhqsPropPGe2fHX_hQ&google_cver=1&google_push=AXcoOmQHtqGZcHViq4dVhFYMhKC6MD2hYpU0p7dRHEBdpM9p50kN26TgWsHfMs2rLhdkJMaSkszfoLZ3JeDvsgY441fqKNM2fWFCp78 HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEDOIoDhqsPropPGe2fHX_hQ&google_cver=1&google_push=AXcoOmQHtqGZcHViq4dVhFYMhKC6MD2hYpU0p7dRHEBdpM9p50kN26TgWsHfMs2rLhdkJMaSkszfoLZ3JeDvsgY441fqKNM2fWFCp78 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=NTUzV0oxd0gxUjBMMHg1&google_gid=CAESEDOIoDhqsPropPGe2fHX_hQ&google_cver=1&google_push=AXcoOmQHtqGZcHViq4dVhFYMhKC6MD2hYpU0p7dRHEBdpM9p50kN26TgWsHfMs2rLhdkJMaSkszfoLZ3JeDvsgY441fqKNM2fWFCp78

Request Chain 306

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEAXunFfiru-LYeQoSctfnMk&google_cver=1&google_push=AXcoOmRuEuOD0qTk9e7w2ThbzOaXplFfWfVt6si-Y8FsqYGvNe0zZbPymF7EBYPRz1QLMny9t0ZuqEX-i4yv5J4tUsNy_c20RyPEA1I HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlV1eENnQUFBUHJQblFBag==&google_gid=CAESEAXunFfiru-LYeQoSctfnMk&google_cver=1&google_push=AXcoOmRuEuOD0qTk9e7w2ThbzOaXplFfWfVt6si-Y8FsqYGvNe0zZbPymF7EBYPRz1QLMny9t0ZuqEX-i4yv5J4tUsNy_c20RyPEA1I

Request Chain 307

https://um.simpli.fi/gp_match?google_gid=CAESEOL48nYlDFxmcVq-UKzjZvA&google_cver=1&google_push=AXcoOmReytOW3TpRTIZnEh-JmE0ceGh7cTMFl0-lrmEuyRYCRhi_KA-0fj-f8SEFaNSgS6xQa3eR_A_qkKWjs21JqRg4ZbX3ywEdYek HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmReytOW3TpRTIZnEh-JmE0ceGh7cTMFl0-lrmEuyRYCRhi_KA-0fj-f8SEFaNSgS6xQa3eR_A_qkKWjs21JqRg4ZbX3ywEdYek

Request Chain 308

https://ads.travelaudience.com/google_pixel?google_gid=CAESEBpHGy41RtWFB18_fSLyxX0&google_cver=1&google_push=AXcoOmTkclo4zjqsxGlK4wAOzYZ73OzNFM6NGgRsxsekSSgx_yoM4yXp_nO_n0ulUOZxmuokVxpO7uWoxwEC0EqINUzQMNB-vHn1MXc HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4f5q8xuyThAOtoh_ej3JUQ&google_push=AXcoOmTkclo4zjqsxGlK4wAOzYZ73OzNFM6NGgRsxsekSSgx_yoM4yXp_nO_n0ulUOZxmuokVxpO7uWoxwEC0EqINUzQMNB-vHn1MXc

Request Chain 331

https://gum.criteo.com/sid/json?origin=publishertag&domain=cybernews.com&sn=ChromeSyncframe&so=0&topUrl=cybernews.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=SGgjk3x0dDFCY2Fmb0MxNGVTMS9qdForbVg4VEY3QzNmUk1Pd2twMkhzUSsyQVFzUiswU0IybHQ4R0lSZ2dVcTZvaEtreVhuSUdOL3pOL25FWm1uWCtCTjFwbjJYbjk4VlNESU9lSGZpWU41NllsR0J5eGk2TG9jYWlWWHVDblNvV051QUlMMVBNZXprUW1yWmJRYkl2Nk5VcEJMWEhIOVIzTGhTZDFaWHNBbzBTYThkcXltckJjbXlsaFZodmo0Y2pteDJJV0FrS2R3Z2JPSTRPTGxxNDRGUEN6K1A2ZS9lVi9GN1BSR3laaytVY1BMbmxnWjVwQ3RLYnh5OXlJNllhd2h3Z3Vkc2VxbWwrSjRaeXNPUGw5YXlpUT09fA&cppv=2

342 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/ 123 KB
30 KB 260ms
205ms Document
text/html 2606:4700:3108::ac42:2bc5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2bc5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

94dc4ccba2729dd99e3517b1f49dfcfca1347273fd74f42433b622236cf37448

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https: data: blob: wss://*.hotjar.com;style-src data: blob: https: 'unsafe-inline';script-src https: data: blob: 'unsafe-inline' 'unsafe-eval';img-src 'self' https: data: blob:;worker-src 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 822f0a1ab83a2c7e-FRA
content-encoding: br
content-security-policy: default-src 'self' https: data: blob: wss://*.hotjar.com;style-src data: blob: https: 'unsafe-inline';script-src https: data: blob: 'unsafe-inline' 'unsafe-eval';img-src 'self' https: data: blob:;worker-src 'self';block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: unsafe-none
cross-origin-resource-policy: same-site
ct-content-bucket: cyber-war
ct-content-type: Editorial
ct-date-published: 2023-08-29
date: Wed, 08 Nov 2023 16:02:17 GMT
expires: Wed, 08 Nov 2023 20:02:17 GMT
last-modified: Wed, 08 Nov 2023 13:42:15 GMT
permissions-policy: geolocation=(), camera=(), microphone=()
referrer-policy: no-referrer
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 83ms
37ms Script
application/javascript 2606:4700::6812:d73b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalSDK.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0d7eace6de7a123701ad163455f50ea9f6f51c5985a49f4d1f6e797009fbdb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:17 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 1453
etag: W/"2a3bbde818bef34d53a0df862ead5d5f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 822f0a1c598a2c41-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400
expires: Sat, 11 Nov 2023 16:02:17 GMT

GET
H2 200 base-69f914aba75b1bb036ab.js Show response
cybernews.com/js/ 24 KB
10 KB 53ms
52ms Script
application/javascript 2606:4700:3108::ac42:2bc5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cybernews.com/js/base-69f914aba75b1bb036ab.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2bc5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b49a24935c33b6588afe92ff18fd96fb3186453e8ce83caf438101329c9c35ef

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https: data: blob: wss://*.hotjar.com;style-src data: blob: https: 'unsafe-inline';script-src https: data: blob: 'unsafe-inline' 'unsafe-eval';img-src 'self' https: data: blob:;worker-src 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: default-src 'self' https: data: blob: wss://*.hotjar.com;style-src data: blob: https: 'unsafe-inline';script-src https: data: blob: 'unsafe-inline' 'unsafe-eval';img-src 'self' https: data: blob:;worker-src 'self';block-all-mixed-content;upgrade-insecure-requests;
age: 13650
cross-origin-embedder-policy: unsafe-none
cf-polished: origSize=24352
cross-origin-resource-policy: same-site
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: no-referrer
last-modified: Wed, 08 Nov 2023 07:00:07 GMT
cf-bgj: minify
server: cloudflare
etag: W/"654b31f7-5f20"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
permissions-policy: geolocation=(), camera=(), microphone=()
cf-ray: 822f0a1c1a032c7e-FRA
expires: Wed, 08 Nov 2023 20:02:17 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 148 KB
51 KB 149ms
65ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5928161074779380

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

55a59a967ed437c22c7ca5f731628428087138856a154dc1f630abf2d7ade0c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
Origin: https://cybernews.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52108
x-xss-protection: 0
server: cafe
etag: 7918365096528399144
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 08 Nov 2023 16:02:17 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 100 KB
31 KB 164ms
81ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

14557f52afb8d067d7189ed0f365f2528cb9001e012ef0e324c5f9c7cbdfaae3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31406
x-xss-protection: 0
server: cafe
etag: 312 / 19669 / 31079511 / config-hash: 6902417098709738194
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 08 Nov 2023 16:02:17 GMT

GET
H2 200 5774 Show response
stpd.cloud/saas/ 342 KB
104 KB 423ms
340ms Script
text/javascript 2606:4700::6812:1e31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stpd.cloud/saas/5774
Requested by: Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1e31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fef97ab35217e2ce4eac36ca6655dfb3cdb9f90832c9d45f0147887fdb487840

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

expires: Wed, 08 Nov 2023 20:02:18 GMT
date: Wed, 08 Nov 2023 16:02:18 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 08 Nov 2023 16:02:17 GMT
server: cloudflare
age: 1
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 822f0a1cbee49238-FRA
stpdhash: cache

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 244 KB
85 KB 121ms
38ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KMWQ6GT

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

065aaede60acea7e4d05da9187852ad98658ce6b5b83e709fca18ee52012640b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86984
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 08 Nov 2023 16:02:17 GMT

GET
DATA 200
OK truncated
/ 61 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e138d129f38769d7080ed6ac6519dce8a4d546b7da5709b12aedff39673fa021

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 64 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f290a3a287182664a81ea150c04e7d1a451f1bf74f6738b43d382e3d40d98002

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 63 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5ed7794c22ce4c54132708cc1cbdc2b21c0a89cbc1a52283b8f95fe8fd45e9e9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 63 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9c69d75b62cd78e86b22a2bc1a285fe881555d852283b2508f7e7c9b4937a89d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 63 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9fca9ae04b4bca7ef7d4f2c43505769b1f03fd173ecf3871dd7b7ee0f115dd48

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 62 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ab8f0b6cec3eb6cd02efd0a9324053b868cac7dcda99fc89871b4e87141bdf14

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 Damien.jpg
media.cybernews.com/2022/05/ 37 KB
38 KB 144ms
65ms Image
image/jpeg 2606:4700:3108::ac42:283b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.cybernews.com/2022/05/Damien.jpg

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

61d428927ee939648e75ce295d112ec2870e7683922741f123c0c2c97b717bfa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

expires: Wed, 08 Nov 2023 20:02:17 GMT
date: Wed, 08 Nov 2023 16:02:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 a7922bb75420f6c3485eed5adcb99ce2.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: DUS51-P3
cf-polished: origSize=38776
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 38139
last-modified: Wed, 27 Jul 2022 11:16:29 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "d5ab03d3189a480fcaf5aaeb4f55d087"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 822f0a1d0fcc65b4-FRA
x-amz-cf-id: kzXZf6vMJHieQKh7xd2kFag6SbKZvO5hPHlQQWcK1NMa0qJWq0V1MA==
x-amz-meta-mtime: 1652961630

GET
H2 200 Iran-map.png
media.cybernews.com/images/750w/2023/08/ 79 KB
79 KB 433ms
354ms Image
image/avif 2606:4700:3108::ac42:283b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.cybernews.com/images/750w/2023/08/Iran-map.png

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

82f1c45783799c25aef6db5c808074960fb6b9135b22087644aa3009e7585728

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 9c7c26f5beeb09381cea450ea3581b36.cloudfront.net (CloudFront)
cf-cache-status: MISS
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
alt-svc: h3=":443"; ma=86400
content-length: 80940
cf-resized: internal=ok/h q=0 n=47+249 c=0+0 v=2023.9.8 l=80940
last-modified: Tue, 29 Aug 2023 07:43:44 GMT
cf-bgj: imgq:90,h2pri
server: cloudflare
etag: "cfZrjt6OYuVPelG2bMziA5el0_u5KfpxHRw9djGO55DQ:c330410d4ef7e2db040adc3459a2ba76"
vary: Accept, Accept-Encoding
content-type: image/avif
cache-control: max-age=15780000
accept-ranges: bytes
cf-ray: 822f0a1d0fbd65b4-FRA

GET
H2 200 bookreviewGoingInfinite.jpg
media.cybernews.com/images/thumbnail/2023/11/ 18 KB
18 KB 126ms
47ms Image
image/avif 2606:4700:3108::ac42:283b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.cybernews.com/images/thumbnail/2023/11/bookreviewGoingInfinite.jpg

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b6230cb6538ab0738ccf6f068b860283f95c5c52a32404d366907c360f3e0b8

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 c6702f5f3b6e77da6f394e67ef1a6aaa.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
alt-svc: h3=":443"; ma=86400
content-length: 18394
cf-resized: internal=ok/h q=0 n=13+100 c=0+0 v=2023.9.8 l=18394
last-modified: Fri, 03 Nov 2023 09:23:01 GMT
cf-bgj: imgq:90,h2pri
server: cloudflare
etag: "cfHERaeuOC290kjeDOKlwEiBU2Pri99XVCPD58WiJxDQ:426f6847c5633ebbe712da743193bfd6"
vary: Accept, Accept-Encoding
content-type: image/avif
cache-control: max-age=15780000
accept-ranges: bytes
cf-ray: 822f0a1d0fc865b4-FRA

GET
H2 200 exoplanet-discovery-ai.jpg
media.cybernews.com/images/thumbnail_small/2023/10/ 3 KB
3 KB 125ms
46ms Image
image/avif 2606:4700:3108::ac42:283b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.cybernews.com/images/thumbnail_small/2023/10/exoplanet-discovery-ai.jpg

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b05cd13161a893b6d815c353de95b25ff3a273e4baa4b503376817ec5c0ab259

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 4eceffc8a157336b4f146e9b841ee3e4.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
alt-svc: h3=":443"; ma=86400
content-length: 2934
cf-resized: internal=ok/h q=0 n=27+1 c=14+71 v=2023.9.8 l=2934
last-modified: Tue, 31 Oct 2023 14:13:06 GMT
cf-bgj: imgq:90,h2pri
server: cloudflare
etag: "cfNAOz1sw3sRX4-W8CjRF6wvIh8iFZYhIqdjUqgfspDQ:0e244048c1ad101ee733562a41d8a8bd"
vary: Accept, Accept-Encoding
content-type: image/avif
cache-control: max-age=15780000
accept-ranges: bytes
cf-ray: 822f0a1d0fc665b4-FRA

GET
H2 200 finding-waldo-missing-person.jpg
media.cybernews.com/images/thumbnail_small/2023/11/ 4 KB
4 KB 153ms
75ms Image
image/avif 2606:4700:3108::ac42:283b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.cybernews.com/images/thumbnail_small/2023/11/finding-waldo-missing-person.jpg

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c7842050c8ca63ebd3d9fd3b93af4f92d7677b26d6182bdc567cf79c6b3eeead

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 9ab847fabb8c9edbd39cff57c2a2f4c0.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
alt-svc: h3=":443"; ma=86400
content-length: 4187
cf-resized: internal=ok/h q=0 n=18+0 c=3+73 v=2023.9.8 l=4187
last-modified: Mon, 06 Nov 2023 13:55:20 GMT
cf-bgj: imgq:90,h2pri
server: cloudflare
etag: "cfvKevg11G5TmJL1i0-mCDqzZG8iFZYhIqdjUqgfspDQ:69bd180c63ef9907b586150fed461f46"
vary: Accept, Accept-Encoding
content-type: image/avif
cache-control: max-age=15780000
accept-ranges: bytes
cf-ray: 822f0a1d0fc165b4-FRA

GET
H2 200 gary-mckinnon-one.png
media.cybernews.com/images/thumbnail_small/2023/10/ 3 KB
4 KB 126ms
51ms Image
image/avif 2606:4700:3108::ac42:283b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.cybernews.com/images/thumbnail_small/2023/10/gary-mckinnon-one.png

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7514b57976180ef294d9334ebf14d8dbc62cbe8f164bf119f64e352c384cbbb4

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 5d8c59c4e33ff30f6610982ac8ad0232.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
alt-svc: h3=":443"; ma=86400
content-length: 3560
cf-resized: internal=ok/h q=0 n=19+0 c=23+76 v=2023.9.8 l=3560
last-modified: Mon, 30 Oct 2023 09:17:34 GMT
cf-bgj: imgq:90,h2pri
server: cloudflare
etag: "cf2Jdktgf93kbK6advbdVao6Bf8iFZYhIqdjUqgfspDQ:0ce6d9da1b2a046257b34a6c120563e4"
vary: Accept, Accept-Encoding
content-type: image/avif
cache-control: max-age=15780000
accept-ranges: bytes
cf-ray: 822f0a1d0fb865b4-FRA

GET
H2 200 hqdefault.jpg
img.youtube.com/vi/Zc04Wug9aj0/ Frame 1C46 35 KB
36 KB 94ms
26ms Image
image/jpeg 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/Zc04Wug9aj0/hqdefault.jpg

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fa8319a7de1f988af9c9b44cf634acfd4eed3ff9e52c8b92595e714543e26660

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 15:56:03 GMT
x-content-type-options: nosniff
age: 374
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36312
x-xss-protection: 0
server: sffe
etag: "1693232197"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 08 Nov 2023 17:56:03 GMT

GET
H2 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 284 KB
68 KB 51ms
46ms Script
application/javascript 2606:4700::6812:d73b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151604

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

425197a561a2dc98259d7e284f708115b672f426a8adc0955f6f42fbaa61d7ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:17 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 1453
etag: W/"7f9669464fe15e6a516c0eb693b26dbb"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 822f0a1cba102c41-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400
expires: Sat, 11 Nov 2023 16:02:17 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 263 KB
89 KB 29ms
28ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-KT8DKCHF41&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KMWQ6GT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

94a82bc2dacf9d0cb0ed2a5e8eb5bc15d9bb393e1402873fc7f508f90b3442cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 90591
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 08 Nov 2023 16:02:17 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 85ms
26ms Script
application/javascript 146.75.116.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KMWQ6GT
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:17 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 16:56:53 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100081-IAD, cache-fra-eddf8230052-FRA

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/589784210/ 3 KB
2 KB 83ms
31ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/589784210/?random=1699459337841&cv=11&fst=1699459337841&bg=ffffff&guid=ON&async=1&gtm=45He3b60v813159125&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&hn=www.googleadservices.com&frm=0&tiba=Iran%20spyware%20breached%20and%20exposed%20by%20GhostSec%20%7C%20Cybernews&auid=1076020221.1699459338&uamb=0&uaw=0&data=contentBucket%3Dcyber-war%3BcontentType%3DEditorial&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KMWQ6GT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9f63bca191ced224e85b469fdae030555b027ae9bff45dd38918479a1b14f7bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1323
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 202 KB
54 KB 67ms
19ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 08 Nov 2023 16:02:17 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: mOGs/UEwcQBBJX4zRsF4na/DGvsCfAgf3Ft0qmVi0ZZTcUR7Qq0xP8csTKVl8dXOPaeOfiT22LGN47IntAmY5g==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311020101/ 400 KB
135 KB 138ms
99ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311020101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5928161074779380&plah=cybernews.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5928161074779380

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03da929bc583ef63bdad194145be9e3d59e7333ae9de2d12199bfac568d32000

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138486
x-xss-protection: 0
server: cafe
etag: 9728811889241073789
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 08 Nov 2023 16:02:17 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231106/r20190131/ Frame 3CC8 10 KB
5 KB 29ms
22ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231106/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5928161074779380

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

626c65063bcb00fcc4574cffc418820fc209794a0519ec1e65931896c79a6ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 55421
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4502
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 00:38:36 GMT
etag: 251720774729838433
expires: Wed, 22 Nov 2023 00:38:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311060101/ 427 KB
134 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311060101/pubads_impl.js?cb=31079511

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

97099da6fb4c43aa8cd1fa2cfb9dfefe93b07b3eac3fc20fc7094ff482871d39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 22:36:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62740
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 136817
x-xss-protection: 0
server: cafe
etag: 14142176788290477171
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Wed, 06 Nov 2024 22:36:37 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 72 B
82 B 106ms
57ms XHR
application/json 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=cybernews.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b65665e32c89ce2e092011b269b0fa005ab33c1ef15cb74f8e9a43838ff2300d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:18 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58
x-xss-protection: 0
expires: Wed, 08 Nov 2023 16:02:18 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
252 B 100ms
27ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-KT8DKCHF41&gtm=45je3b60v882489589z8813159125&_p=1699459337625&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=841652769.1699459337&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1699459337&sct=1&seg=0&dl=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&dt=Iran%20spyware%20breached%20and%20exposed%20by%20GhostSec%20%7C%20Cybernews&en=page_view&_fv=1&_ss=1&ep.contentBucket=cyber-war&ep.pagePostAuthor=Damien%20Black&tfd=647
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KT8DKCHF41&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cybernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
243 B 1003ms
930ms Ping
text/plain 2a00:1450:400c:c07::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-KT8DKCHF41&cid=841652769.1699459337&gtm=45je3b60v882489589z8813159125&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KT8DKCHF41&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c07::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cybernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 120ms
47ms Image
image/gif 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-KT8DKCHF41&cid=841652769.1699459337&gtm=45je3b60v882489589z8813159125&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=2041301191

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/589784210/ 42 B
455 B 100ms
32ms Image
image/gif 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/589784210/?random=1699459337841&cv=11&fst=1699459200000&bg=ffffff&guid=ON&async=1&gtm=45He3b60v813159125&u_w=1600&u_h=1200&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&frm=0&tiba=Iran%20spyware%20breached%20and%20exposed%20by%20GhostSec%20%7C%20Cybernews&data=contentBucket%3Dcyber-war%3BcontentType%3DEditorial&fmt=3&is_vtc=1&cid=CAQSGwDICaaNEKIfr50CmDyEK34mmZ8E9Ku3T87T3g&random=1877063905&rmt_tld=0&ipr=y

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/589784210/ 42 B
455 B 98ms
38ms Image
image/gif 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/589784210/?random=1699459337841&cv=11&fst=1699459200000&bg=ffffff&guid=ON&async=1&gtm=45He3b60v813159125&u_w=1600&u_h=1200&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&frm=0&tiba=Iran%20spyware%20breached%20and%20exposed%20by%20GhostSec%20%7C%20Cybernews&data=contentBucket%3Dcyber-war%3BcontentType%3DEditorial&fmt=3&is_vtc=1&cid=CAQSGwDICaaNEKIfr50CmDyEK34mmZ8E9Ku3T87T3g&random=1877063905&rmt_tld=1&ipr=y

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/1/i/ 43 B
377 B 260ms
203ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=1aef6b6e-7066-4cad-8ce9-2f3a7bc35bbc&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=69495626-452e-42b0-9c1c-045c11c4541d&tw_document_href=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&tw_iframe_status=0&txn_id=o3auk&type=javascript&version=2.3.29

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-response-time: 183
date: Wed, 08 Nov 2023 16:02:17 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 325c095622233f4b
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: df45ec0496363299fbd2e4c3d937e8409e18161105b657f259bfaccca19c4eaa
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
727 B 187ms
130ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=1aef6b6e-7066-4cad-8ce9-2f3a7bc35bbc&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=69495626-452e-42b0-9c1c-045c11c4541d&tw_document_href=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&tw_iframe_status=0&txn_id=o3auk&type=javascript&version=2.3.29

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-response-time: 109
date: Wed, 08 Nov 2023 16:02:17 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: fe3fba77d05c7980
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: a958322f97a3af33d3758d4fad9e9ddb4c58bf78ba9548b195d27ce7a268d567
content-length: 43

GET
H2 200 1031670724691978 Show response
connect.facebook.net/signals/config/ 133 KB
35 KB 20ms
19ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1031670724691978?v=2.9.138&r=stable&domain=cybernews.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9ec169e17d05c2935b44d196fe74a35c7c1ea22182fb146394f12b30d4396891

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 08 Nov 2023 16:02:18 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 35312
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: Luty8MoF0zWijezhm9PrAXZFgxdUF063fQuec8ZwWv5hEmOuWyfgEYZvmPOS0UbUZHEwyU6Q5Pa0Yvy23Ikxsw==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 73ms
21ms Image
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1031670724691978&ev=PageView&dl=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&rl=&if=false&ts=1699459338098&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1699459338095.810165104&ler=empty&it=1699459338025&coo=false&rqm=GET

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 08 Nov 2023 16:02:18 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 121ms
44ms Preflight
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fcybernews.com%2F&domain=cybernews.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://cybernews.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://cybernews.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 08 Nov 2023 16:02:17 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 239370
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 135 B
414 B 68ms
21ms XHR
application/json 162.19.138.83
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/5774

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

7c2589f966c01479236dda131a4942c70ba281e3be202cc12d56680f86977a54

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://cybernews.com
date: Wed, 08 Nov 2023 16:02:17 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
372 B 125ms
33ms XHR
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fcybernews.com%2F&domain=cybernews.com&cw=1&lsw=1

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/5774

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:17 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://cybernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 173344
expires: 0

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
2 KB 78ms
29ms XHR
application/json 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20231108

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/5774

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

37f954338ad6a9a7986c5fc3bd3c0d21beb057006a1f71c136a73ada20e344e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 08 Nov 2023 16:02:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 86
x-jsd-version: 1.0.1868
content-encoding: br
x-cache: MISS
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230092-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"636-C0XVeVMXw7PRcpXopDc8jPu9+5w"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=swoslMWuTDc6ltAH6%2BlKmqHFMZOPya8XS4Z0P%2B2UBsF%2BVMacjJDfLsUOrmo4cEAHfY%2FER%2BYFwqdbMgtUWGa3PNuvlKTm4iz%2BQ2ueVKtfeASJXBsE2or0kS46DW2DJ6D5B5CrSL12CYtd50Uv3C0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 822f0a1fc90c906a-FRA

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 393 B
605 B 83ms
29ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=cybernews.com&callback=_gfp_s_&client=ca-pub-5928161074779380

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311020101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5928161074779380&plah=cybernews.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

10187acc5235c6059887a125e97dadd34033fe8b255b594fa69a07a1d6d814d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 253
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1448 344 KB
72 KB 409ms
406ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&adk=1812271804&adf=3025194257&lmt=1699450935&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=164x810_l%7C188x675_r&format=0x0&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2&ascmds=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337879&bpp=3&bdt=277&idt=284&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=60113865226&frm=20&pv=2&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=316

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e09f05e5f2c84ddcda63866ab911f35b020c1e935cd0b677602c70f81b0f136b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 73691
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 16:02:18 GMT
expires: Wed, 08 Nov 2023 16:02:18 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4BC1 107 KB
40 KB 415ms
405ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2732825802&adk=652042997&adf=2125223602&pi=t.ma~as.2732825802&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337882&bpp=2&bdt=280&idt=319&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=1049&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&xpc=TADUTnXVU7&p=https%3A//cybernews.com&dtd=326

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cf4245e39a60da440102ffe9d7d690e3ee5ca3e36ca97f6cb473aa038c924817

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 40909
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 16:02:18 GMT
expires: Wed, 08 Nov 2023 16:02:18 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9D8E 722 B
709 B 355ms
347ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=1815900770&adk=471421629&adf=3153423549&pi=t.ma~as.1815900770&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337884&bpp=1&bdt=282&idt=329&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=2851&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=qWDiFUohuQ&p=https%3A//cybernews.com&dtd=336

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2170329b6c38f145f4c9d662dbe957eb5326d8008df28ff3cf976849103581b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 362
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 16:02:18 GMT
expires: Wed, 08 Nov 2023 16:02:18 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 cookie_sync Show response
prebid-stag.setupad.net/ 1 KB
933 B 93ms
40ms XHR
application/json 104.26.9.178
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/cookie_sync
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.9.178 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6298aa27bb1e6f06e724122d279362875c81eff0b2e0576a8eec5aefeee452d8

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HJ%2BR7ChIse8vQIdn24OKevz%2FAJLbC3pjkcuYWM3NSj4qg5%2F6zUmusrynJeqmD0eutLVJNNJUAD%2BczDZKW5CO86ukLYxcLvJFC1ZjK5FAX7GrDYKXxMxJAqMn3YcdKrhWe7Ns2ya6NrK%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://cybernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 822f0a205ae52bb0-FRA
expires: 0

POST
H2 200 auction Show response
prebid-stag.setupad.net/openrtb2/ 483 B
629 B 247ms
196ms XHR
application/json 104.26.9.178
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/openrtb2/auction
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.9.178 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ce9e7cb2dd39562981d62eeecf90a692ded55e854a15fd7f243423209e104851

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-prebid: pbs-go/0.234.0-3-gde6ed827
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=axAkc7zQF18TbNnI4bVa%2BTQ4%2BA3oOf7sbt%2B3IN6AzkrU5J0Ub3M0cewr1axkv9ky45g6sP0mahJGR32Rp9iTnb0x3gGn9XjZIlLyMljCv0iptegrx2xxR2zXvYErWnKArH6fmtn8baiz"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://cybernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 822f0a205ae22bb0-FRA
expires: 0

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
192 B 225ms
151ms XHR
text/plain 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=7.54.0&cb=40537238236&lsavail=1

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/5774

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://cybernews.com
date: Wed, 08 Nov 2023 16:02:18 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
400 B 115ms
49ms XHR
application/json 216.52.2.39
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.54.0
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.39 New York, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: 55bc2527d4798f4d64619ed95d95e1befef6b19c20f5b892168bad4e57a0bfe5

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 08 Nov 2023 16:02:18 GMT
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://cybernews.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap7ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 24

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
176 B 110ms
46ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://cybernews.com
date: Wed, 08 Nov 2023 16:02:18 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 14 KB
5 KB 238ms
130ms XHR
application/json 185.86.139.116
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.116 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 63986dd7aa8ec7a3035df73ad7ca7671e009113245b63360bc999e54458932f1

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://cybernews.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5081 88 KB
29 KB 411ms
404ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=9812672228&adk=3541318952&adf=1004996698&pi=t.ma~as.9812672228&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337885&bpp=1&bdt=283&idt=367&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4558&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=yEOzzq4M2D&p=https%3A//cybernews.com&dtd=372

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

afaefb2e6f601df64071adcfad943a3dce684fef0753d43e0e15046d7cf4bfc4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 29298
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 16:02:18 GMT
expires: Wed, 08 Nov 2023 16:02:18 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
273 B 147ms
95ms XHR
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/5774

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

Resource Hash

bddb8267c0816fce9bb5fb9101f80a8e0c98d43a4e2fd197dc1834eea8b45a36

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://cybernews.com
date: Wed, 08 Nov 2023 16:02:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H/1.1 200
OK sync
ssbsync-global.smartadserver.com/api/ 0
75 B 133ms
36ms Image
text/plain 185.86.138.150
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsmartadserver%26gdpr%3D%26gdpr_consent%3D%26f%3Di%26uid%3D%5Bssb_sync_pid%5D
Requested by: Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.150 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:17 GMT
content-length: 0

POST
H2 200 481.json Show response
id5-sync.com/g/v2/ 250 B
529 B 62ms
18ms XHR
application/json 162.19.138.83
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/481.json

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/5774

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

Resource Hash

4f180b0a15f71d1cf46888f0380f86570e44a3556ef9dd496d22482d6cb4cae3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://cybernews.com
date: Wed, 08 Nov 2023 16:02:17 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 cookie
cm.adform.net/ 43 B
106 B 98ms
30ms Image
image/gif 37.157.5.133
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D%26gdpr_consent%3D%26f%3Di%26uid%3D%24UID
Requested by: Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.5.133 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:18 GMT
server: nginx
content-length: 43
content-type: image/gif

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 28 KB
13 KB 323ms
323ms Fetch
text/plain 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2784811193083586&correlator=2925165841007899&eid=31079469%2C31079380%2C31079511&output=ldjh&gdfp_req=1&vrg=202311060101&ptt=17&impl=fifs&iu_parts=21924397842%2Ccybernews.com_300x600_sidebar_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C300x600&ifi=6&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D09432204d3d82e22-22328050cce40022%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYhoFlqQ3CbV9-CaqK9zLU6ZxdA-Q&gpic=UID%3D00000da0ad62a0d1%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MZeiiY0VwiMtozWHa9lYuxTICniqA&abxe=1&dt=1699459338512&lmt=1699450935&adxs=1023&adys=1365&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&vis=1&psz=350x20&msz=350x0&fws=516&ohw=350&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=true&dlt=1699459337602&idt=438&prev_scp=hb_env%3Dweb%26hb_source%3Dclient%26hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.04%26hb_adid%3D2029a56961fa15e%26hb_bidder%3Dsmartadserver&cust_params=origin%3Ddirect%26ECT%3D4g%26hb_rf%3D0&adks=3686707683&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311060101/pubads_impl.js?cb=31079511

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08a877f42f68ec37f4c1c33a0fd4cac81e7b40d1b2be090da317a119761d1350

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:18 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12874
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cybernews.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6360 6 KB
3 KB 99ms
26ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311060101/pubads_impl.js?cb=31079511

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 16:02:18 GMT
expires: Thu, 07 Nov 2024 16:02:18 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 171F 15 KB
6 KB 103ms
32ms Document
text/html 2.19.105.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.105.180 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-105-180.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 94061a925c5d84bf776554ac894020c407a9a4c89b979d538de3cf45591fe423

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=138434
content-encoding: gzip
content-length: 5606
content-type: text/html
date: Wed, 08 Nov 2023 16:02:18 GMT
expires: Fri, 10 Nov 2023 06:29:32 GMT
last-modified: Fri, 01 Sep 2023 11:18:33 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0B32 98 KB
30 KB 377ms
376ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2895910089&adk=4004477476&adf=3455423724&pi=t.ma~as.2895910089&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337886&bpp=1&bdt=284&idt=398&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4019e175c95576ce%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MbRkZpwDWvwgImp4hT4MxuOzfwlyg&gpic=UID%3D00000ccc31a35fda%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYOaxCzChjXiL5NQ3guXhLuXwECNQ&prev_fmts=0x0%2C749x280%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4766&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tz4yikkSlt&p=https%3A//cybernews.com&dtd=736

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

24167eb290a34a5ddd8ec3f3e3111283bea38b61d3d4d23017a67d3a4343756c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 30382
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 16:02:18 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 16907500102997322243
tpc.googlesyndication.com/daca_images/simgad/ Frame 4BC1 94 KB
94 KB 91ms
29ms Image
image/png 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/16907500102997322243

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2732825802&adk=652042997&adf=2125223602&pi=t.ma~as.2732825802&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337882&bpp=2&bdt=280&idt=319&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=1049&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&xpc=TADUTnXVU7&p=https%3A//cybernews.com&dtd=326

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

503e34a807f7d34e1661db6f2301987b62a9beed68463f412fd2681be816e50a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 06:12:25 GMT
x-content-type-options: nosniff
age: 208193
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 96339
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 06:07:17 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 05 Nov 2024 06:12:25 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/ Frame 4BC1 23 KB
9 KB 84ms
22ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8b1cd2613a5b066023f3aee22ea0cd501c2fb10eccaece8de94114f659c0d61f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:02:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71994
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9286
x-xss-protection: 0
server: cafe
etag: 5170786266788330719
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:02:24 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/ Frame 4BC1 3 KB
1 KB 77ms
29ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 15:55:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 382
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Nov 2023 15:55:56 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/ Frame 4BC1 20 KB
9 KB 79ms
18ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee46bdadc83beb5e76bce18bc7cc3d169c7f0490901f6be96ec41ee2c14d3776

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:02:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71994
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8543
x-xss-protection: 0
server: cafe
etag: 18034338113832500900
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:02:24 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 4BC1 0
0 39ms
27ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRi2hFPtYZ86c1F7hOyqvA9skz6uC_yVvVvIuWiZXZ61y_dEl8GQJKIe3AlxDb9AKWIUMQlfwp9R3CpDMYuaojD7EfxPw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2732825802&adk=652042997&adf=2125223602&pi=t.ma~as.2732825802&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337882&bpp=2&bdt=280&idt=319&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=1049&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&xpc=TADUTnXVU7&p=https%3A//cybernews.com&dtd=326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4BC1 190 KB
60 KB 131ms
33ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a67d82954e869f63863c01de1404e74d89722d7774b105176d253292b75b6aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61127
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1699274420466708"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Nov 2023 16:02:18 GMT

GET
H2 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/ Frame 4BC1 36 KB
14 KB 115ms
67ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2643055468a1998ead0119c96cf7865c023e0b2723bb1009a201d79044ce5221

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:04:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71859
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14682
x-xss-protection: 0
server: cafe
etag: 11032495276070724100
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:04:39 GMT

GET
H2 200 publishertag.prebid.136.js Show response
static.criteo.net/js/ld/ 94 KB
30 KB 157ms
53ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.136.js

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/5774

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

ed3dc50aa8e28ea856d113dfbd2bd12dbb09ceb4381f2bdf8dba7b14b2a00108

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 07 Nov 2023 09:08:30 GMT
server: nginx
etag: W/"6549fe8e-17704"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 09 Nov 2023 16:02:18 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 8E8B 143 B
166 B 27ms
24ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2732825802&adk=652042997&adf=2125223602&pi=t.ma~as.2732825802&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337882&bpp=2&bdt=280&idt=319&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=1049&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&xpc=TADUTnXVU7&p=https%3A//cybernews.com&dtd=326
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3135
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 15:10:03 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 redir.html Show response
p4-gidz3q2355n2a-r25fzgi7mt7gbnu5-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 7448 247 B
867 B 197ms
56ms Document
text/html 142.250.184.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-gidz3q2355n2a-r25fzgi7mt7gbnu5-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f3.1e100.net

Software

sffe /

Resource Hash

935f1d2b3a97bbe7f061a0661519e8fb2229c8eacfc73b9b2a78dd338891e85d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 202
content-security-policy-report-only: script-src 'nonce-bE3DEti0_nkf0oUNLOMDCA' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 16:02:18 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Tue, 07 Nov 2023 06:08:00 GMT
pragma: no-cache
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0DE7 1 KB
643 B 39ms
35ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 85221
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 16:21:57 GMT
etag: 48472445140208031
expires: Wed, 08 Nov 2023 16:21:57 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311020101/ 160 KB
55 KB 98ms
70ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311020101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dcb27378f3a6aaed99f68ca8bc81cc083561aba44bbf878da18372afab044b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:18 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55821
x-xss-protection: 0
server: cafe
etag: 1683054841143277588
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Nov 2023 16:02:18 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/ Frame 5081 23 KB
9 KB 49ms
31ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=9812672228&adk=3541318952&adf=1004996698&pi=t.ma~as.9812672228&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337885&bpp=1&bdt=283&idt=367&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4558&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=yEOzzq4M2D&p=https%3A//cybernews.com&dtd=372

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8b1cd2613a5b066023f3aee22ea0cd501c2fb10eccaece8de94114f659c0d61f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:02:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71994
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9286
x-xss-protection: 0
server: cafe
etag: 5170786266788330719
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:02:24 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 5081 8 KB
1 KB 101ms
28ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

98d2e3edd14aa506c4521125c7cdb7bb3030d7caae5803feec6d2613195ee955

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 08 Nov 2023 16:02:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:37:14 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Nov 2023 16:02:18 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/ Frame 5081 15 KB
3 KB 82ms
18ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/outstream.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29c99771c81466150d55d307a9b0e12cfdab8240a9c65a80b764c1d58965406f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 14:01:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 180053
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2920
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 11:36:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2024 14:01:25 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/ Frame 5081 376 KB
131 KB 83ms
19ms Script
text/javascript 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/outstream.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c9ee4bf9f0e069ecf0037a5cde67640a7a323072f95efeecea32fb7177a518d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 14:01:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 180053
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 133662
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 11:36:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2024 14:01:25 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/ Frame 5081 20 KB
8 KB 47ms
30ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee46bdadc83beb5e76bce18bc7cc3d169c7f0490901f6be96ec41ee2c14d3776

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:02:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71994
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8543
x-xss-protection: 0
server: cafe
etag: 18034338113832500900
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:02:24 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 5081 0
0 36ms
30ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTKd5fnfnmkFVHj2-P9kC9cF4RrLdMJUENWCKTwFiTVnrxL1nYndKzIWhf-z6frHafQyAzdlKQMQxD9b2tOp65eCEGSeQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=9812672228&adk=3541318952&adf=1004996698&pi=t.ma~as.9812672228&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337885&bpp=1&bdt=283&idt=367&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4558&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=yEOzzq4M2D&p=https%3A//cybernews.com&dtd=372
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 171F 0
42 B 128ms
39ms Script
text/plain 198.47.127.19
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=13453103&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.19 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:17 GMT
content-length: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 8E8B
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

37ms
36ms

Document
text/html

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 16:02:18 GMT
expires: Wed, 08 Nov 2023 16:02:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 16:02:18 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4BC1 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2b8f6dccf79e1a4c54767f6d4214ce5e64a20ab3fa500359aaab45a6519049ee

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0DE7
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEGTw6ytLg9Xkg7Gk4eeWc8Y&google_push=AXcoOmRrZElBHl6l4Ka-wPhFFUyrsxkXZMEKlJPPnPeO_1xCmLmEkYBiv6...

170 B
188 B

30ms
29ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEGTw6ytLg9Xkg7Gk4eeWc8Y&google_push=AXcoOmRrZElBHl6l4Ka-wPhFFUyrsxkXZMEKlJPPnPeO_1xCmLmEkYBiv6m3j9G1g7_qF0G_pnS5o4upQbF3eFhSJRKlAbrMivRxO2A

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-cph2320040-CPH
pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1699459339.863470,VS0,VE96
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEGTw6ytLg9Xkg7Gk4eeWc8Y&google_push=AXcoOmRrZElBHl6l4Ka-wPhFFUyrsxkXZMEKlJPPnPeO_1xCmLmEkYBiv6m3j9G1g7_qF0G_pnS5o4upQbF3eFhSJRKlAbrMivRxO2A
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 0DE7
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEPyLWM-sozO5yb_MzwwHipI&google_cver=1&google_push=AXcoOmQ63v_KSdiQJ8U-ogHfYHO1Wx4ji-VzopEaIBRDxkO1ksVA4W5RmrIw73pUTtd8MKleyZWMAAoqJX2fYSkg2kvSKQNmdX9tjsE
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmQ63v_KSdiQJ8U-ogHfYHO1Wx4ji-VzopEaIBRDxkO1ksVA4W5RmrIw73pUTtd8MKleyZWMAAoqJX2fYSk...

170 B
232 B

30ms
30ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmQ63v_KSdiQJ8U-ogHfYHO1Wx4ji-VzopEaIBRDxkO1ksVA4W5RmrIw73pUTtd8MKleyZWMAAoqJX2fYSkg2kvSKQNmdX9tjsE

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 08 Nov 2023 16:02:18 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmQ63v_KSdiQJ8U-ogHfYHO1Wx4ji-VzopEaIBRDxkO1ksVA4W5RmrIw73pUTtd8MKleyZWMAAoqJX2fYSkg2kvSKQNmdX9tjsE
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 07 Nov 2023 16:02:18 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 0DE7 70 B
149 B 140ms
42ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESENjI18cO8AkWm0p_ZniE4JQ&google_cver=1&google_push=AXcoOmS2ywXIbbe7s_Uox86JnXUm8OIFt1eLJTMbkt5WSuxKXEXYopLitLzu3LEt6U1bzMu6suCuk7Ms8g77nml8AtqjmUH8LoEELA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2732825802&adk=652042997&adf=2125223602&pi=t.ma~as.2732825802&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337882&bpp=2&bdt=280&idt=319&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=1049&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&xpc=TADUTnXVU7&p=https%3A//cybernews.com&dtd=326
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:18 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2 200 sync
x.bidswitch.net/ Frame 0DE7 43 B
146 B 68ms
18ms Image
image/gif 3.123.196.74
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEPZQ_p3f3PdbAGFW3xRvTrk&google_cver=1&google_push=AXcoOmTELjMIEK5awtRD5qXgsU9ba81ZHnO8D6yw-mRcZTGrd5baLwYa1qWdhsat_cYKPHc7ZKTZIx2iA6DHu5VeV5OHtDX3ESawxg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2732825802&adk=652042997&adf=2125223602&pi=t.ma~as.2732825802&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337882&bpp=2&bdt=280&idt=319&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=1049&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&xpc=TADUTnXVU7&p=https%3A//cybernews.com&dtd=326
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.196.74 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-196-74.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:18 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0DE7
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEOwCQnzAKDqEz5sDSBYMvd4&google_cver=1&google_push=AXcoOmQ_lW1W_wqwXPxZ8zPNptVbI6NnLCe0rwtguBntS3VoLNou7g3QwqIVEwK9PlF4LDN_Pt_nEE3Y...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEOwCQnzAKDqEz5sDSBYMvd4&google_cver=1&google_push=AXcoOmQ_lW1W_wqwXPxZ8zPNptVbI6NnLCe0rwtguBntS3VoLNou7g3QwqIVEwK9PlF4LDN_Pt_...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMjQ4ODk4MzMxMzc3NjgyNA&google_push=AXcoOmQ_lW1W_wqwXPxZ8zPNptVbI6NnLCe0rwtguBntS3VoLNou7g3QwqIVEwK9PlF4LDN_Pt_nEE...

170 B
188 B

32ms
32ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMjQ4ODk4MzMxMzc3NjgyNA&google_push=AXcoOmQ_lW1W_wqwXPxZ8zPNptVbI6NnLCe0rwtguBntS3VoLNou7g3QwqIVEwK9PlF4LDN_Pt_nEE3YCuVRn_0mAELieJUVNqp6ag

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMjQ4ODk4MzMxMzc3NjgyNA&google_push=AXcoOmQ_lW1W_wqwXPxZ8zPNptVbI6NnLCe0rwtguBntS3VoLNou7g3QwqIVEwK9PlF4LDN_Pt_nEE3YCuVRn_0mAELieJUVNqp6ag
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 0DE7
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEF68YPVf-kszXq1QSC8TYT8&google_cver=1&google_push=AXcoOmRnhvkZrUV-9IZmVMaUuHyI5cPa28bwkxZiwrWEwJINjCC10v4uXdQkvy5plHrOo6B4m_nGO3NOuXct...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRnhvkZrUV-9IZmVMaUuHyI5cPa28bwkxZiwrWEwJINjCC10v4uXdQkvy5plHrOo6B4m_nGO3NOuXcteWxMk0mcebFsxEbIdNo

170 B
329 B

30ms
28ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRnhvkZrUV-9IZmVMaUuHyI5cPa28bwkxZiwrWEwJINjCC10v4uXdQkvy5plHrOo6B4m_nGO3NOuXcteWxMk0mcebFsxEbIdNo

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRnhvkZrUV-9IZmVMaUuHyI5cPa28bwkxZiwrWEwJINjCC10v4uXdQkvy5plHrOo6B4m_nGO3NOuXcteWxMk0mcebFsxEbIdNo
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2

200

report
sync.teads.tv/um/ Frame 0DE7
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEAR7sggaqql1...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmS8ObKIo5fVro1hhf307cDggh6qsQ1HZnKHPs89j-ubYoahS2SZmx-KeiiWDhIj4Six6gDl1G-UXIy4e2aJv6QpD7pnc_excFTJ
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

47ms
46ms

Image
image/gif

23.32.185.35
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2732825802&adk=652042997&adf=2125223602&pi=t.ma~as.2732825802&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337882&bpp=2&bdt=280&idt=319&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=1049&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&xpc=TADUTnXVU7&p=https%3A//cybernews.com&dtd=326
Protocol: H2
Server: 23.32.185.35 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-35.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

expires: Wed, 08 Nov 2023 16:02:18 GMT
pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 0DE7 0
130 B 92ms
34ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ia635i22uV1fLN10PsExo9dJH9ITP7qgLGcfq8t8XZyuvcBsrVpgij6KjBLEhR80s_hmayQg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:18 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/ Frame 0121 10 KB
4 KB 20ms
20ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

626c65063bcb00fcc4574cffc418820fc209794a0519ec1e65931896c79a6ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 17356
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4502
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 11:13:02 GMT
etag: 251720774729838433
expires: Wed, 22 Nov 2023 11:13:02 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/ Frame 3B47 10 KB
4 KB 20ms
19ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

626c65063bcb00fcc4574cffc418820fc209794a0519ec1e65931896c79a6ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 17356
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4502
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 11:13:02 GMT
etag: 251720774729838433
expires: Wed, 22 Nov 2023 11:13:02 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/ Frame 9F4E 10 KB
4 KB 20ms
19ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

626c65063bcb00fcc4574cffc418820fc209794a0519ec1e65931896c79a6ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 17356
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4502
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 11:13:02 GMT
etag: 251720774729838433
expires: Wed, 22 Nov 2023 11:13:02 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 publishertag.prebid.136.js Show response
static.criteo.net/js/ld/ 93 KB
30 KB 144ms
70ms XHR
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.136.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.136.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0c1ce1aa8e07e9cd49cd881147c0495b5c636dab10ab1c30ceb935b74a8c0ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 19 May 2023 17:15:21 GMT
server: nginx
etag: W/"6467aea9-175c4"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 09 Nov 2023 16:02:19 GMT

GET
H2 200 container.html Show response
108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 8E03 6 KB
3 KB 21ms
19ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311060101/pubads_impl.js?cb=31079511

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 16:02:18 GMT
expires: Thu, 07 Nov 2024 16:02:18 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 iframe.html Show response
p4-gidz3q2355n2a-r25fzgi7mt7gbnu5-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 7448 5 KB
2 KB 58ms
57ms Document
text/html 142.250.184.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-gidz3q2355n2a-r25fzgi7mt7gbnu5-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html

Requested by

Host: p4-gidz3q2355n2a-r25fzgi7mt7gbnu5-if-v6exp3-v4.metric.gstatic.com
URL: https://p4-gidz3q2355n2a-r25fzgi7mt7gbnu5-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f3.1e100.net

Software

sffe /

Resource Hash

5bac692cfb83932e3c6d6aa8702b47d2233840878bbab8fb4b4173067005e919

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://p4-gidz3q2355n2a-r25fzgi7mt7gbnu5-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 1986
content-security-policy-report-only: script-src 'nonce-jybSVNDiAKQxU15xPTfKvg' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 16:02:19 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Tue, 07 Nov 2023 06:08:00 GMT
pragma: no-cache
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/ Frame 0B32 23 KB
9 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2895910089&adk=4004477476&adf=3455423724&pi=t.ma~as.2895910089&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337886&bpp=1&bdt=284&idt=398&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4019e175c95576ce%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MbRkZpwDWvwgImp4hT4MxuOzfwlyg&gpic=UID%3D00000ccc31a35fda%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYOaxCzChjXiL5NQ3guXhLuXwECNQ&prev_fmts=0x0%2C749x280%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4766&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tz4yikkSlt&p=https%3A//cybernews.com&dtd=736

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8b1cd2613a5b066023f3aee22ea0cd501c2fb10eccaece8de94114f659c0d61f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:02:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71995
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9286
x-xss-protection: 0
server: cafe
etag: 5170786266788330719
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:02:24 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 0B32 8 KB
846 B 42ms
39ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2895910089&adk=4004477476&adf=3455423724&pi=t.ma~as.2895910089&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337886&bpp=1&bdt=284&idt=398&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4019e175c95576ce%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MbRkZpwDWvwgImp4hT4MxuOzfwlyg&gpic=UID%3D00000ccc31a35fda%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYOaxCzChjXiL5NQ3guXhLuXwECNQ&prev_fmts=0x0%2C749x280%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4766&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tz4yikkSlt&p=https%3A//cybernews.com&dtd=736

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

98d2e3edd14aa506c4521125c7cdb7bb3030d7caae5803feec6d2613195ee955

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 14:03:39 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Nov 2023 16:02:19 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/ Frame 0B32 15 KB
3 KB 33ms
31ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/outstream.min.css

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2895910089&adk=4004477476&adf=3455423724&pi=t.ma~as.2895910089&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337886&bpp=1&bdt=284&idt=398&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4019e175c95576ce%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MbRkZpwDWvwgImp4hT4MxuOzfwlyg&gpic=UID%3D00000ccc31a35fda%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYOaxCzChjXiL5NQ3guXhLuXwECNQ&prev_fmts=0x0%2C749x280%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4766&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tz4yikkSlt&p=https%3A//cybernews.com&dtd=736

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29c99771c81466150d55d307a9b0e12cfdab8240a9c65a80b764c1d58965406f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 14:01:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 180054
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2920
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 11:36:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2024 14:01:25 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/ Frame 0B32 376 KB
131 KB 34ms
32ms Script
text/javascript 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/outstream.min.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2895910089&adk=4004477476&adf=3455423724&pi=t.ma~as.2895910089&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337886&bpp=1&bdt=284&idt=398&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4019e175c95576ce%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MbRkZpwDWvwgImp4hT4MxuOzfwlyg&gpic=UID%3D00000ccc31a35fda%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYOaxCzChjXiL5NQ3guXhLuXwECNQ&prev_fmts=0x0%2C749x280%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4766&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tz4yikkSlt&p=https%3A//cybernews.com&dtd=736

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c9ee4bf9f0e069ecf0037a5cde67640a7a323072f95efeecea32fb7177a518d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 14:01:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 180054
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 133662
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 11:36:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2024 14:01:25 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/ Frame 0B32 20 KB
8 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2895910089&adk=4004477476&adf=3455423724&pi=t.ma~as.2895910089&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337886&bpp=1&bdt=284&idt=398&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4019e175c95576ce%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MbRkZpwDWvwgImp4hT4MxuOzfwlyg&gpic=UID%3D00000ccc31a35fda%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYOaxCzChjXiL5NQ3guXhLuXwECNQ&prev_fmts=0x0%2C749x280%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4766&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tz4yikkSlt&p=https%3A//cybernews.com&dtd=736

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee46bdadc83beb5e76bce18bc7cc3d169c7f0490901f6be96ec41ee2c14d3776

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:02:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71995
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8543
x-xss-protection: 0
server: cafe
etag: 18034338113832500900
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:02:24 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 0B32 0
0 55ms
54ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSUVucddn1XKGGS_aMVcYWI3rl0NbXPSGDNJRSgW5IbjjjZHvoiRpq1561nTq346xNVE8uv01cZDdnGmUPIc8RNI_OhTw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2895910089&adk=4004477476&adf=3455423724&pi=t.ma~as.2895910089&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337886&bpp=1&bdt=284&idt=398&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4019e175c95576ce%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MbRkZpwDWvwgImp4hT4MxuOzfwlyg&gpic=UID%3D00000ccc31a35fda%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYOaxCzChjXiL5NQ3guXhLuXwECNQ&prev_fmts=0x0%2C749x280%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4766&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tz4yikkSlt&p=https%3A//cybernews.com&dtd=736
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

GET
H2 200 css2
fonts.googleapis.com/ Frame 0121 4 KB
744 B 32ms
31ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 14:15:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Nov 2023 16:02:19 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 0121 205 B
651 B 87ms
27ms Image
image/png 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 07:29:06 GMT
x-content-type-options: nosniff
age: 203593
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 05 Nov 2024 07:29:06 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 0121 604 B
696 B 87ms
28ms Image
image/png 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 13:30:38 GMT
x-content-type-options: nosniff
age: 527501
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 01 Nov 2024 13:30:38 GMT

GET
H3 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/elements/html/ Frame 0121 15 KB
7 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ccc4eb3e8c138e0ac4c09d09e765d3228f6fdf29b134613b5a2331c47b39aef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 22:17:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 63871
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6703
x-xss-protection: 0
server: cafe
etag: 18125926408851158271
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 22:17:48 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/elements/html/ Frame 0121 21 KB
9 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bfd4745fee7e2635754df4ff32e620ff7356b538283d881968cf48255db8eebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:14:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 67642
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8785
x-xss-protection: 0
server: cafe
etag: 17726888854999048520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 21:14:57 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 96B1 624 B
242 B 76ms
62ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjT7bvGATAB&v=APEucNW8L58yKRiWQnItT29JjDN3WXPiAm7CFjLVSPOZHVP2UoAt7Jpub9p-BRHW2FFEpsXIgjM5fr0NkBh6mrcr0LaaQRquKjLsyxJ3a2nLnf4RITy9zOsLZMLNpU7bf5fy8Ct4u2QDTRm6oCWV2WBcSKZv_wJN0rqS2xhwVu2ShpdIgKU4rgE

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 16:02:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame BB16 92 KB
32 KB 121ms
107ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3420da2b260abe345161cc29857cbbc84426d366c896a1738302e7aa56e9496

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32794
x-xss-protection: 0
server: cafe
etag: 4863332729753539511
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 08 Nov 2023 16:02:19 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/ Frame BB16 3 KB
1 KB 32ms
18ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/window_focus_fy2021.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 08:32:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27017
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Nov 2023 08:32:02 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/ Frame BB16 20 KB
8 KB 33ms
19ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee46bdadc83beb5e76bce18bc7cc3d169c7f0490901f6be96ec41ee2c14d3776

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:02:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71995
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8543
x-xss-protection: 0
server: cafe
etag: 18034338113832500900
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:02:24 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame BB16 0
0 42ms
28ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQuB93A_eAGBi3SKpSyn2fVYCkQv07pOENbZsdC0fF5488jlV2fYaw5iQAVPgQJQboPQ7dDeQh3DhI__izarkj8_ZFZ-w
Requested by: Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BB16 190 KB
60 KB 75ms
49ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a67d82954e869f63863c01de1404e74d89722d7774b105176d253292b75b6aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61127
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1699274420466708"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Nov 2023 16:02:19 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame BB16 42 B
63 B 64ms
52ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BvfL8aUAuN2YIfqnE_Sz_UBkozH-LFjah-BBXOalkQ3jBGWQa7sg6SWAM6omcTDJQNXZ1l0H_NdCjeQanNorZAba44_Ic95oefWDX2GePu9C2WRYw

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BB16 0
20 B 65ms
53ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=8196432674232524589&x=1&ct=77

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3992 624 B
242 B 68ms
60ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjT7bvGATAB&v=APEucNVo8DtCH9G4GFPuHNjg5IT67hZiJTCewkRvhZtVPUoKEbfc70Zv7VCzUoCoCuzK4z345ns8EKaJlsP4VhvtL5Vw4xEAVSzjA1z8QgP3X1o0U0oobMvQhgwGELymVPKJLb3WCKAvvoBM8Eq4hKHyjrXrxvK08BVwGv2bxGzNQyrHr8Yqz3s

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 16:02:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame C50A 89 KB
31 KB 176ms
167ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 08 Nov 2023 16:02:19 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/ Frame C50A 3 KB
1 KB 27ms
19ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/window_focus_fy2021.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 08:32:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27017
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Nov 2023 08:32:02 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/ Frame C50A 20 KB
8 KB 28ms
20ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee46bdadc83beb5e76bce18bc7cc3d169c7f0490901f6be96ec41ee2c14d3776

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:02:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71995
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8543
x-xss-protection: 0
server: cafe
etag: 18034338113832500900
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:02:24 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C50A 0
0 36ms
28ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR79wRzTlhY_c-ukxHb8nBcAPdeSFfmtWmx4O8drgs5x3zLDKTJuGIEtPji5TsOq6nK6_rJs4zJ-qcAtzHLqrsCo4JrcQ
Requested by: Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C50A 190 KB
60 KB 73ms
62ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a67d82954e869f63863c01de1404e74d89722d7774b105176d253292b75b6aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61127
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1699274420466708"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Nov 2023 16:02:19 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C50A 42 B
63 B 58ms
51ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Ao0zXs6q8ByYYUW7gOjv8D_KIPQ96Xacq7_XtHNUOxrgHPIDwF7kZPykbLs_6fZhdeOM6FS-7ocL_TsnwCJwoJbqhls37cCJq13WOYa4AeeevGxeA

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C50A 0
20 B 59ms
53ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=14487535150792728339&x=1&ct=77

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 5081 0
234 B 109ms
44ms Ping
image/gif 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~lopy7mdk&c=3070742655433&slotId=1535371327716.5&qqid=CPWTrrHjtIIDFczw7QodQ2AHCQ&fb=outstream-lima&sei=44752538%2C75259414%2C420706098&nsei=44714510%2C44729911%2C44730425%2C44730426%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 5081 15 KB
16 KB 82ms
26ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 18:18:43 GMT
x-content-type-options: nosniff
age: 164616
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2024 18:18:43 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 5081 15 KB
16 KB 72ms
21ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 19:40:17 GMT
x-content-type-options: nosniff
age: 159722
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2024 19:40:17 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5081 0
20 B 68ms
66ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CpnmMCrFLZfXmEszhtwfDwJ1Iwd-4h3SBmur7ihLwLhABILbX6XtglYKAgKAHyAEFqQI09vlQz-SxPqgDAcgDmwSqBKQCT9BvTKRDwDlMVWjnzsLopJmWKOs4XX6jUUj7ExGJgAtrTbZg1cOZoH-onQrLhOOgudtNYeRzorwtwzAOkmgrW739vDJSRJzMMfQ0Z1S09mL1AUubefm0IsV4meRf36KRgmsDqCmB787mwrJMxnjx8hKo3x8pEFpYlRKfnJb-NkBpJOjlIRkH7qqYO0ah2zkDJ_lE8YH6sOkR8E3Hxpo8eJkH56zk-8BiZxqCaBMEOXA4dxAyJ1Tv8tpM93BOuYMZuAWSxh0Lu4x0NFUzM4Z_urn0HKu78J0qdX2IdjpupEK7SzK7QV_phfeZ-p1cIxMizXXXVzmkMm5k6mao1cuhZ9D5IINrx8879FTojMb0ItjpCxWfDQs6lQwrJ4X5-3WqFdY7gcAEp8exkMQE4AQDiAXd2MOoTZAGAaAGdoAHrdP9mgWoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAcgLAeALAYAMAaoNAkRFsBPJqbQVyBPSue7jA9ATANgTCogUBtgUAdAVAfgWAYAXAegXBQ&eventType=clickstring&clientTime=1699459339102&ai=CpnmMCrFLZfXmEszhtwfDwJ1Iwd-4h3SBmur7ihLwLhABILbX6XtglYKAgKAHyAEFqQI09vlQz-SxPqgDAcgDmwSqBKQCT9BvTKRDwDlMVWjnzsLopJmWKOs4XX6jUUj7ExGJgAtrTbZg1cOZoH-onQrLhOOgudtNYeRzorwtwzAOkmgrW739vDJSRJzMMfQ0Z1S09mL1AUubefm0IsV4meRf36KRgmsDqCmB787mwrJMxnjx8hKo3x8pEFpYlRKfnJb-NkBpJOjlIRkH7qqYO0ah2zkDJ_lE8YH6sOkR8E3Hxpo8eJkH56zk-8BiZxqCaBMEOXA4dxAyJ1Tv8tpM93BOuYMZuAWSxh0Lu4x0NFUzM4Z_urn0HKu78J0qdX2IdjpupEK7SzK7QV_phfeZ-p1cIxMizXXXVzmkMm5k6mao1cuhZ9D5IINrx8879FTojMb0ItjpCxWfDQs6lQwrJ4X5-3WqFdY7gcAEp8exkMQE4AQDiAXd2MOoTZAGAaAGdoAHrdP9mgWoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAcgLAeALAYAMAaoNAkRFsBPJqbQVyBPSue7jA9ATANgTCogUBtgUAdAVAfgWAYAXAegXBQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 5081 0
54 B 86ms
45ms Ping
image/gif 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~lopy7mg0&c=3070742655433&slotId=1535371327716.5&qqid=CPWTrrHjtIIDFczw7QodQ2AHCQ&fb=outstream-lima&ulv=1&cll=0&met.4=arp_a_s.o1&vast_v=4.0&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 5081 32 KB
18 KB 190ms
117ms XHR
text/xml 64.233.184.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-AlOdq-xqG9AL0lIIgcxvc274dlYCX9T3JX5J3bMrEY_ccuHmh0hgO2jpmLSORIqw_5KZOzA-_KDex3SxTWxTDnG9hSwQ&cry=1&dbm_d=AKAmf-CLeStltr-GLUElEwz5yXcdYy0YljyKoY6X9HWhFZaxduOBZOFtvsYjJXvjDC3pq9qe8N3grhKN6xalIGF2xPtEeIGqSkUO3GwFZjgJT4tCVnm5ZZqC-QAWDTE8D7LEnxDdMH7gTMMWP5-CxRf9-q1tnRaLbezoSzEkekPXNonotopFVYRpD11sSjF_-iklhRB_ReZxxskHFgnXg1-j-7Ba5gvhk1fDV3CKZj2RfQCcq0zeuELO4rzWtUrWYBnxFU92L2B_7T-T29ez9lEFAVeGoVbRgY8yWVXeT1ReqVpGCaQ45DQE8izsGLA2KLPtrK-W5yCwdqxTwSanQb8f1ch6QVPH-suN8TznIL3ugbOUAFTsMwMLM7BBwryLdQpHQCI9Z19I4kuiUFkxiv0fw69ph1JXHl1EJpdYmTwrdqVvMxZhlXxT9n6-SaBTsQk_CTjfzKxi92MiM3Cq68nz3Ub9EEEqSMcUAtUJDBd8rIeGGvwiq33oGVm7F6DdDYYwpJUbCNteJjWy_sfy25PvkPNH-RX5zX5yr9yNPA33gDvmUDRsS00WOXxzxHuQiGMjxsuGKnq37a8w_LyhHJDIg7HO0e00X-u-Kg1QqZabJV0cUeIdu-mueoIGqk8izYXv6UMISYHuadNfvQuhu7NZTQ0md1pe5aTfsvYCaAj2PTHBdVVoXBG_AuQLZ2B6ACE1ogPn8I6MTEE4smTcn5r0OJnwAVZwDnxFcejuN-wl8OHAgdQ4k0vjBz77HiA_cBsVF62pa_pRgDc37gkRiPcVgq5OIZvSwy1aVBiCNjw3MCsTQK4VU6vnNxpdFBdZJAhwBQuG90eFcKjK1oIUVTqRnBVK09369PiU0Igf_A4VajJOFZn7xsgflmi10gyvg2GOGs4tlT_4FdqAyZQE-G6xPVLTa--J3tYk2ECo0YPmhju1RI0LfgtKsDTPTkqSpGSClN_3w_lj7cB233Q8h2SCurJE_vqE92zlQauwFcVAF_JHV0ihJcVSe34aZWKARdiPNkuYt5RiVkcXF4SDKw9LfXo7r9ea-49d6J6_1PqYog6VQY6sLufWVKhcceRnYy4f4FfkgJV7QoocmabP53qkwu0b14px2zGrt1G6-NWI-Ru1JsZDR6JDqjZeTDs0ygmCGYbbZ_Ce7sCx__br35YIzaz4siYZod6BkCP219qmc4jn8OWwpU6TgXGFlexuBv1JkviAEUzNJlVI9LqIQopBx0G6ecmT2ig5TXGrFnZ3_2Uq2R-IhbrzXMTyAIrzSq8VBKlEvJhee8nurz1JgjTSVC5IFugUF0GtpCr-GWTk9Fj08elXZg917LINPIXqI-vKTkgDx6tnYaVePB6vUby3UXuBWcJPmyZaEeojsit_02-OZIyeOJQlg4OoTXy9MxYPjLYODVGIG0RNXLB7cR3zKp4stxyQPgVCPxh5l3QPnoG5y2i40Cnfe33fcgISQFFSk7MbNoQbzB1W0xVMvPUM0AL0w4PRmmkzjmIG-v2f9loG86WdOQAW-TXULTfJ6_gVGWeqxJaAQm9Ztlb1cSOkrLpxsMBQalJ8nnt4DB0M_X6mt2AplmcU-6DMelKkaCHs1nm71fyq66esF0YHK38hr0EabtWTqJ1CXi0y7bb9taK4L0GEs2NNWJKu9XR7ODMbPdoSYXep_jCcfm2okH5ZUHgaxSkJmrzHT27WZNCIR50pxpsFQclJVOmOewIQl9LUkcx8saDsrzZJvVmdWMBx_uT2nqz6xqyq6HvbLAwsHRM6e_UK5fpz1A3iovXQVwQNhaIeXcNl6o1SbsdHRrgEO3ufi183-vnwrNhrjn-UBkE_gk-UZk4-e1jfsOmOd05NUMMbe3l-fGSujLe55tLDimvzZeLkDvFZ5uznQPuDYtI2GweJM25eQWAjutpT81sIrbNhjf9o9gr633_be9wNxxqxDbeUxgBbr_sGFPplXQriZ4b6V4Sl994EJubMJ45MzGwLIiB3Fxkv4HZ1mZD96_BOqoc-39ighMV2nEWUIN4WwU6dVpyHtBcmupEIKQcQqxv7iOAUufjD-dIaKzTVRV6qqeH-NQ_fbVSO8yiSj1R3qGGV8CKB-UmsvCUhKX3Q-fDWt95zNnrDhJsWhfVMmwr5m_9hBpsEcVZs_pzcEHuJZNYMcTtKY7dnJILcEiDmbsf2ug6mSYYhfdgOOF70r5bYFLy4oDekX0GCinOJGhrE0oupcrX10m5kA3kpJAwwEx233_-hgDFK_3Esd87pIcjdp-wI7s2TacBCtReNhM8HPw8OPuam2Er2nDv97cU_1-Q1b_5tLs21h4KRjDiyNUfs9Jfp8lHio-TIG-kHK_B0o7mLR6RFa3YBZ0ZSTmwjwsowC3on3XySxLsoKiawS9e7DPOvaEwIAjTZWJuGbQGn0OtLSUca4HumxjyC7jWidO5S_aQsX-17ij8ge9ek-Yf6wmDY2m7geTv-GGLogkILhJjnW4Swh107x7cBLYdCf2sOPxcPFWiKZnWjd1jLZNIHDqlWFFOT-BALTi-_geNwgf6B7-2rzsua_tKsCwzyW_q7SmmiX04bdgl7RIffAuApCSbAw2ACoCmuPVp9Ff3bvRSG1QPpVTu9hkygc5q_h3MGcOIXhvR0E-ZULV6LuhKlLXRXK1wDPJAeXfzdLcN1fHKRdvyy9onscFdNITQPgV6Mb74j9OCaGEf4xSb258yQEN-ONGViU7_afGDljIwkFfCkyJXt-V4Xmk_iEC8vngRvp3EIcJ_uwDE2fLFUhH5QNaVp-JYtKEKQocx0bGyJwjCLAjYbVScf-8HjCGaonuzbpTU1aMirhjfbWEz85gakm-NKW88h0dOAf7cYbc-I2t-XBnhgTSRpkmNYT3l7nnpk3yb8wvx93gNGICWaxvE_FtsXh0VEwUkxuvYCeX-evBR4mVXw45G1M5IMEo4eX88ysg8G-62hGY5LiaSmQIGmACtz2n4MgBbaZbsK50kO5a5-ST7x8ctwNi66yCmNKcDnvRKg4c3nfuGswAiQJKHlyK06JD8tGvcvbs32E93lpRgkpc5HaYLVGcuNPVUr1rYcq3fO4N7BDsSdkoyfvuPQCumwxX1l464bAJWoMKjy7hexhHBIIReMcn_tv8J_IDec_IvLhu85sPJGW7gRhXktlBUCKOH6cQQ-BJzS03pidQrMtN6j_nGaOMRMNe7EYgjN1RAGfD87KNBUZsW7tomrOXb7bNRWOQ0q5GJXT5gS71XxuTQ2debITXMH2Ql3decpzzrtCjIBG_-OI9GegjSC1IJGrR5rav_8w3RSHX6MBfl8NadWFflVhRJ9Mte3N4P2fWLokB2LMWve41UqDNv5Zjo3z-njaFYKLtWYM9M-DcJWHx1FEUbatiKP50lNoN950Kph93lG4f65wmjPmausF_eaX3IyfSKyWtiGmes0BtjXxsM5Jv5t40TKI6fPpAYm4jUQ01sSnK0UtpcvdhGzMwcQ97K4obdBwEx23-EWQEYXt5y5qFDUr5qo4OI5GNsy9V4AN7sRyDijvkBngJ_zZUDO_IFWyI01huKFpA2omylfowMPRzRlSKzWqOfooLJzVhh3_zh01E5eoVbV9bjVJ4FtvS1m7FB7Kgcxx0Vx3dFIwQBmdgc9m8KFGYVcK0aGOfbUG3oEOHkB7NlsMu2R3YLNQUe3SYeeeInR8sEgkIx_VnbLcEsfHO7Wp7jULItBfZ8A2kIH39Y1hzPj08MBBzBj5Sc6ke6VMsGVVcd_qDEw5Y9pgQQtnaO5Os7UEqlQDVcZ9IIKRBQmdx_FGckWCWnNuA&cid=CAQSOwDICaaNUvG-g4dBrxiTrGCL8B7NMI6DMZ23brYbGi3pBIfwiET0eiZqoZTH6WULeZAAAq8EjS_VQD80GAE&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1&nel=0

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.184.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wa-in-f154.1e100.net

Software

cafe /

Resource Hash

5bc7c92fc3e0fae77f4172e804cccf7a20489ebb98f142c84e9e357366b40f84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17387
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
No Content /
ap.lijit.com/beacon/prebid-server/ Frame 821D 0
0 32ms
29ms Document
text/plain 216.52.2.39
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon/prebid-server/?gdpr=&gdpr_consent=&us_privacy=&url=https%3A%2F%2Fprebid-stag.setupad.net%2Fsetuid%3Fbidder%3Dsovrn%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.39 New York, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date: Wed, 08 Nov 2023 16:02:19 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap7ams1

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame BD5F 640 B
262 B 63ms
60ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxia77vGATAB&v=APEucNXK5LB0gRo0kybo5KLlY_pbqBWk9XnJrKZEkfFerTFpcA_Lpk7gzr3oqnJyltrnawyUpXGW5llmRCTDyA3h1irN96mXx6Pv9vDwBfCeZ1MbP0Bi9u8jBiqSRzACJqwVY7_nWLwCF8-j_6kG1UplmN5Sfg3oI6IDmslCJIBaUYTBR5Qf980

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 08 Nov 2023 16:02:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 8E03 89 KB
31 KB 106ms
103ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 08 Nov 2023 16:02:19 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8E03 42 B
63 B 56ms
53ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B9VOHgKxbWKg9mE1mP3GALEG-CL7uU45YLN92atj95gYlW8PAxFe6Q0DfDJvPWikFn3-EFcRM4UyjwBrqO6dRyANcHdmtxfU7I2a1HVsFIlrQ21-U

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8E03 0
20 B 57ms
54ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=7945756343880056435&x=1&ct=77

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/ Frame 8E03 3 KB
1 KB 36ms
33ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/window_focus_fy2021.js

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 08:32:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27017
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Nov 2023 08:32:02 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/ Frame 8E03 20 KB
8 KB 35ms
33ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee46bdadc83beb5e76bce18bc7cc3d169c7f0490901f6be96ec41ee2c14d3776

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:02:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71995
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8543
x-xss-protection: 0
server: cafe
etag: 18034338113832500900
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:02:24 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 8E03 0
0 36ms
33ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSKyTHu5boXR-iOOoIfqbcXIxMkTWZAhh7i2k2kTaQnVJ6tHOSFLlsFIHPqypXUtkeLeLFj6ojAef_DEqC0MDe7Twxn2A
Requested by: Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8E03 190 KB
60 KB 63ms
61ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a67d82954e869f63863c01de1404e74d89722d7774b105176d253292b75b6aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61127
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1699274420466708"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Nov 2023 16:02:19 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame DECB 1 KB
643 B 29ms
19ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 85222
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 16:21:57 GMT
etag: 48472445140208031
expires: Wed, 08 Nov 2023 16:21:57 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 96B1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&C=1

43 B
326 B

52ms
50ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjT7bvGATAB&v=APEucNW8L58yKRiWQnItT29JjDN3WXPiAm7CFjLVSPOZHVP2UoAt7Jpub9p-BRHW2FFEpsXIgjM5fr0NkBh6mrcr0LaaQRquKjLsyxJ3a2nLnf4RITy9zOsLZMLNpU7bf5fy8Ct4u2QDTRm6oCWV2WBcSKZv_wJN0rqS2xhwVu2ShpdIgKU4rgE
Protocol: H2
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3turanhOWSzDJ7%2Bpu6AHsUfaVygUTR5hilMc2swWpwMLlWlR85BzxEUIs3TDWAqrR3NxV3r%2Bm60oqfjnKldPzeIXlKz%2BIMCahAXBPcNVViIQ11xAWH9CUqGTPrimEIiuROwgN%2FzGv8yS5A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 822f0a26ee5c39c1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G%2BTtE1JooDVr3YayheNyoJp3ZQmL9jfazIEUiQv3vWD4viXUYuKOmPoStDVV7%2FyuaK8l52aSYc5xUo3Mgqky8yWzHpOVs1Hwp8RpRTaj4oEGQmsedKNVPYJZ699%2F%2Ff3RJ86wENvzexQSZg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&C=1
cache-control: no-cache
cf-ray: 822f0a266d8939c1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 96B1
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZUuxC3IQQP-Km.B4CnTlUwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&google_hm=2

43 B
768 B

53ms
49ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjT7bvGATAB&v=APEucNW8L58yKRiWQnItT29JjDN3WXPiAm7CFjLVSPOZHVP2UoAt7Jpub9p-BRHW2FFEpsXIgjM5fr0NkBh6mrcr0LaaQRquKjLsyxJ3a2nLnf4RITy9zOsLZMLNpU7bf5fy8Ct4u2QDTRm6oCWV2WBcSKZv_wJN0rqS2xhwVu2ShpdIgKU4rgE
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NZswNKyejkxcJ9aUqx7U0QIUplPo3NJA2UfFRbAVlybMRp9dTSJfBQNF6pbC76ZZOlmDmvBOffVXlBxeteLrID5VL6ulR%2Bhl7kp8MbJc3AJhR9r7i9IwxjQPWdkyWglHctQxbaXtPk%2B1uA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 822f0a27bb6e39ce-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame 96B1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESENS47Hvb5SdoRQmdJAf4KWw&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESENS47Hvb5SdoRQmdJAf4KWw%26google_cver%3D1

43 B
891 B

66ms
52ms

Image
image/gif

185.89.210.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESENS47Hvb5SdoRQmdJAf4KWw%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjT7bvGATAB&v=APEucNW8L58yKRiWQnItT29JjDN3WXPiAm7CFjLVSPOZHVP2UoAt7Jpub9p-BRHW2FFEpsXIgjM5fr0NkBh6mrcr0LaaQRquKjLsyxJ3a2nLnf4RITy9zOsLZMLNpU7bf5fy8Ct4u2QDTRm6oCWV2WBcSKZv_wJN0rqS2xhwVu2ShpdIgKU4rgE

Protocol

Server

185.89.210.90 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
an-x-request-uuid: 30ea3741-63ef-40cb-8467-ffdb4b22a2b1
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 217.114.218.29; 217.114.218.29; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
an-x-request-uuid: ad45debc-a79d-4c95-8094-1873705fac59
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESENS47Hvb5SdoRQmdJAf4KWw%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 217.114.218.29; 217.114.218.29; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 96B1
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA3MjI1NzA3MjU0OTA3Nzk0NA%3D%3D

170 B
188 B

45ms
44ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA3MjI1NzA3MjU0OTA3Nzk0NA%3D%3D

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
an-x-request-uuid: bbc4705c-4d58-46a6-aa88-f0ff18424919
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA3MjI1NzA3MjU0OTA3Nzk0NA%3D%3D
x-proxy-origin: 217.114.218.29; 217.114.218.29; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 5081 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 42b502362dd947b478b75e3babd1c72395a4219edd293ce963ac8abe4e48794e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 3992
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&C=1

43 B
438 B

51ms
49ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjT7bvGATAB&v=APEucNVo8DtCH9G4GFPuHNjg5IT67hZiJTCewkRvhZtVPUoKEbfc70Zv7VCzUoCoCuzK4z345ns8EKaJlsP4VhvtL5Vw4xEAVSzjA1z8QgP3X1o0U0oobMvQhgwGELymVPKJLb3WCKAvvoBM8Eq4hKHyjrXrxvK08BVwGv2bxGzNQyrHr8Yqz3s
Protocol: H2
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h0muMMtWF2nCWchEx4EXkuyp%2FKoNIs5nR1hyCw%2Fld64qxeClPdYgirSxlmtI5AS9IBWHolDbYF0QLCCoxpZ2slFzeaMu3QFPRT5Sn%2FSwOsVCCqzrMt%2BgUhNIrnqaqdrY%2BNSBcwnf3xzBPA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 822f0a26ee5d39c1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JpMVuq1QKzHfcJjjFU5%2FZxzDz581LOxuTsZwgJOK1t%2Bg8GcpG4V7hu8EeOECrgLoA%2FtLiz8sRiGjPT5ExmRWckzbN2HyIJtTZpq6vi1bI8uyvmriL%2B0W7wzEIf9OYN%2FD9GmMaZP7P%2FIYCg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&C=1
cache-control: no-cache
cf-ray: 822f0a266d8b39c1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 3992
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZUuxC3IQQP-Km.B4CnTlUwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&google_hm=2

43 B
734 B

51ms
49ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjT7bvGATAB&v=APEucNVo8DtCH9G4GFPuHNjg5IT67hZiJTCewkRvhZtVPUoKEbfc70Zv7VCzUoCoCuzK4z345ns8EKaJlsP4VhvtL5Vw4xEAVSzjA1z8QgP3X1o0U0oobMvQhgwGELymVPKJLb3WCKAvvoBM8Eq4hKHyjrXrxvK08BVwGv2bxGzNQyrHr8Yqz3s
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sRTb6xxkIzjO5zfjWgR9BQt1r9hwuRQE8u2t4o2GI%2F%2BS0%2FsmUuPUB16NrNzwsclasUCvofexAzefdxuYE%2FySIma4DolvOLUEtKNAajMIfSn4lOjpd5ECknns38kVi8DeWOfk%2BZAOUanD3g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 822f0a27bb7239ce-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOKVcdZUOcm1w4L7fbFBJp8&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame 3992
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESENS47Hvb5SdoRQmdJAf4KWw&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESENS47Hvb5SdoRQmdJAf4KWw%26google_cver%3D1

43 B
891 B

63ms
49ms

Image
image/gif

185.89.210.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESENS47Hvb5SdoRQmdJAf4KWw%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjT7bvGATAB&v=APEucNVo8DtCH9G4GFPuHNjg5IT67hZiJTCewkRvhZtVPUoKEbfc70Zv7VCzUoCoCuzK4z345ns8EKaJlsP4VhvtL5Vw4xEAVSzjA1z8QgP3X1o0U0oobMvQhgwGELymVPKJLb3WCKAvvoBM8Eq4hKHyjrXrxvK08BVwGv2bxGzNQyrHr8Yqz3s

Protocol

Server

185.89.210.90 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
an-x-request-uuid: ce2a875b-dc90-4541-bfb8-7cdabca9000c
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 217.114.218.29; 217.114.218.29; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
an-x-request-uuid: 375b916c-9bfb-4ea5-a6f3-dacd1a1f0f97
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESENS47Hvb5SdoRQmdJAf4KWw%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 217.114.218.29; 217.114.218.29; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3992
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA3MjI1NzA3MjU0OTA3Nzk0NA%3D%3D

170 B
188 B

40ms
40ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA3MjI1NzA3MjU0OTA3Nzk0NA%3D%3D

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
an-x-request-uuid: 45a9f480-b1fb-48b7-84e6-3626e4024230
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA3MjI1NzA3MjU0OTA3Nzk0NA%3D%3D
x-proxy-origin: 217.114.218.29; 217.114.218.29; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 4BC1
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CMlAECrFLZe6YD5iMtwflpa2wAYiN9Yx0t4yOqvQR2dkeEAEgttfpe2CVgoCAoAegAYPArpUCyAECqAMByAPJBKoEqgJP0F96vWyZxGQNC2Mlyrmg7s3EIXscBWUjFdffNHE0HS7ElYeSK6D...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%221271557475478652936%22,%22debug_reporting%22:true,%22destination%22:%22https://cotosen.com%22,%22event_report_window%22:%2...

0
0

122ms
56ms

Fetch
text/css

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%221271557475478652936%22,%22debug_reporting%22:true,%22destination%22:%22https://cotosen.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22581672963%22],%224%22:[%2211-08%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225282313274206199873%22}&andc=true

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"1271557475478652936","debug_reporting":true,"destination":"https://cotosen.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["581672963"],"4":["11-08"],"6":["true"]},"priority":"500","source_event_id":"5282313274206199873"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 08 Nov 2023 16:02:19 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"1271557475478652936","debug_reporting":true,"destination":"https://cotosen.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["581672963"],"4":["11-08"],"6":["true"]},"priority":"500","source_event_id":"5282313274206199873"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame 8F20 2 KB
480 B 38ms
37ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins%3A400%2C600

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e537bb0b81601eabcdc6dd4e2eb938917a7c6887765651882ec0ed5081c26c67

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:27:58 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Nov 2023 16:02:19 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/ Frame 8F20 2 KB
822 B 24ms
24ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:02:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71995
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:02:24 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/ Frame 8F20 23 KB
9 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8b1cd2613a5b066023f3aee22ea0cd501c2fb10eccaece8de94114f659c0d61f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:02:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71995
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9286
x-xss-protection: 0
server: cafe
etag: 5170786266788330719
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:02:24 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/ Frame 8F20 3 KB
1 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 08:32:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27017
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 22 Nov 2023 08:32:02 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4174 1 KB
643 B 29ms
26ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 85222
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 16:21:57 GMT
etag: 48472445140208031
expires: Wed, 08 Nov 2023 16:21:57 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/ Frame 8F20 20 KB
8 KB 28ms
26ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231106/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee46bdadc83beb5e76bce18bc7cc3d169c7f0490901f6be96ec41ee2c14d3776

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:02:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71995
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8543
x-xss-protection: 0
server: cafe
etag: 18034338113832500900
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:02:24 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 8F20 0
0 31ms
29ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSMaHT3bFgfAElBkD-6p8uLCVBEqyBQ9FTkjLiBCRmRINCnm1UplqC5pMRnkmkVc8Cs8S1Nvvg3tSQZQ2hAuDPGQqhSwQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8F20 190 KB
60 KB 74ms
71ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a67d82954e869f63863c01de1404e74d89722d7774b105176d253292b75b6aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61127
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1699274420466708"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Nov 2023 16:02:19 GMT

GET
H2 200 ac1dbca482530a26bafc7a8c1241173a.js Show response
www.gstatic.com/mysidia/ Frame 8F20 36 KB
15 KB 23ms
20ms Script
text/javascript 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ac1dbca482530a26bafc7a8c1241173a.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cddb42bd69440699ae8fe758dac4d5f52911fa67b2a7a637d5d1bcfa2d88b0d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 19:58:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 417810
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15099
x-xss-protection: 0
last-modified: Wed, 01 Nov 2023 17:23:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 01 Feb 2024 19:58:49 GMT

GET
H3 200 QFuvQnGphQ6GO9QABj_Aqe7B_rJiyTlA9JcZ7sKm_jE.js Show response
pagead2.googlesyndication.com/bg/ Frame FAB0 50 KB
19 KB 29ms
25ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/QFuvQnGphQ6GO9QABj_Aqe7B_rJiyTlA9JcZ7sKm_jE.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

405baf4271a9850e863bd400063fc0a9eec1feb262c93940f49719eec2a6fe31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 592732
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19777
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 31 Oct 2024 19:23:27 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame BD5F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFnUygyHT_pzqgRfItPCf3I&google_cver=1

43 B
264 B

45ms
43ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFnUygyHT_pzqgRfItPCf3I&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxia77vGATAB&v=APEucNXK5LB0gRo0kybo5KLlY_pbqBWk9XnJrKZEkfFerTFpcA_Lpk7gzr3oqnJyltrnawyUpXGW5llmRCTDyA3h1irN96mXx6Pv9vDwBfCeZ1MbP0Bi9u8jBiqSRzACJqwVY7_nWLwCF8-j_6kG1UplmN5Sfg3oI6IDmslCJIBaUYTBR5Qf980
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFnUygyHT_pzqgRfItPCf3I&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame BD5F 43 B
145 B 191ms
135ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxia77vGATAB&v=APEucNXK5LB0gRo0kybo5KLlY_pbqBWk9XnJrKZEkfFerTFpcA_Lpk7gzr3oqnJyltrnawyUpXGW5llmRCTDyA3h1irN96mXx6Pv9vDwBfCeZ1MbP0Bi9u8jBiqSRzACJqwVY7_nWLwCF8-j_6kG1UplmN5Sfg3oI6IDmslCJIBaUYTBR5Qf980
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame BD5F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESECDUHyTRf7rcQ5ADFaC_Gz0&google_cver=1

23 B
163 B

53ms
52ms

Image
image/gif

23.32.185.35
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESECDUHyTRf7rcQ5ADFaC_Gz0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxia77vGATAB&v=APEucNXK5LB0gRo0kybo5KLlY_pbqBWk9XnJrKZEkfFerTFpcA_Lpk7gzr3oqnJyltrnawyUpXGW5llmRCTDyA3h1irN96mXx6Pv9vDwBfCeZ1MbP0Bi9u8jBiqSRzACJqwVY7_nWLwCF8-j_6kG1UplmN5Sfg3oI6IDmslCJIBaUYTBR5Qf980
Protocol: H2
Server: 23.32.185.35 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-35.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

expires: Wed, 08 Nov 2023 16:02:19 GMT
pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESECDUHyTRf7rcQ5ADFaC_Gz0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame BD5F 23 B
163 B 50ms
49ms Image
image/gif 23.32.185.35
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxia77vGATAB&v=APEucNXK5LB0gRo0kybo5KLlY_pbqBWk9XnJrKZEkfFerTFpcA_Lpk7gzr3oqnJyltrnawyUpXGW5llmRCTDyA3h1irN96mXx6Pv9vDwBfCeZ1MbP0Bi9u8jBiqSRzACJqwVY7_nWLwCF8-j_6kG1UplmN5Sfg3oI6IDmslCJIBaUYTBR5Qf980
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.185.35 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-35.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

expires: Wed, 08 Nov 2023 16:02:19 GMT
pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BB16 0
20 B 56ms
55ms Ping
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4333468507427&version=m202311060101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BB16 0
20 B 87ms
69ms Ping
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4333468507427&version=m202311060101&ct=77&x=1&cor=8196432674232525000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame BB16 20 KB
13 KB 91ms
88ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ad4V9RkYdUbcFq5vBuqeqnmeWnUwlGI_JND0TyEysPONuKgscuETpOIRHDyphyS9cNBSzNA3G_CDLALvK7nVOBzGpHctKVf9hwL7Y3wTXgCEy-sDCmonTijw9kWUoiF65UzyN3u9Eru5db_bfYfgQmYjOe97Q9QPnj4J26e__XR53cqy0&cry=1&dbm_d=AKAmf-D9p8EaSg90BvMLMulQWs7qUME_z17t7hu6qKtJhWy5hJkyuRS12HjIdPVLesm57IxPdEeBeivmEJh1_qb7f-2BHwgpZGgYGkYwEEoIDyzbCdjSTQGIe7QmSZiFZ8mi5UgPCqZEjYe1sZ0Xj3WfDaZCDB8L-87T4FUMs7agOQmSjHPKiLbIEn4CMXAo7scZ8lw9QYKNJdTQXR3Hhs_LOGoixA4slxv9OFgNRWKHSwvant9oyxrWm0roPXSsiDEKwnEmBn_XqcZLGoURKR3moGc5y2pjhR6SD7UL2Pk-EMATXs4iy3z6Vse3v5fVh5J1jkEQ94w3hXpzAtpTk9Dg_9YUI1bO0_mzUHplOWPTPo4V1HGU1tw8eJkGZOOyaU0M5R4Uhil1i1JfldAvb_8Uq1PglW_kHtFoD7-njUDJD1Kiw2VVrs6v5IrAIlCZ2hgad7ZmVI1bU0fHp2xa4nzRGIyRmfjrUJO82Gb6mlpOmrWDQoEQBMHk6WHT7OHo9DM8pQm6xMeq2RFr9KWVrJStdtaQF2jvCVQpW6i3qqO9FKnz5sBI_PmFtMqZGWfjhMLiYUpyE9wZYGekQjaK-PvejNY7IpB998q7lJN2WMjhVzIzhbpVra9t1j7ym0ysnnaTuClKHXEoWdhstYuQNdSrmczeDMQntsWHjB7e3jvxPJSg-7bRQ7ocKMBQ0At64c02Ow5jx__CJp8MKyaHLQeFiaz_8TLh0GoIHUsqkI1KMI36yi1UuIRt6hbufafI28aEIaFmRxmm_fv9gKI1fF1FyOMZL1MxOaJqgrNWkhwGAztRODjWnn2OZ7lSXe4479vxqMtbDfi2D8H74yrCFbhtM2xWLRN0De48cfKtNTLgs2INttyx88EsoNKs0AVdV8rbjZa5eY4pqjp5R-k_YWDsKt2g705qCpJulzTHio3fSMjYj3oIw3kkFTNPp3OZmOUH0OQ3n0w-L7FtE82o_8G9kLnqXL3VAGrjrK65y3QrUikzzMp5UnvfSYvkuEGIxwK1EeTAFgXqGJ3V6_vZ7dPwlAGWX_wKr7JHeQYsmVi7aezYxX7m7VIxWTtq_S5jvvUtu8VBHbYlujTeNBZOezsPuauPSPz1kPzLgYrtkNjJrHR0dm2ELBWGXXsdr303pZ2hi2HlKgN3eJauDvKJc9uKOpb7ECFOO7TNbV5YSdbN36bfVKU1hxgbRohxcH8_cmq4qMKTG6Lg1zuCe_DizwfGgPVrW2dxBabZ9JTTWIgvUVDdbUDeUK2uCx76yIqFpzlSTTVpic5H3kXmScfZxFajhtdlMgciQReIH8r9ohHnlY8h21gnWijoEL02W82ThmQ7iy2P0_wAXvtky-tgplBrWnxFowfZrG9FjgaJMrztLHmrxZ7WSSlMW_-bxsXOD3rbuR0LpwfxhMgTxtl6q_KV50ZNIm8SQanjtgSmZ2x1vaaICjVZn0JMyHMH-LKZ4iWOKQXPjDZsBVaBvLWSMDW5pnmkhozhHFIkSGsNv-YQet78-1SIL7M9YoOFfkz4Z3gucgG-cKuN-HNswKNes5GhpnKXjbmswO2l7C1kB06kgWGCKFBTndhbMHPi9TGGbp4_dGx2XyNsHfJe5JyuayKzYUiuR7YU-zZeKAAWG5bEHWWLKjUVQLftnlyqBoXNnoUxsIZDJ9S0JuJZ_fd_H9KV2mWZq2HtiweWJiVJw6EOnJhbKL9w6M4rmsrcNpML_XxB-4X7ir3tiC1E52D9oVyRsMNmFIyiJRQftYtc9Ut2jhCXxKXhIeNm97hOqNd6LYKIh9kk1wy5NXf1nIezWzk3I58bRgka1ndnHnAmkk2E-cYl1zSD-ZMGFSjPU7h2ti8EMMaznEmPg8hBStA1_fJrXAUMAlTaeke9u3fy7cQucUT1aLEwqRRNP07eT5eJhjP4y2cJVm-Y0Cy9alLU5U_jDSbby70yapnEKtyhp_YxC-51r_DiZfHGihNudcKbcD2Ftiw34HfHnPqDO7dN2UZ6-ns4IH5aMSRaUB-RVke8KefArSAessfOXO-5AVuGqZmo-UPPlXkDLJh79qalojbwlul1gzGYN7gZsqeYdEt6qrpzw7eAylVRiqXToyGWM7j8_CSmrELOgVVGw3kgTGAIMPdcyCNGTn3s27sNwBG-4FiRfZiJn_rWVEa5F-hAm6Z8qQi3zQIxLD88iarLyj2fXijrIDSrAjU8WoS4ggTJlKJCwXC_A-yGJNamNLJnsCtxaEuSIHA5MaQy9jdgehmVX6_MbKxXizc9sTVmrxFBophMGeEEwSriYXUk6NrMWw24Iw9m6sEo_s6zWn6W1fF8QcgVLc4sDcdoJOWx_Ne3IAUPz73_6f7EVxO08jHfvw_l5YvZmzYGJ5VQwMmL2zo3NmujogAXNBEzv371HpMHuxNUlff-dDV6E6k_HAdUri6sLXLyQowMQZYX8GwzY5qVghO0zUkcp9-EKb7cIcEzvkiYlpHUsOoUyuIMkzbLoITSoI551vWrDC0Q1QE6Nhlund7pNb0nqobhGUYHWzvZk84oeVESlFKlr_aiRvEAZXsRxNp0sPJiUGfDAhDs5m4Iz2gANQpPQy-41og16hq1hZnxswNfsbuQfRCxFXtmzIthHFhcMTg2C2konvLl7l7a_arZAuarMK20a3KR2OdsZwsfTBl9ktKQjsIOIYhPV0E88_2mBMCu6viPVBHzAD1GxR0ukVCdo4SGPX1Yh4KiT-BUbV2oSs4GcvSX409EpgJ3TEfH_WB1ML7p4jqQAgaUFVcs2oVITvGjR_0QByNFJ6fIqk-hPSxPCDwuoL-c4WUpeOlVSmig8gWKX11t7iyPGRPm-Y7LN8QojyQc5MzKEojAE3nfNkm2QydaG0ePbFC3f3AmIwzk60jp3nZG-ErPGwMVl90YdxJu8k5DVYcqesaA-5PHmlQDhyGItynfoeoDz5HeCbSaR_WHGc2cEcBif9-y1DilKOy0gTFJlb3XYD719gl-WOtEcOz6dgT9H-fAsrq3nvy6MJU5oil8eZ1JrlhGRv7TfWvwaEMDYv2kJZfI8ueNb0BFfjhMIhlp4b_ZPy67XVIQx6nrJ1lNBIh9fTxYvL_lqgRpbTvyYjZjscfwKvCfQ9O9--5S8hp3dhuKs-WHxWV0Ug9A9e17L72uG86wvfpuxs7x6hinp2lcFEWGOihCIvBMNrn9AsYmEC2mYfNVM7PKqCIc_TgQIx8xhigcEOqdWlxgOGC2KVSiJ3O5UMIgeefY6qOWqEjeX_RWtT_PiASaGeuL4xLIpU7w2R8kpvDEQOnKKDQYSSqkyxuzX1hbzLjVgjBEI_6mRvcxDW0qUZkHGKFY4gJusCIb8oGNmQQu8ntrIgtOHVcdl_LNu4CMkFUolGUsVIkZJuGmdMPr4dC6tEvV8fMt0cqhW36gpbt8rhzaDfKma7NMrJBOU-Y38bGXQUczINBsGMSV0C8_RFuaKYm48xopQG9JfLHSQSSGXS7aO4ILCbaiCir5QpEh9xGMu4_PEyi_dIjStv8JPVa73SmTesnwtp7GaGkb2AOlRRTzNlSBEiz8I9Xo9x4RdIaK757ZtC5zgkxkG9AVdhB8KwV--IBkMjNIrUXgGrX1rAtOfcTYp7KpW9AhCyjFLNlwXT3Cifqj6LIRkc-Z6HvUY7eDeZijKF1gStzwcQf0NT8yVgADdYdhdkGYe0l11ZyX69TXXhDphOu_f68B1M5k0IL_W1hLAT7Z6q8g2Cqyp7ZsYtlbwvhuwmGWnf2Q4VFN18hJC8JCjks-5CLGlvlQ2mdcFjCrGhl8ELZb5bEakkRAygfW-r0nS__hCdvBPZ3LvertK8etM6Vl6bNJH3gWtRN6YNK7mLo1dtiKUM8rjFrFZqcrx0BnHIN_x8jPN2s2BWpFdWEaZR4SPujb7zUmovSOsSfKLKi44Vu39scMeyHMQF2YGJrsLFKXg4HjEIDDqEcmeWptPy7hxJV81Zze&cid=CAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB&dc_eid=31079496&dv3_ver=m202311060101&rfl=https%3A%2F%2Fcybernews.com&ds=l&xdt=1&iif=1&cor=8196432674232525000&adk=2935317967&idt=139&cac=0&dtd=30

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fe87c59c67cd22bdfd2e0737beb77bdde1c36a5aba3fa955af9fec5bfa76d102

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13761
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 162ms
53ms Preflight
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 08 Nov 2023 16:02:19 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 csi
csi.gstatic.com/ Frame 0B32 0
54 B 71ms
34ms Ping
image/gif 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~lopy7ml4&c=3796831317714&slotId=1898415658857&qqid=CMuOw7HjtIIDFcPF7Qod6MAISg&fb=outstream-lima&sei=44752538%2C75259414%2C420706098&nsei=44714510%2C44729911%2C44730425%2C44730426%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 0B32 15 KB
16 KB 64ms
26ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 18:18:43 GMT
x-content-type-options: nosniff
age: 164616
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2024 18:18:43 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 0B32 15 KB
15 KB 80ms
43ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 19:40:17 GMT
x-content-type-options: nosniff
age: 159722
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2024 19:40:17 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0B32 0
20 B 72ms
62ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CAVL0CrFLZcvhJ8OLtwfogaPQBMHfuId0gZrq-4oS8C4QASC21-l7YJWCgICgB8gBBakCNPb5UM_ksT6oAwHIA5sEqgSkAk_QKDfo1igAhcGg_kohvpz7MUeotm8Nr_Ua_eXWlZ_WT2LKgERPmDPSCeZdgKHt8A-Pr-LPnuQusG43Jg7VY4zPZ69CPpjSzsdYc6C7XafHW42WVD0TFYHx_l7O1Z45DI1ryTh0qfBykIIyE3eSdDTDMZoUNo86ddSpniVS0HDwqNM-T50eO_JO1QMH3WkQIP6nfefBiyipHEC0KxRGoYfRBpelbmgTMLoT5VoDBmEGNTxZQi_lKoabigVAoRedsroyPzoaDPfMcXEQ6JeQeXzqdnoZYTUQWA0ttw0zImiDvKYxdrCECJX0TxQHtqXwQ0kqWJJBwo2-6GuJN9utS0u0TGgawrrCAriHm-utRqJsq1Mwf3ktFjbYOSUcsccf3Pv-lQHABKfHsZDEBOAEA4gF3djDqE2QBgGgBnaAB63T_ZoFqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgHICwHgCwGADAGiDAwqCgoI5LSxAu61sQKqDQJERbATyam0FcgT0rnu4wPQEwDYEwqIFAbYFAHQFQH4FgGAFwHoFwU&eventType=clickstring&clientTime=1699459339364&ai=CAVL0CrFLZcvhJ8OLtwfogaPQBMHfuId0gZrq-4oS8C4QASC21-l7YJWCgICgB8gBBakCNPb5UM_ksT6oAwHIA5sEqgSkAk_QKDfo1igAhcGg_kohvpz7MUeotm8Nr_Ua_eXWlZ_WT2LKgERPmDPSCeZdgKHt8A-Pr-LPnuQusG43Jg7VY4zPZ69CPpjSzsdYc6C7XafHW42WVD0TFYHx_l7O1Z45DI1ryTh0qfBykIIyE3eSdDTDMZoUNo86ddSpniVS0HDwqNM-T50eO_JO1QMH3WkQIP6nfefBiyipHEC0KxRGoYfRBpelbmgTMLoT5VoDBmEGNTxZQi_lKoabigVAoRedsroyPzoaDPfMcXEQ6JeQeXzqdnoZYTUQWA0ttw0zImiDvKYxdrCECJX0TxQHtqXwQ0kqWJJBwo2-6GuJN9utS0u0TGgawrrCAriHm-utRqJsq1Mwf3ktFjbYOSUcsccf3Pv-lQHABKfHsZDEBOAEA4gF3djDqE2QBgGgBnaAB63T_ZoFqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgHICwHgCwGADAGiDAwqCgoI5LSxAu61sQKqDQJERbATyam0FcgT0rnu4wPQEwDYEwqIFAbYFAHQFQH4FgGAFwHoFwU

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2895910089&adk=4004477476&adf=3455423724&pi=t.ma~as.2895910089&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337886&bpp=1&bdt=284&idt=398&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4019e175c95576ce%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MbRkZpwDWvwgImp4hT4MxuOzfwlyg&gpic=UID%3D00000ccc31a35fda%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYOaxCzChjXiL5NQ3guXhLuXwECNQ&prev_fmts=0x0%2C749x280%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4766&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tz4yikkSlt&p=https%3A//cybernews.com&dtd=736

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 0B32 0
54 B 57ms
36ms Ping
image/gif 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~lopy7mn8&c=3796831317714&slotId=1898415658857&qqid=CMuOw7HjtIIDFcPF7Qod6MAISg&fb=outstream-lima&ulv=1&cll=0&met.4=arp_a_s.kq&vast_v=4.0&vmfc=12&vhc=0&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

HEAD
H/1.1

200
OK

file.mp4
r2---sn-4g5lzned.c.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995338/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 0B32
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995338/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signa...
https://r2---sn-4g5lzned.c.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995338/sparams/acao,ctier,expire,id,ip,ipbits,ita...

0
0

84ms
28ms

Fetch
video/mp4

2a00:1450:4001:13::7
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-4g5lzned.c.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995338/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/6845708EA129D97682FC62BA5175E0FA93EED76E.60AF5C84B5BD1AF6C91437E7151EEF810F06EF9A/key/cms1/cms_redirect/yes/mh/98/mip/2001:1b60:2:240:3247::6/mm/42/mn/sn-4g5lzned/ms/onc/mt/1699457892/mv/u/mvi/2/pl/36/file/file.mp4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2895910089&adk=4004477476&adf=3455423724&pi=t.ma~as.2895910089&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337886&bpp=1&bdt=284&idt=398&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4019e175c95576ce%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MbRkZpwDWvwgImp4hT4MxuOzfwlyg&gpic=UID%3D00000ccc31a35fda%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYOaxCzChjXiL5NQ3guXhLuXwECNQ&prev_fmts=0x0%2C749x280%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4766&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tz4yikkSlt&p=https%3A//cybernews.com&dtd=736

Protocol

HTTP/1.1

Server

2a00:1450:4001:13::7 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Wed, 08 Nov 2023 16:02:19 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000
Content-Length: 4188249
Last-Modified: Wed, 08 Nov 2023 09:11:46 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Wed, 08 Nov 2023 16:02:19 GMT

Redirect headers

date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 653
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
location: https://r2---sn-4g5lzned.c.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995338/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/6845708EA129D97682FC62BA5175E0FA93EED76E.60AF5C84B5BD1AF6C91437E7151EEF810F06EF9A/key/cms1/cms_redirect/yes/mh/98/mip/2001:1b60:2:240:3247::6/mm/42/mn/sn-4g5lzned/ms/onc/mt/1699457892/mv/u/mvi/2/pl/36/file/file.mp4
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://googleads.g.doubleclick.net
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 5081 0
54 B 54ms
37ms Ping
image/gif 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=3~lopy7mgo&c=3070742655433&slotId=1535371327716.5&qqid=CPWTrrHjtIIDFczw7QodQ2AHCQ&fb=outstream-lima&vast_v=2.0&vmfc=12&vhc=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 5081 41 KB
15 KB 52ms
46ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/outstream.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sun, 05 Nov 2023 22:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 235770
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Nov 2024 22:32:49 GMT

HEAD
H/1.1

200
OK

file.mp4
r2---sn-4g5lzned.c.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995339/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 5081
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995339/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signa...
https://r2---sn-4g5lzned.c.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995339/sparams/acao,ctier,expire,id,ip,ipbits,ita...

0
0

85ms
29ms

Fetch
video/mp4

2a00:1450:4001:13::7
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-4g5lzned.c.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995339/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/4571E5A1B001EC9FEDA1CA7BF704B1B2B935DCD0.26CB6E65D34A500486339F22DAB5EF8D55AC8288/key/cms1/cms_redirect/yes/mh/98/mip/2001:1b60:2:240:3247::6/mm/42/mn/sn-4g5lzned/ms/onc/mt/1699457892/mv/u/mvi/2/pl/36/file/file.mp4

Requested by

Protocol

HTTP/1.1

Server

2a00:1450:4001:13::7 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Wed, 08 Nov 2023 16:02:19 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000
Content-Length: 4188249
Last-Modified: Wed, 08 Nov 2023 09:11:46 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Wed, 08 Nov 2023 16:02:19 GMT

Redirect headers

date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 653
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
location: https://r2---sn-4g5lzned.c.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995339/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/4571E5A1B001EC9FEDA1CA7BF704B1B2B935DCD0.26CB6E65D34A500486339F22DAB5EF8D55AC8288/key/cms1/cms_redirect/yes/mh/98/mip/2001:1b60:2:240:3247::6/mm/42/mn/sn-4g5lzned/ms/onc/mt/1699457892/mv/u/mvi/2/pl/36/file/file.mp4
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://googleads.g.doubleclick.net
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C50A 0
20 B 66ms
59ms Ping
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2227166053474&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C50A 0
20 B 63ms
63ms Ping
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2227166053474&version=m202309260101&ct=77&x=1&cor=14487535150792729000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C50A 20 KB
14 KB 89ms
89ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A6eMCTNqtcmrTSKfyBjfjDnPm0xEAKAJjVVrjoJ2cmn89afgMBkeE344QiwCKkxGWzmfUYqHLSpVUsEHoFCsZX7SA0KYPBpMraa5akszy2hltr1TI-cJ7NmY7Y2qO_Uam3gzvj-hcmH23V8-jV_gMGZuglLsgz6wQh4EngZ_Z7tWnqHFs&cry=1&dbm_d=AKAmf-CbLCl0IPX4eUaNn5rIbMp4Luk4OAFFJv_OChOhR_gpSrwSPG5hXZKN5p02R0CQ3dAPRhJvEqfPS3pgv44GiFIBZzf80QNAYmKy-yOnOaPY3yMTpe-HY9SDsZ8qNYRrfXS7OMsQNAfMrBDQ45H9lR5YCK3VzX1hjPN1GYjV0Yl_8DrwOklwWQeWkbXmSs_cuJuJPNmPdtglpn7S99GTDz5Jww7gczEigfa1VXnblczitUAoJktYjBOMCd9UkJ6zZ60GAa4QkTbx9ByFGzSEsus2bSi3oZHZIJ-ePv4ejfyxPrfD4Yr61zTk1q3bsXdD2GAqqohP3srrF4JyQbOuDgAcJ0vr6jeJposboCND2vWsYToWDJvOlLHuNQxNIeqz-x2kdcw0jdD2NG4rQFHS-tnvqqTwMUBFqb9OyQDpRA7dKNh922VojQTx6Ets-aGJEAjukwIVDGwK1JgoOYBUnELZoP4Fb4HEB1MH7vHuFOT_f2T14fbzEIoIwvHPJFEWmIojI0-q11hF0D0yjdN8fP5orZr34ZHfHrTV6NLiTFf296cC8PyrVz46avWp3TUbHGZdez1ttyeuU4x9JwZLbJHPCSrjPql0gwv6tfdtsCWrskZM284d6ABnGejiHVGrC-eAyVR059zhfUogo8_X8nLCNiu5qzIvqO_vYxZqBUF3aHPH4s8LJcWGAtOJZ1X3GGy8y52nEtTblAci_fzCPUBJbCzDzFQ3AE33Sd4tZYB46Yuy4-6JqakkrcY86nj-H0CqnAfWcmM2_uK4jxIqIgPFN0Qy_3cg-dyg-5CM_9-VfLe7ioiiRuyWnY7KXLPW1WfGH2FsIRz8S0UA9vmYLPWqiPQQsq5NoEwV8HKTpt-t14cdI9RRpxLmHoeWXllTzUtZciTslrt1-1YOMgKFj_220cWp-NwcCTXW6J9hyAlIS2cF_G_bvzA4PS8mSyOKQHbdyOCM_jIjoyjlvFurDI0eUF4bZuqZJcb1zDUx0EEjfQncwwnHmGofZ9ceziAwxNZh8ygU8T4VchB3PKJVCsVupnjxlZmNoNtVC8a5FRp_tK0C3gYN68oGbXpkFY4u-rdaHCIlqX5J2l9GjIT2MSeWZh6ahZkbDutgY96AqZdIUDPLLdhxeBzlTvABrYHj6a7ZFfxwdNKmHglxot33Gc8YkmCVaE9g9Y2X0s6qp1943Q6QN8GVJBesUWsZVQAmpjV6gUDQ0qMIn5ELdn_toPlY2GsDhyZjAu3FMeSZuMvxrSUoSCUJYVs-I1B2qBpiKUa8MkGspdjDq_cMjGVWecWN_IgF16bcF0nurfVFw1n7Sl3DeyPeQ8TsZTxGJyHRN-vVUoq12lBEZOZF02DIk3osd_3_8XMsx1o9n0tiWv1VfdxyC9I_ysNdoHXIt42UIOBn7Vnh8P36oITdtwH86FQs4uCkHu2Vdo-YJqJApKItNKfvf2xJefEtnAJeQ1T4KTcTbMU2EY4t4D05E_Z88Xn4xb-wS6Wqyq1dcHPjbArEUADnpZizOgFikPA1-mbm_jY7aqmpU0L6Clax9GUzbNF8nUyOsSeayl1Q90bhz_hbTOWnCK8JQ9oVQa6CKHXd1Ez5ym4w-cQ1la2Jp4dNUotxT-GyAhO3Sy4jEk7l6ma1Eh6WIjkmvTFUfc9DImJQQPyA9dTfLXjUdU3k5jRHRoYy3G5rmmp23viNq7899_oY5kzVZaVZp4NFEk_1LRFndDePrV7ig076h0JH5byJqJyFHJdk4C_E7W_AfABE1_EtLD6HhXCG6cezqkd6KcWXV80DkCVrg5aZY7z68KOtEgGLRZ1rE3m5dFKPKm7SQowvgDtJYUC3fl4g_BkNR-uMa6kEmO2MaSEaB3xcQp-smI7aw0DrK8nwVoT5nmTlVXFo8l7V-l0GptmXdPZ5FIFNB9ebbZ4O3aAtnT9zGaUve5JV1ObyaPKLZd0-92j_BDJDogq0rvr25dmBD8VLWIKqt8oWupnO-JRq_8muvUvQlkhDQLvgN2k15WWzeze8ZPW4Sv-aadFeADrDSwEIWVTL9T9LvBsfpbzhG3TAKt_JE_TYpEjyKcq72Frg5K4r7EsQI1IAKQ0DHgbEKT1zAre7c-iMewos9RiyzILgv9pzoUp0tCd45kX9SlUBQU4Muhw0GawduILg08sVDr83y_X4cM4oWOUWpxlfdgyNyAKXiRsaLXUFq7ejihUNYhOv09YFXTss-SqamtnuH6cUjOKnEDHp7EGlz0Z2xh5BM3c6MlyyS4EM1z6NkaPfp9ppwj1Yg0s4S0QESluj_ccTjUci0PiTYbnIvhoaJ0VUcJ0wDaQZJdRwdlGo7aqSY4JPHYyTTygSFeyrUiINBjR5UFGC3djpPHsyjD0COvutT9_WNa9mrsIVPM6Lh5PxUtJ78pmM8bIbOL8D2G7_2KvR1mlH4_cGM78wBpeWNIa5RNEHDeFK2g3YNzNag1TqHOoGneyiBhtgKvwGiRUqumMA3jPlF5e1s-9KxtDLxn7bi8j8DtdnzBx_dmOPTNbESyKMZenEHJARRUvxOJrj2YBDrKYzaUiBQMz09gaefoDs8MsnWsR9_Z652DUxfDdKNnOWR2GqgWxH1CUrYj00fqyNCCA8JApgzA6dvXsFpUtzyxq5h0pSzvyBPHtXgK_ms21cA3-Eil0hHDah4zCYNEtBaxP-rnL2BhSQr3rLtSCzsyVd_X_Xgxek7UmT8plLEO2l4tLDJ4YOl6Xc1EuiOPAGCH3ZG4PQJo9j662gyvaudE8wBvgSL1z4CHkPFMjPn7-z56Oq67NN5VpUd_wrQz_KS1k0DlEVqWcRfvwVqIxDeVUlfX8uQGIR1CPj6SFpf5estlFcoB7hU-RiO4EE_OW1GSJCNudbC8avJY_APd7o79Uy6tAw7cLkZJwqKEEIZEDoXzAZA5RhUI6tMsj7CLUqOlzryKCAKnjVAxDBj2BRle-KFNWsekP6pzD3qDEN2afr-t93d2MyZh3AqTohGkrllwytRY3Y_NDrVStT9EASOxHxsJI_uIeoK8KjoSLKxuM8iA_yfvKzlZDcYlrltZkjo9Od9HpZSAtnC-CnDmRG_Kj9dfO9odEcv92peDBFGTx6U7BIBaumpIXjj5HGIMkp7APgX_1ZbOsmsJZywjy49bDjTEq0tFdICu0RSTYI2SeATjIQG6j7-rTZnKF-QeUS8vQZl3DUK4Pz6YwLDqB8K59afla1PngAB6ugsoCx0INg67GbYIV7aCDDCL33KSBzHWNLLnCJiFgNqffGguBy5DyWc1GiRD8Nzp-ieQmk3q7tmQ9w7X3KgGA9_mDAEwDtkxGRlYuBpE2kIpC0ODoNNGu7msV1ER-BKRIhgslWaFpuB0JTWhIUfB_zssZh9ycyHcIoN25T6Ccv8X68cjDiDoqTD_Ww-uR2fY1IWOiltj64zhaAAi6y6aq8BMgNjOmrz1NVTXqLqkbk4clOOwJvB7cT9Co8WWK82BRg_vbcYOUKJgG3vcl5Va5aQCf44zr2k3mTl7P_1mKpTpGD1WxPGog67gVXd2KZReKfCvW1ojrZXpEJ2qJ9a0ycIot31cR9ihTMeNQuPUnwwhLOhvW8E7FZfjBNtulNnZ0LGI8gggY_kMPHpO-_IrZJU247XM6Q5K438JlQR6P6P-vbEjG3VqgS1yGdIM8lw10_xzjFg4ugyJgdt1ruFZa5Vk5tAtdtOUQrvii_7RMP3O07_oSo0GoE52K3W7nlLF711eUlKnjE15N7tqhF18Xz1eZDe4cwqaTw-DPuKT_O_U5rTS36wZlZzdH9QkyjQsacqwbp577v6BaCkvzFWL290XVslzSKsUD8wq3FIALX7N7sPEmr3q4WW77EUamIBAQBTYthVaqEaIXz7MN7eyQP4uEQ2vQ6OeOKQS65qvHG_xhhhk41OGezPwHml687d-x2-AnGi7Q_zR6zIxyI0rlRVe4VC2U1PtJqvjW4WQs9&cid=CAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fcybernews.com&ds=l&xdt=1&iif=1&cor=14487535150792729000&adk=2515327512&idt=190&cac=0&dtd=20

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

44ea8cff4758905b27eec9929efb7fa8fff22d8d1ae7f2e767c6efb98f7a00da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13819
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8E03 0
20 B 78ms
69ms Ping
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9635228272357&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8E03 0
20 B 79ms
61ms Ping
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9635228272357&version=m202309260101&ct=77&x=1&cor=7945756343880057000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 8E03 20 KB
13 KB 92ms
74ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bmaxv0EVjSGHLQvdw1VuBFYCtDFfzcmczbpikkQ4zBbifk3mVDxUTFq_DnsXXWNleTgV5aJsGfvdyrEvaUPouzHNb4Wv2BVJzr4bhMNNHZAl-9iDEk78XPmfFWz1p-eTIwxDHSTI738PMODsk2BHxtdq4oGUEMyjqC3-jvCS5i651d2vc&cry=1&dbm_d=AKAmf-DrRgF48sRJ5wY7EmeTEjLCnl-VmgY-rw5kry8gNvPWGCPpvaQ9mkLPK6KuYWeCOiSDZrHg1b_2jY93QjnE956CI5-J5AmUd47sOBdkCBcXtsLMF2PW-1V1xvetn_bW149UJtW3DV1z4rlr68ZJYuD6SDqKYGCh5LapqDK0zWluz-mWHPUYquds0XtlTOtdP7DOjwmXoFhreDSMA9Z13TuJYMZ--V7rax3ZD_4ZuyIwve3UAQ5P1wXFz60Cb0ViP-kbbYgsffTSDg9QfMO5_5_CO0dapHJscoZ6xKZX4zdJftL-P9kex-U3zFWSZeOmuHAwDOqD_W3TTmhiFwJI6ktFYdJF-shPZxXjFmxoglvz5qnoQePOk15d0SKSgqoyBbVaL3g4PoZt6D44snTyn5AEiRzWxwUMcJfQD9WtHIGQHZMMeh1-bNOIstOmP70jaG1t-ns2sGPjdJvAUnPIkyiANgI5Jd1exsUtjmHWHaSDElqSZdKL6ilq8xsOA0rfpR6vebvJLlffc6HC0icVU99mxeAnW-YBV96up3HM6SXkQGUeFaSpq1cM-ZScPOirgSOL5wq_--0vKz_HmnBmWiembUunYhqbPsePUPn3MET-Un3fIHJlxvIVW5FabpXvK3H4AgMFdAQjW2-hyMV3q9xOpIqweQ5sPOgtd9RnpuNn637d86RkC2Uji6niNGkUK__i8Pjmjf8TTgjjBOqs_fSsOqnk37z8VBr2g445eKYTIekrDWblTuLWkBIHza-_Mn3ueNhbq92nz5Q7XQFQvt8kSZs6ANxuj-jNoTitbarWfUM1U_ycqOXXRNVnD16o3u2kb9g0fb934LxDEBXXoWkv_B-J4QltHS_30B9C8Rhe4SRwhXrWlFNTGMWUphypyyfeXWvshviKmRfM8MtsNLvC-6BYbons7dNcFlhoDluA5PZnCs8eNFhJVKDw64-paH2xxAfdq3qs9cjCpR643RPbrh_1HOSZ1LIP34NdHbidw-L_bcDfW50AgPbYxv5xasvhdD4BwGPlKmkQs-aw4_XXfUZlycSVkebWjGUIXIuWlJdcOFOTsgiq4_kdGmthdrLpC48of7ZfJf-WoVPApc7qR12XQiNThXZYE5av0RvAs-OzT20SQkMtTootrtGyRpTFwn6zkUdl0CVgsRijah2OmtIIOPLbsien-bntmletNaemPUiOVPN9U9Xjr2dWdtFWy68UBSuFyJwgUcdyo1Zyzrq5FwdlURC2QkS80LUKgvZFGEvJFDZzSqFgBWC5IX_72mK8lFytb_ZSENDGGArUT9akJgJLhVr8HqMwc787HKK7A--IEefCl8ZZs6xvk0vsVsW2wK-Cq0jV8rcPPKj6hmc4YHbEvAOt9ktCRel1HUsnqcKn619vrnnnRpNQKQMaLRJ8oLao0RFvFj_-iRW8vk_sBQtrOfjIMRqI97bmABHEQci34nUaUzL3xcC9jd5xDHU_Jl15OBaj6QJVBqTgayqdpuPbZlUl9c1eftE94AsjgXUav48NdyphvCzoxDqjpPeDSaJbdZbUmR1CVeY1KZ1FDLlXb-ypxH_Xa84qqjiMiH1T4b9RCrQAA2XZ5_bhFxWoDdUmsDbISh_PvexIsSoJ7I3qWDzplqcHfsEGD0adVb0c5maTKtp4WC9Fn_NmnsytB9_Rix3vBDBcAoCYGIDb6wmHcyWfyF1KbISPcgLUO9tpRbjdnF6HLNhUmwbPzntABlGjbrqmI-L-jhMYayrsrPiTQvxgJZmzBJfPI603bauUfBKvod8eC-he7t0xBD7WOjqkJfoR6LiKeDhd78BbKVdXP5bGVsE6Rgejlr2BSfa2EJ9Z3geJdFRnSaqI_L_MoaF-CCjCsuXLwfheacmT1xTyKcgDF2faQmY0LOP374FlYG8smBpUN8aGvr9k0_-jjxkbaBHe5S5T7tBUrXYgFnOFOJPdD1udkD0uYskaM3-_ItezTec6JRLmyuodTkDxhNMMQVaYZ7Pod_b_x6vuAONjgbZDcJDoNPeUiOiEyPwW9FeV_manfFBofNri8irhJikoyiIGGYS2AcioCiafb1dgrkVV8vfyXP6o1cJikTdbcNM9mVgg1UYZwKTK8Bc7xX7TUrFnohkmexubtGpN9BnCrraPN1-YxXuJtw0exe9tzD_86tDrNvQdQDCG4wy-4xDUmjEtONBZrjaGd8FYGkZhT7L546_3DjVfRLrqbutxFj59LSLp05zeaUng2FgZZ9NiFWAQyyUtLQhDs1TjS_xBON9JOIJs3GrB6TRFDpfKqb8c81GUkY-BnYGqYJMd4vV8XgD7G-T8bHz-Xq3RVpKrPTnSp5acGVWh3hO_a_odmU4Pw9udVT5Fl7XRZ67KvHil9VIJ0YabHpen4OevCC_auAqxB_EYuGqTnsfdMe41LW-j-c4fknRLq11o4n17RUhOkyYtLxBG23zqOTGcugORrIg3qS0uk-j8UtxEHyJDuOGPxzKD2NzJgwonE1AZmcIqnYgh3QtaHICrDqFKg3KxCNnLcz_AwqgkNg0nvkMFaC1448NdF-TbapHTGCJ-OQdEc3OcYRsfoY1EBCsTkc4lpsLkpxWm5L6aMmZSNJfxn467qxrasG1N27T3K0QIKkwrutTmOjxC9mkPNMdlgrvNRIxuB_cpRSkwhpyFia_6qZUB_4pI_svWahZj9iWL_4Ly9tNYPJG2GiYVRudCAWFH6M0kJGVuvq_ShRNgmpfo5XvFGOaXhWMVbHdWU9OhA18QW2w1o3823mYTh8-hQVZr2Ww7XyEjTeWemx_qiA0UembomKnvvCKDrFd5Dlq-dXSPQfixPiIcgKA0_M8-_YE0F6O9rISqgp3CBOYWzGtKslHsuuWEizpcNb0AIWGuoTNZ-SLWOyMRUVddcUIxDUH36bR6LoCUgjhwjuknm7UmZHTQib0ZA2YAwA2Jl7yCNLtGJKkrddnaYQfJ8rfc2WNsf8sqLuixRjSZPjXcfIWr8m1fvHZXkNxXBIkJWrVesc-LXw7iyAG3zd4XNfG_ECYLqXuvPUFz0l8I27a27rEjBzqoY_GTS_vtJIbob0usbMH0bon-p3kzjIdKYpmZExw-EFoqQVvDCF1FlsaARZby6ogcouiGl41Jz9ZAPmU1cGQev1Mj9texm_XvM1AepfQX3jZXV_90vT7GLelTWKKtsJHZNHX-aQ2iaP6NElm_ApRNZUJQmyuuoaBbAPl1aBN1mn8MO2TN_vZsFmjeSGlmieIWAqTfEFHSGbpiuzSaWMR1KTKHAWsVfaU-FgewaOcvW-XhCniWIGGOFsp2ZMgwmeer3JAItDJ5TsfSudKglP_j8VS-AOAjxOfj4VcZ5ov25KbflItol7Fc0-DlZr4Oliv9VYhh3f_5FKmwXemeq-zp3Y6OpjiDFwy9bGJAwbl4I9iXaKxM2V95V1u6V4WFBAd3gT1zOD9NJmFD8o-alznfz6Pfon1Fr70UhI8wH8BgvxY8YOxmVH_RszAAs7GAicWCSwtFakRktg19kRbgMnOZoTXSf7obIm2TgQIP36guGDZhlwzfFw1lXV5mQLZz6qXCo_Cmycvaq1nM4p3ufGN73cj0Avup7gOy7kdeHC5P07ngtWSyw4QSf0UNaAizS1xD5JCPZkp97EhKsF2VgjpbgPSL87vWOXGDCtefmAmgcV_0JvE_fAHrSyAfX2E_xb7acWfPQ4-0igM3BXuyfOQPVhl-_3JmaVntzVrpY-G7U3qih5bBgnqEHVmiJL0OSMNVH7sx72KXomr7KrQyAbUWQxGbwiFwpEG_iE8VNQYlpdzZh5J2bQwqzOYhH8yzD7fhTrr0tuk5iCYXwhjzVkDCXJ7x0Q2uH6KEvwTIVaERUfrJisjHyl9-59ZiQJF_KwN6tJMiatFiH3mTRR8bgCegn4gLhbEA75OA3cRsx9Meyuax0nKcejzUb7dwwTvyrfDzsqo66C2kcWycM6VRpSchWf_9KCoMmA2vZ_8NUe8ZWblDET4p9o1iYX-XysuSMZQi0fnq1UKR6eGZR8ne2shoyDjjXwQWCwP5UvDLAA&cid=CAQSOwDICaaNyd8AMPD2TzTvMtd0QMYAEK_sgy_fE6YlOvuUmyjM2AKdL98Ey2XaEazXLZWSEytdyCzAm9oHGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fcybernews.com&ds=l&xdt=1&iif=1&cor=7945756343880057000&adk=1033480531&idt=123&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8e86e427c631cd47db1094d7bbc7ae4cb35997fdc84acd8bfda98b9e5a088a5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13699
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame DECB
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEGD906BJIhLRqYJ_dv2FI9c&google_cver=1&google_push=AXcoOmRUFTvHg7SqgdeSzlCMDjxZJ0sok1l-PPW_37aRUMRxPTaPGCV-mJZ5TA2vxq80smPaRJJguDe34TPJhS1rs4AhpfCzGJ4WhLw
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mzc3Mjk2MzUzMTkzMjY3OTU1NA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDwFDaKmWikuqVyVd8q4q_M&google_cver=1

43 B
398 B

28ms
26ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDwFDaKmWikuqVyVd8q4q_M&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=9812672228&adk=3541318952&adf=1004996698&pi=t.ma~as.9812672228&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337885&bpp=1&bdt=283&idt=367&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4558&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=yEOzzq4M2D&p=https%3A//cybernews.com&dtd=372
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDwFDaKmWikuqVyVd8q4q_M&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame DECB
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEPaufe2z3fYfOitOc0lg2E0&google_cver=1&google_push=AXcoOmSbpVZpqzaqvRf8Ley559A2B_1udlsr3QV1aPQj5NSkOo-s3cbJws2FbqOP3G3M6lpjDJRP1HhwxtiTy80i5lPqPqezq2bXs...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEPaufe2z3fYfOitOc0lg2E0&google_cver=1&google_push=AXcoOmSbpVZpqzaqvRf8Ley559A2B_1udlsr3QV1aPQj5NSkOo-s3cbJws2FbqOP3G3M6lpjDJRP1HhwxtiTy80i5lPqPqezq2b...

43 B
416 B

196ms
191ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEPaufe2z3fYfOitOc0lg2E0&google_cver=1&google_push=AXcoOmSbpVZpqzaqvRf8Ley559A2B_1udlsr3QV1aPQj5NSkOo-s3cbJws2FbqOP3G3M6lpjDJRP1HhwxtiTy80i5lPqPqezq2bXsw&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSbpVZpqzaqvRf8Ley559A2B_1udlsr3QV1aPQj5NSkOo-s3cbJws2FbqOP3G3M6lpjDJRP1HhwxtiTy80i5lPqPqezq2bXsw%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=9812672228&adk=3541318952&adf=1004996698&pi=t.ma~as.9812672228&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337885&bpp=1&bdt=283&idt=367&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4558&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=yEOzzq4M2D&p=https%3A//cybernews.com&dtd=372
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 822f0a294a5503a6-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 120
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEPaufe2z3fYfOitOc0lg2E0&google_cver=1&google_push=AXcoOmSbpVZpqzaqvRf8Ley559A2B_1udlsr3QV1aPQj5NSkOo-s3cbJws2FbqOP3G3M6lpjDJRP1HhwxtiTy80i5lPqPqezq2bXsw&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSbpVZpqzaqvRf8Ley559A2B_1udlsr3QV1aPQj5NSkOo-s3cbJws2FbqOP3G3M6lpjDJRP1HhwxtiTy80i5lPqPqezq2bXsw%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 822f0a28288f03a6-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame DECB 70 B
148 B 70ms
41ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEPQUhaURWF3Q2eNHiH4y7Vw&google_cver=1&google_push=AXcoOmQ8YD_P1gznpHkKDThZcT4gFtI3sJijSlyWVPlvcCAbmlNzVE-rRaMXf75vtr80h2FUyJzuAzPf3SeL_9UMhLzzsmBgks8Wrg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=9812672228&adk=3541318952&adf=1004996698&pi=t.ma~as.9812672228&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337885&bpp=1&bdt=283&idt=367&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4558&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=yEOzzq4M2D&p=https%3A//cybernews.com&dtd=372
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DECB
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESELKFVIJGh84YzL7_cCo0d8g&google_cver=1&google_push=AXcoOmSj9wxflaXcjtCFw-rzROyPh78k6f68NNBtpuDn2RiERrwj2Yjc8w531JGvJpSz_jK9-9fVEFICrev4NP...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI5OTEyMjI4MTkwNTQ1MzE5OA%3D%3D&google_push=AXcoOmSj9wxflaXcjtCFw-rzROyPh78k6f68NNBtpuDn2RiERrwj2Yjc8w531JGvJpSz_jK9-9fVEFICrev4NP1cAF...

170 B
188 B

40ms
39ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI5OTEyMjI4MTkwNTQ1MzE5OA%3D%3D&google_push=AXcoOmSj9wxflaXcjtCFw-rzROyPh78k6f68NNBtpuDn2RiERrwj2Yjc8w531JGvJpSz_jK9-9fVEFICrev4NP1cAF91Fggcn-tRhw4

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI5OTEyMjI4MTkwNTQ1MzE5OA%3D%3D&google_push=AXcoOmSj9wxflaXcjtCFw-rzROyPh78k6f68NNBtpuDn2RiERrwj2Yjc8w531JGvJpSz_jK9-9fVEFICrev4NP1cAF91Fggcn-tRhw4
Date: Wed, 08 Nov 2023 16:02:19 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DECB
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEE6IvyDEYF48cNqazBu-VzU&google_cver=1&google_push=AXcoOmQceTli2b46DKa8_Z2aysrR83QFvgZsASWMEhdaXMe22cizJ9OhVSXxR7qfBwGcEJu4gXC2KLSIt6Hu1MwP...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4f5q8xuyThAOtoh_ej3JUQ&google_push=AXcoOmQceTli2b46DKa8_Z2aysrR83QFvgZsASWMEhdaXMe22cizJ9OhVSXxR7qfBwGcEJu4gXC2KLSIt6Hu1MwPVM_ZSkX5pRM3Wg8

170 B
188 B

30ms
29ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4f5q8xuyThAOtoh_ej3JUQ&google_push=AXcoOmQceTli2b46DKa8_Z2aysrR83QFvgZsASWMEhdaXMe22cizJ9OhVSXxR7qfBwGcEJu4gXC2KLSIt6Hu1MwPVM_ZSkX5pRM3Wg8

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 08 Nov 2023 16:02:19 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4f5q8xuyThAOtoh_ej3JUQ&google_push=AXcoOmQceTli2b46DKa8_Z2aysrR83QFvgZsASWMEhdaXMe22cizJ9OhVSXxR7qfBwGcEJu4gXC2KLSIt6Hu1MwPVM_ZSkX5pRM3Wg8
x-host: tde-deliveryengine-production-bb588bf9-mlx8p
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 sync
x.bidswitch.net/ Frame DECB 43 B
145 B 45ms
18ms Image
image/gif 3.123.196.74
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEJXImplc4AIzOBMKGDhF3HY&google_cver=1&google_push=AXcoOmTFcC9NwCPsaf1RA3wl-jnJBP4mp2SqCgjte-KwgthVjo9KqYZH9E_M7dw2JEqAZBY-2sGr4IzCiTHtaZOHy4CQKO8mERI5eDY
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=9812672228&adk=3541318952&adf=1004996698&pi=t.ma~as.9812672228&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337885&bpp=1&bdt=283&idt=367&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4558&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=yEOzzq4M2D&p=https%3A//cybernews.com&dtd=372
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.196.74 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-196-74.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DECB
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEMOBqq_4Zvei4knImAEIgLA&google_cver=1&google_push=AXcoOmRV_eLvBBXnSg4AZteF_Ygw7ApsLDymToTzMY-68k5rjlwKzJg2Bm4QhcadbU2Z1q8-MZoR4j1i...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMjQ4ODk4MzMxMzc3NjgyNA&google_push=AXcoOmRV_eLvBBXnSg4AZteF_Ygw7ApsLDymToTzMY-68k5rjlwKzJg2Bm4QhcadbU2Z1q8-MZoR4j...

170 B
188 B

36ms
30ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMjQ4ODk4MzMxMzc3NjgyNA&google_push=AXcoOmRV_eLvBBXnSg4AZteF_Ygw7ApsLDymToTzMY-68k5rjlwKzJg2Bm4QhcadbU2Z1q8-MZoR4j1iyrO4s1CqVTQ3hKRH8kj0kkk

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMjQ4ODk4MzMxMzc3NjgyNA&google_push=AXcoOmRV_eLvBBXnSg4AZteF_Ygw7ApsLDymToTzMY-68k5rjlwKzJg2Bm4QhcadbU2Z1q8-MZoR4j1iyrO4s1CqVTQ3hKRH8kj0kkk
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame DECB 0
12 B 42ms
28ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13ITiVCAbws9Ic-9a_ly99gUMb_71tDwoJVM9pJiJI4ugMvxHMjoj8fgAsR22Fk5fo-N6JCQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame AEE8 1 KB
643 B 44ms
31ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2895910089&adk=4004477476&adf=3455423724&pi=t.ma~as.2895910089&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337886&bpp=1&bdt=284&idt=398&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4019e175c95576ce%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MbRkZpwDWvwgImp4hT4MxuOzfwlyg&gpic=UID%3D00000ccc31a35fda%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYOaxCzChjXiL5NQ3guXhLuXwECNQ&prev_fmts=0x0%2C749x280%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4766&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tz4yikkSlt&p=https%3A//cybernews.com&dtd=736

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 85222
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 16:21:57 GMT
etag: 48472445140208031
expires: Wed, 08 Nov 2023 16:21:57 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dpixel
cms.quantserve.com/ Frame 4174 35 B
464 B 122ms
22ms Image
image/gif 2620:116:800d:21:c5a4:625:6563:a5bb
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFCB7wScQeENPnwL1fOrhM0&google_cver=1&google_push=AXcoOmRAyw1Os37E5iAdkp5cQ6KqJjVmDY6Ke4ElKlhZ-7yBvdWRB2IbH8a9D03atU7wUo_P0nAY5w2I9MT-ZhJUH7nhI7NIontsEgc

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:c5a4:625:6563:a5bb , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 4174 0
104 B 217ms
80ms Image
text/plain 2a02:fa8:8806:13::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEIJ_DOCDa8ggf5_GIFniW8k&google_cver=1&google_push=AXcoOmRk0OxyVRnPoEhB8pAdBWI9sFaKEI_b1vIYBjx0jG_1s3gIfP0CzxKm1ZT3XA1rX7mHeVtjluvFPZQbv7h66PtE8rneSI9Ugp0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:13::1370 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4174
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlV1eENnQUFBUHJQblFBag==&google_gid=CAESEAXunFfiru-LYeQoSctfnMk&google_cver=1&google_push=AXcoOmRsunc9najVIZA27abyhxokdo8H8Y...

170 B
188 B

43ms
42ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlV1eENnQUFBUHJQblFBag==&google_gid=CAESEAXunFfiru-LYeQoSctfnMk&google_cver=1&google_push=AXcoOmRsunc9najVIZA27abyhxokdo8H8Yg6miJsp9quPF5INXi913KeopBWi_6VL5mipvNfmQ05MrCgRQR2ijlTV0x-RsWiqmO_3g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-cph2320040-CPH
pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1699459340.528126,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlV1eENnQUFBUHJQblFBag==&google_gid=CAESEAXunFfiru-LYeQoSctfnMk&google_cver=1&google_push=AXcoOmRsunc9najVIZA27abyhxokdo8H8Yg6miJsp9quPF5INXi913KeopBWi_6VL5mipvNfmQ05MrCgRQR2ijlTV0x-RsWiqmO_3g
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4174
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEOL48nYlDFxmcVq-UKzjZvA&google_cver=1&google_push=AXcoOmTBHkvwbpRn-A82x-f0P9qiJkGRO7MSqmlj_KR1K-OYQvDJXuEXuVs3Ivk-qDt5zZjAWCw8B81gFZ__PRZkLGEUVmmXWV1mUA
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmTBHkvwbpRn-A82x-f0P9qiJkGRO7MSqmlj_KR1K-OYQvDJXuEXuVs3Ivk-qDt5zZjAWCw8B81gFZ__PRZ...

170 B
188 B

33ms
31ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmTBHkvwbpRn-A82x-f0P9qiJkGRO7MSqmlj_KR1K-OYQvDJXuEXuVs3Ivk-qDt5zZjAWCw8B81gFZ__PRZkLGEUVmmXWV1mUA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 08 Nov 2023 16:02:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmTBHkvwbpRn-A82x-f0P9qiJkGRO7MSqmlj_KR1K-OYQvDJXuEXuVs3Ivk-qDt5zZjAWCw8B81gFZ__PRZkLGEUVmmXWV1mUA
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 07 Nov 2023 16:02:19 GMT

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 4174 0
173 B 131ms
29ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEE_tGlSPsDIywFhuhnEfrCY&google_cver=1&google_push=AXcoOmTzocO6GRKYqpFlGWPTyrbt4XRZSazUwzDEYS1_sjp8U6TufTQ_cHyMZh_af_DZNHw66oCD4X0M_MeVf3wSQKjK35pS5usb_A
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4174
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEDXLSYBDMRNkpiZtXq36zxw&google_cver=1&google_push=AXcoOmRb-tzrfNsYWjkXmuWct2cuekLSePTodGt5SNkTSL0_N9KEA9N6yMpVz3QIUZwNVpK2VL_zax-nyv3q1O...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI5OTEyMjI4MTkwNDkyODkxOA%3D%3D&google_push=AXcoOmRb-tzrfNsYWjkXmuWct2cuekLSePTodGt5SNkTSL0_N9KEA9N6yMpVz3QIUZwNVpK2VL_zax-nyv3q1OFYZ0...

170 B
188 B

41ms
40ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI5OTEyMjI4MTkwNDkyODkxOA%3D%3D&google_push=AXcoOmRb-tzrfNsYWjkXmuWct2cuekLSePTodGt5SNkTSL0_N9KEA9N6yMpVz3QIUZwNVpK2VL_zax-nyv3q1OFYZ0nQ-MVooDS6d4g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI5OTEyMjI4MTkwNDkyODkxOA%3D%3D&google_push=AXcoOmRb-tzrfNsYWjkXmuWct2cuekLSePTodGt5SNkTSL0_N9KEA9N6yMpVz3QIUZwNVpK2VL_zax-nyv3q1OFYZ0nQ-MVooDS6d4g
Date: Wed, 08 Nov 2023 16:02:19 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 4174 43 B
363 B 128ms
30ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQfAA92oVik17rJLIMVRYsAGtCjG95H7kkEAFzQDdyhDojr82Wq3YCESBIVXzXwMuk_XItHTWMP3SBCPV_D1H9YQqx5epEt7tM&google_gid=CAESEOHr73-HmgAwXkbGDoSv-po&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:18 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 284524
expires: Wed, 08 Nov 2023 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4174 0
12 B 51ms
32ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KqNxFvc-CpZN7-qKN5YquBLP36CX_-zvUQl0XIo1PUTQlR8jvSLtVW7jbW6Bitx0gXE9td

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame 0B32 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 03bdad3c466dfc122853d82ee604a6ef6f60248541e3ef3b16f38a16c5427514

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame BB16 41 KB
14 KB 24ms
18ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ad4V9RkYdUbcFq5vBuqeqnmeWnUwlGI_JND0TyEysPONuKgscuETpOIRHDyphyS9cNBSzNA3G_CDLALvK7nVOBzGpHctKVf9hwL7Y3wTXgCEy-sDCmonTijw9kWUoiF65UzyN3u9Eru5db_bfYfgQmYjOe97Q9QPnj4J26e__XR53cqy0&cry=1&dbm_d=AKAmf-D9p8EaSg90BvMLMulQWs7qUME_z17t7hu6qKtJhWy5hJkyuRS12HjIdPVLesm57IxPdEeBeivmEJh1_qb7f-2BHwgpZGgYGkYwEEoIDyzbCdjSTQGIe7QmSZiFZ8mi5UgPCqZEjYe1sZ0Xj3WfDaZCDB8L-87T4FUMs7agOQmSjHPKiLbIEn4CMXAo7scZ8lw9QYKNJdTQXR3Hhs_LOGoixA4slxv9OFgNRWKHSwvant9oyxrWm0roPXSsiDEKwnEmBn_XqcZLGoURKR3moGc5y2pjhR6SD7UL2Pk-EMATXs4iy3z6Vse3v5fVh5J1jkEQ94w3hXpzAtpTk9Dg_9YUI1bO0_mzUHplOWPTPo4V1HGU1tw8eJkGZOOyaU0M5R4Uhil1i1JfldAvb_8Uq1PglW_kHtFoD7-njUDJD1Kiw2VVrs6v5IrAIlCZ2hgad7ZmVI1bU0fHp2xa4nzRGIyRmfjrUJO82Gb6mlpOmrWDQoEQBMHk6WHT7OHo9DM8pQm6xMeq2RFr9KWVrJStdtaQF2jvCVQpW6i3qqO9FKnz5sBI_PmFtMqZGWfjhMLiYUpyE9wZYGekQjaK-PvejNY7IpB998q7lJN2WMjhVzIzhbpVra9t1j7ym0ysnnaTuClKHXEoWdhstYuQNdSrmczeDMQntsWHjB7e3jvxPJSg-7bRQ7ocKMBQ0At64c02Ow5jx__CJp8MKyaHLQeFiaz_8TLh0GoIHUsqkI1KMI36yi1UuIRt6hbufafI28aEIaFmRxmm_fv9gKI1fF1FyOMZL1MxOaJqgrNWkhwGAztRODjWnn2OZ7lSXe4479vxqMtbDfi2D8H74yrCFbhtM2xWLRN0De48cfKtNTLgs2INttyx88EsoNKs0AVdV8rbjZa5eY4pqjp5R-k_YWDsKt2g705qCpJulzTHio3fSMjYj3oIw3kkFTNPp3OZmOUH0OQ3n0w-L7FtE82o_8G9kLnqXL3VAGrjrK65y3QrUikzzMp5UnvfSYvkuEGIxwK1EeTAFgXqGJ3V6_vZ7dPwlAGWX_wKr7JHeQYsmVi7aezYxX7m7VIxWTtq_S5jvvUtu8VBHbYlujTeNBZOezsPuauPSPz1kPzLgYrtkNjJrHR0dm2ELBWGXXsdr303pZ2hi2HlKgN3eJauDvKJc9uKOpb7ECFOO7TNbV5YSdbN36bfVKU1hxgbRohxcH8_cmq4qMKTG6Lg1zuCe_DizwfGgPVrW2dxBabZ9JTTWIgvUVDdbUDeUK2uCx76yIqFpzlSTTVpic5H3kXmScfZxFajhtdlMgciQReIH8r9ohHnlY8h21gnWijoEL02W82ThmQ7iy2P0_wAXvtky-tgplBrWnxFowfZrG9FjgaJMrztLHmrxZ7WSSlMW_-bxsXOD3rbuR0LpwfxhMgTxtl6q_KV50ZNIm8SQanjtgSmZ2x1vaaICjVZn0JMyHMH-LKZ4iWOKQXPjDZsBVaBvLWSMDW5pnmkhozhHFIkSGsNv-YQet78-1SIL7M9YoOFfkz4Z3gucgG-cKuN-HNswKNes5GhpnKXjbmswO2l7C1kB06kgWGCKFBTndhbMHPi9TGGbp4_dGx2XyNsHfJe5JyuayKzYUiuR7YU-zZeKAAWG5bEHWWLKjUVQLftnlyqBoXNnoUxsIZDJ9S0JuJZ_fd_H9KV2mWZq2HtiweWJiVJw6EOnJhbKL9w6M4rmsrcNpML_XxB-4X7ir3tiC1E52D9oVyRsMNmFIyiJRQftYtc9Ut2jhCXxKXhIeNm97hOqNd6LYKIh9kk1wy5NXf1nIezWzk3I58bRgka1ndnHnAmkk2E-cYl1zSD-ZMGFSjPU7h2ti8EMMaznEmPg8hBStA1_fJrXAUMAlTaeke9u3fy7cQucUT1aLEwqRRNP07eT5eJhjP4y2cJVm-Y0Cy9alLU5U_jDSbby70yapnEKtyhp_YxC-51r_DiZfHGihNudcKbcD2Ftiw34HfHnPqDO7dN2UZ6-ns4IH5aMSRaUB-RVke8KefArSAessfOXO-5AVuGqZmo-UPPlXkDLJh79qalojbwlul1gzGYN7gZsqeYdEt6qrpzw7eAylVRiqXToyGWM7j8_CSmrELOgVVGw3kgTGAIMPdcyCNGTn3s27sNwBG-4FiRfZiJn_rWVEa5F-hAm6Z8qQi3zQIxLD88iarLyj2fXijrIDSrAjU8WoS4ggTJlKJCwXC_A-yGJNamNLJnsCtxaEuSIHA5MaQy9jdgehmVX6_MbKxXizc9sTVmrxFBophMGeEEwSriYXUk6NrMWw24Iw9m6sEo_s6zWn6W1fF8QcgVLc4sDcdoJOWx_Ne3IAUPz73_6f7EVxO08jHfvw_l5YvZmzYGJ5VQwMmL2zo3NmujogAXNBEzv371HpMHuxNUlff-dDV6E6k_HAdUri6sLXLyQowMQZYX8GwzY5qVghO0zUkcp9-EKb7cIcEzvkiYlpHUsOoUyuIMkzbLoITSoI551vWrDC0Q1QE6Nhlund7pNb0nqobhGUYHWzvZk84oeVESlFKlr_aiRvEAZXsRxNp0sPJiUGfDAhDs5m4Iz2gANQpPQy-41og16hq1hZnxswNfsbuQfRCxFXtmzIthHFhcMTg2C2konvLl7l7a_arZAuarMK20a3KR2OdsZwsfTBl9ktKQjsIOIYhPV0E88_2mBMCu6viPVBHzAD1GxR0ukVCdo4SGPX1Yh4KiT-BUbV2oSs4GcvSX409EpgJ3TEfH_WB1ML7p4jqQAgaUFVcs2oVITvGjR_0QByNFJ6fIqk-hPSxPCDwuoL-c4WUpeOlVSmig8gWKX11t7iyPGRPm-Y7LN8QojyQc5MzKEojAE3nfNkm2QydaG0ePbFC3f3AmIwzk60jp3nZG-ErPGwMVl90YdxJu8k5DVYcqesaA-5PHmlQDhyGItynfoeoDz5HeCbSaR_WHGc2cEcBif9-y1DilKOy0gTFJlb3XYD719gl-WOtEcOz6dgT9H-fAsrq3nvy6MJU5oil8eZ1JrlhGRv7TfWvwaEMDYv2kJZfI8ueNb0BFfjhMIhlp4b_ZPy67XVIQx6nrJ1lNBIh9fTxYvL_lqgRpbTvyYjZjscfwKvCfQ9O9--5S8hp3dhuKs-WHxWV0Ug9A9e17L72uG86wvfpuxs7x6hinp2lcFEWGOihCIvBMNrn9AsYmEC2mYfNVM7PKqCIc_TgQIx8xhigcEOqdWlxgOGC2KVSiJ3O5UMIgeefY6qOWqEjeX_RWtT_PiASaGeuL4xLIpU7w2R8kpvDEQOnKKDQYSSqkyxuzX1hbzLjVgjBEI_6mRvcxDW0qUZkHGKFY4gJusCIb8oGNmQQu8ntrIgtOHVcdl_LNu4CMkFUolGUsVIkZJuGmdMPr4dC6tEvV8fMt0cqhW36gpbt8rhzaDfKma7NMrJBOU-Y38bGXQUczINBsGMSV0C8_RFuaKYm48xopQG9JfLHSQSSGXS7aO4ILCbaiCir5QpEh9xGMu4_PEyi_dIjStv8JPVa73SmTesnwtp7GaGkb2AOlRRTzNlSBEiz8I9Xo9x4RdIaK757ZtC5zgkxkG9AVdhB8KwV--IBkMjNIrUXgGrX1rAtOfcTYp7KpW9AhCyjFLNlwXT3Cifqj6LIRkc-Z6HvUY7eDeZijKF1gStzwcQf0NT8yVgADdYdhdkGYe0l11ZyX69TXXhDphOu_f68B1M5k0IL_W1hLAT7Z6q8g2Cqyp7ZsYtlbwvhuwmGWnf2Q4VFN18hJC8JCjks-5CLGlvlQ2mdcFjCrGhl8ELZb5bEakkRAygfW-r0nS__hCdvBPZ3LvertK8etM6Vl6bNJH3gWtRN6YNK7mLo1dtiKUM8rjFrFZqcrx0BnHIN_x8jPN2s2BWpFdWEaZR4SPujb7zUmovSOsSfKLKi44Vu39scMeyHMQF2YGJrsLFKXg4HjEIDDqEcmeWptPy7hxJV81Zze&cid=CAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB&dc_eid=31079496&dv3_ver=m202311060101&rfl=https%3A%2F%2Fcybernews.com&ds=l&xdt=1&iif=1&cor=8196432674232525000&adk=2935317967&idt=139&cac=0&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 06:26:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 207357
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2024 06:26:22 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTY5OTQ1OTMzOTM1OTM2NwogIHNlcnZlcl9pcDogMTI2MDU5MzM0CiAgcHJvY2Vzc19pZDogMjc4NTAzNTM0MQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame BB16 0
498 B 116ms
58ms Image
image/png 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTY5OTQ1OTMzOTM1OTM2NwogIHNlcnZlcl9pcDogMTI2MDU5MzM0CiAgcHJvY2Vzc19pZDogMjc4NTAzNTM0MQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxMTAwODU3NzY0NjI3NjUzNzExOApkZWJ1Z19rZXk6IDIyNzcwODkwMDEyODIyNjM4OTkKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDIzLTExLTA4IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIxNzU0MzcKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIxNjc4NwogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vYWQtc3J2Lm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2tsaWNrLXdlbHQuZGUiCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3NTQ5NzQ3MjAK

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x93a26508889116400000000000000000","13":"0xd831cb87674617340000000000000000","14":"0x6180ddc4d3dcfbbe0000000000000000","15":"0x9c8ff6de000b67300000000000000000"},"debug_key":"2277089001282263899","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"11008577646276537118"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 33lgkyejwpt3 Show response
hal9000.redintelligence.net/zone/ Frame BB16 12 KB
4 KB 104ms
30ms Script
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/33lgkyejwpt3?subid=&gdpr=&gdpr_consent=&rnd=1699459338232565&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC2mbzCrFLZfWYDv-PwuIPup-7gA6m5b2gaZ2cnKfJD_AuEAEgttfpe2CVgoCAoAfIAQmpAjT2-VDP5LE-qAMByAObBKoEnwJP0MoBeZvo7q_ta-PBIcStN11S7fuqLtTkXfzAAzP-6qQsUIpUQqSAyT6y1qL_fFOfPkhM1b4rck6eRqpgFWMW8icz96RJq2v4EMJrk_HDherbztz2YbOvTgM-Ms3CbcH60kRzeafHA0nHP_qHMuoUR8-AUqIsjtRQJN8VBU9fBxlAVruoBKXzPXma0awllY_eBcpgKtad5QMojAHQGGBbWt_-BVpy3oY766hQfhFgDQ6mLTqgJJrtsXd5u6vgoduOQP1vAOLXQA56Zcrbp633djLpIcUJ6Eqd298jxfarI9C4kW45u6kihhh9_3HZAhxtxh7eRqtNtvaX8J3vvBrvgOKBw-S-pRUfdcy_s1-42eQfVOn5DJfH52Hwe-CLTMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB%26sig%3DAOD64_2LLfF4xeUB9JCobCAu67Mhmn4jog%26client%3Dca-pub-5928161074779380%26dbm_c%3DAKAmf-DeIfZHGoWnT06yeo4Yma5TpKGSCw3X6kh3Fa2bt2z65h2RedDoGdnht7HvW8NY8ZKqyu75ap1vg2B9WuMPuUu-gnQ7rzzxQw5gfmjrMGczm8QDb2SDw2QgUf3aGqr0IYjKrrVn73340AuUoEOIty6GQZy-3lvv-O3e3WVjZzNE_gTWvrE%26cry%3D1%26dbm_d%3DAKAmf-BglPN-28nuaf72W07dZhhuZA85jxWTYJYg-pa1YEnFTYwDVDbNhGs-x39k5oCjX18Q7jCICdqU8Bljh_L4KxEMFObWvwMX2LcoDjUCrYtl_vDdgyzRQBd3xnZBCINCT6ENa2LnyogsQ45XsdOPeNDOpj-GV9bpj4fDrgyMpaJSxxWuO3BGis75eKkYyRV5NkRlY5cCHLZ63BU97YrQsQPuGHMauXSqUDeshFlt_JCntykMMcTlkQG_uz-UA5yZpg-rER72m9HewB3D1Wm2VWhULAk3edRluOd34fgNcYP7relSeAElveaCS3ufufJnOp_MOxC7yJOK8tXuUDj-uGVwyBloNdCPVGD1GR6Jgf65r7zbsv2bwHEMFXUzFtWUGJJvA2cbinP2v6d_V5KJtzn240fvQgFwwjjCzv-mdyQxk83b9AFFW5mOSbgTojoIm9Zd1J-yRtkCtutODFZ1Zm3qz-qooUuT-dxpkYg9xI-HZGkYidxZkwly0tsp7qwAf9dkeHwrKxKW3RQ6SV9Q5Y7ay3tU8S51X_OLpQTinHfyDz91oDl02m7BmpH-GLZygwHVtsu6fStdLOwHiqLAMCBE4GUtSilHabKzwg_KvcAOx65U-zg%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: 31076bc627207770bab8842e1afb82805a4a4a1b9a9a78fe05a60891ab69dd9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Wed, 08 Nov 2023 16:02:19 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4243
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame F13E 23 KB
8 KB 23ms
21ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 66444
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 7799
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 21:34:55 GMT
expires: Wed, 06 Nov 2024 21:34:55 GMT
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame C50A 41 KB
14 KB 31ms
28ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A6eMCTNqtcmrTSKfyBjfjDnPm0xEAKAJjVVrjoJ2cmn89afgMBkeE344QiwCKkxGWzmfUYqHLSpVUsEHoFCsZX7SA0KYPBpMraa5akszy2hltr1TI-cJ7NmY7Y2qO_Uam3gzvj-hcmH23V8-jV_gMGZuglLsgz6wQh4EngZ_Z7tWnqHFs&cry=1&dbm_d=AKAmf-CbLCl0IPX4eUaNn5rIbMp4Luk4OAFFJv_OChOhR_gpSrwSPG5hXZKN5p02R0CQ3dAPRhJvEqfPS3pgv44GiFIBZzf80QNAYmKy-yOnOaPY3yMTpe-HY9SDsZ8qNYRrfXS7OMsQNAfMrBDQ45H9lR5YCK3VzX1hjPN1GYjV0Yl_8DrwOklwWQeWkbXmSs_cuJuJPNmPdtglpn7S99GTDz5Jww7gczEigfa1VXnblczitUAoJktYjBOMCd9UkJ6zZ60GAa4QkTbx9ByFGzSEsus2bSi3oZHZIJ-ePv4ejfyxPrfD4Yr61zTk1q3bsXdD2GAqqohP3srrF4JyQbOuDgAcJ0vr6jeJposboCND2vWsYToWDJvOlLHuNQxNIeqz-x2kdcw0jdD2NG4rQFHS-tnvqqTwMUBFqb9OyQDpRA7dKNh922VojQTx6Ets-aGJEAjukwIVDGwK1JgoOYBUnELZoP4Fb4HEB1MH7vHuFOT_f2T14fbzEIoIwvHPJFEWmIojI0-q11hF0D0yjdN8fP5orZr34ZHfHrTV6NLiTFf296cC8PyrVz46avWp3TUbHGZdez1ttyeuU4x9JwZLbJHPCSrjPql0gwv6tfdtsCWrskZM284d6ABnGejiHVGrC-eAyVR059zhfUogo8_X8nLCNiu5qzIvqO_vYxZqBUF3aHPH4s8LJcWGAtOJZ1X3GGy8y52nEtTblAci_fzCPUBJbCzDzFQ3AE33Sd4tZYB46Yuy4-6JqakkrcY86nj-H0CqnAfWcmM2_uK4jxIqIgPFN0Qy_3cg-dyg-5CM_9-VfLe7ioiiRuyWnY7KXLPW1WfGH2FsIRz8S0UA9vmYLPWqiPQQsq5NoEwV8HKTpt-t14cdI9RRpxLmHoeWXllTzUtZciTslrt1-1YOMgKFj_220cWp-NwcCTXW6J9hyAlIS2cF_G_bvzA4PS8mSyOKQHbdyOCM_jIjoyjlvFurDI0eUF4bZuqZJcb1zDUx0EEjfQncwwnHmGofZ9ceziAwxNZh8ygU8T4VchB3PKJVCsVupnjxlZmNoNtVC8a5FRp_tK0C3gYN68oGbXpkFY4u-rdaHCIlqX5J2l9GjIT2MSeWZh6ahZkbDutgY96AqZdIUDPLLdhxeBzlTvABrYHj6a7ZFfxwdNKmHglxot33Gc8YkmCVaE9g9Y2X0s6qp1943Q6QN8GVJBesUWsZVQAmpjV6gUDQ0qMIn5ELdn_toPlY2GsDhyZjAu3FMeSZuMvxrSUoSCUJYVs-I1B2qBpiKUa8MkGspdjDq_cMjGVWecWN_IgF16bcF0nurfVFw1n7Sl3DeyPeQ8TsZTxGJyHRN-vVUoq12lBEZOZF02DIk3osd_3_8XMsx1o9n0tiWv1VfdxyC9I_ysNdoHXIt42UIOBn7Vnh8P36oITdtwH86FQs4uCkHu2Vdo-YJqJApKItNKfvf2xJefEtnAJeQ1T4KTcTbMU2EY4t4D05E_Z88Xn4xb-wS6Wqyq1dcHPjbArEUADnpZizOgFikPA1-mbm_jY7aqmpU0L6Clax9GUzbNF8nUyOsSeayl1Q90bhz_hbTOWnCK8JQ9oVQa6CKHXd1Ez5ym4w-cQ1la2Jp4dNUotxT-GyAhO3Sy4jEk7l6ma1Eh6WIjkmvTFUfc9DImJQQPyA9dTfLXjUdU3k5jRHRoYy3G5rmmp23viNq7899_oY5kzVZaVZp4NFEk_1LRFndDePrV7ig076h0JH5byJqJyFHJdk4C_E7W_AfABE1_EtLD6HhXCG6cezqkd6KcWXV80DkCVrg5aZY7z68KOtEgGLRZ1rE3m5dFKPKm7SQowvgDtJYUC3fl4g_BkNR-uMa6kEmO2MaSEaB3xcQp-smI7aw0DrK8nwVoT5nmTlVXFo8l7V-l0GptmXdPZ5FIFNB9ebbZ4O3aAtnT9zGaUve5JV1ObyaPKLZd0-92j_BDJDogq0rvr25dmBD8VLWIKqt8oWupnO-JRq_8muvUvQlkhDQLvgN2k15WWzeze8ZPW4Sv-aadFeADrDSwEIWVTL9T9LvBsfpbzhG3TAKt_JE_TYpEjyKcq72Frg5K4r7EsQI1IAKQ0DHgbEKT1zAre7c-iMewos9RiyzILgv9pzoUp0tCd45kX9SlUBQU4Muhw0GawduILg08sVDr83y_X4cM4oWOUWpxlfdgyNyAKXiRsaLXUFq7ejihUNYhOv09YFXTss-SqamtnuH6cUjOKnEDHp7EGlz0Z2xh5BM3c6MlyyS4EM1z6NkaPfp9ppwj1Yg0s4S0QESluj_ccTjUci0PiTYbnIvhoaJ0VUcJ0wDaQZJdRwdlGo7aqSY4JPHYyTTygSFeyrUiINBjR5UFGC3djpPHsyjD0COvutT9_WNa9mrsIVPM6Lh5PxUtJ78pmM8bIbOL8D2G7_2KvR1mlH4_cGM78wBpeWNIa5RNEHDeFK2g3YNzNag1TqHOoGneyiBhtgKvwGiRUqumMA3jPlF5e1s-9KxtDLxn7bi8j8DtdnzBx_dmOPTNbESyKMZenEHJARRUvxOJrj2YBDrKYzaUiBQMz09gaefoDs8MsnWsR9_Z652DUxfDdKNnOWR2GqgWxH1CUrYj00fqyNCCA8JApgzA6dvXsFpUtzyxq5h0pSzvyBPHtXgK_ms21cA3-Eil0hHDah4zCYNEtBaxP-rnL2BhSQr3rLtSCzsyVd_X_Xgxek7UmT8plLEO2l4tLDJ4YOl6Xc1EuiOPAGCH3ZG4PQJo9j662gyvaudE8wBvgSL1z4CHkPFMjPn7-z56Oq67NN5VpUd_wrQz_KS1k0DlEVqWcRfvwVqIxDeVUlfX8uQGIR1CPj6SFpf5estlFcoB7hU-RiO4EE_OW1GSJCNudbC8avJY_APd7o79Uy6tAw7cLkZJwqKEEIZEDoXzAZA5RhUI6tMsj7CLUqOlzryKCAKnjVAxDBj2BRle-KFNWsekP6pzD3qDEN2afr-t93d2MyZh3AqTohGkrllwytRY3Y_NDrVStT9EASOxHxsJI_uIeoK8KjoSLKxuM8iA_yfvKzlZDcYlrltZkjo9Od9HpZSAtnC-CnDmRG_Kj9dfO9odEcv92peDBFGTx6U7BIBaumpIXjj5HGIMkp7APgX_1ZbOsmsJZywjy49bDjTEq0tFdICu0RSTYI2SeATjIQG6j7-rTZnKF-QeUS8vQZl3DUK4Pz6YwLDqB8K59afla1PngAB6ugsoCx0INg67GbYIV7aCDDCL33KSBzHWNLLnCJiFgNqffGguBy5DyWc1GiRD8Nzp-ieQmk3q7tmQ9w7X3KgGA9_mDAEwDtkxGRlYuBpE2kIpC0ODoNNGu7msV1ER-BKRIhgslWaFpuB0JTWhIUfB_zssZh9ycyHcIoN25T6Ccv8X68cjDiDoqTD_Ww-uR2fY1IWOiltj64zhaAAi6y6aq8BMgNjOmrz1NVTXqLqkbk4clOOwJvB7cT9Co8WWK82BRg_vbcYOUKJgG3vcl5Va5aQCf44zr2k3mTl7P_1mKpTpGD1WxPGog67gVXd2KZReKfCvW1ojrZXpEJ2qJ9a0ycIot31cR9ihTMeNQuPUnwwhLOhvW8E7FZfjBNtulNnZ0LGI8gggY_kMPHpO-_IrZJU247XM6Q5K438JlQR6P6P-vbEjG3VqgS1yGdIM8lw10_xzjFg4ugyJgdt1ruFZa5Vk5tAtdtOUQrvii_7RMP3O07_oSo0GoE52K3W7nlLF711eUlKnjE15N7tqhF18Xz1eZDe4cwqaTw-DPuKT_O_U5rTS36wZlZzdH9QkyjQsacqwbp577v6BaCkvzFWL290XVslzSKsUD8wq3FIALX7N7sPEmr3q4WW77EUamIBAQBTYthVaqEaIXz7MN7eyQP4uEQ2vQ6OeOKQS65qvHG_xhhhk41OGezPwHml687d-x2-AnGi7Q_zR6zIxyI0rlRVe4VC2U1PtJqvjW4WQs9&cid=CAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fcybernews.com&ds=l&xdt=1&iif=1&cor=14487535150792729000&adk=2515327512&idt=190&cac=0&dtd=20

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 06:26:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 207357
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2024 06:26:22 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTY5OTQ1OTMzOTQ0NzI3MgogIHNlcnZlcl9pcDogMTI2MDU5ODc5CiAgcHJvY2Vzc19pZDogNzg5NTcxNzk5Cn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQz...
ad.doubleclick.net/ddm/activity/ Frame C50A 0
499 B 98ms
79ms Image
image/png 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTY5OTQ1OTMzOTQ0NzI3MgogIHNlcnZlcl9pcDogMTI2MDU5ODc5CiAgcHJvY2Vzc19pZDogNzg5NTcxNzk5Cn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQzCmFkdmVydGlzZXJfZG9tYWluOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0Igp4ZmFfYXR0cmlidXRpb25faW50ZXJhY3Rpb25fdHlwZTogVklFVwppbXByZXNzaW9uX3ByaW9yaXR5OiAwCmltcHJlc3Npb25fZXhwaXJ5X2luX2RheXM6IDMwCmV2ZW50X2ltcHJlc3Npb25faWQ6IDE1Njc5NDE0MTI0MDM4ODMxNDkxCmRlYnVnX2tleTogMTAxMzg2OTM5ODk3MjU2OTc3MDAKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDIzLTExLTA4IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIxNzU0MzcKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIxNjc4NwogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vYWQtc3J2Lm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2tsaWNrLXdlbHQuZGUiCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3MzgxOTc1MDQK

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x93a26508889116400000000000000000","13":"0xd831cb87674617340000000000000000","14":"0x6180ddc4d3dcfbbe0000000000000000","15":"0x9c8ff6de000b67300000000000000000"},"debug_key":"10138693989725697700","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"15679414124038831491"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 33lgkyejwpt3 Show response
hal9000.redintelligence.net/zone/ Frame C50A 12 KB
4 KB 82ms
27ms Script
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/33lgkyejwpt3?subid=&gdpr=&gdpr_consent=&rnd=1699459338232566&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLgwLCrFLZfaYDv-PwuIPup-7gA6m5b2gaZ2cnKfJD_AuEAEgttfpe2CVgoCAoAfIAQmpAjT2-VDP5LE-qAMByAObBKoEoAJP0Nrx9IyKj8xDNVrnTtXa3dyVd9xz2797OPyq0jEOpBYMQeyAgCssRWGZz1TcY-0vgBcLeFOmoUNUAkh1X1fdiAK8fNzwOi370tjpHhq3bb6O2Dv4l9XlgGzjq22-sVFDsJ__2z8A-YtcXQ9CNVWefRDoYvUM8kg7QhNA7pc2Lbc99eZvNqIGBs080SaHz-Ubv6oC-SxEmhPORIMvuZroVu2MCokR33pJXMMaWRxUh0FMOu9LY9j7_FSv26MQ3ZCdqPBbGxyfm-a8isESgBUXiHQOPAGYpOrtayRIZr2s2rpbyiSB7PZGi9Z0aEhMLi0j516VqANJZY8b8od2aK51IWuLvh8p7Dzv6FekvIgSM_1e4s9uCb--sKSm3ooOrL_ABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGiDAwqCgoI5LSxAu61sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB%26sig%3DAOD64_0xkGm96nyt1VC0ckM1_q4f1opEIw%26client%3Dca-pub-5928161074779380%26dbm_c%3DAKAmf-Da2jXNEj4sL32OPJnRP6IHI3x2tl122lLVaJ9gQqvjQ_I0vxKEsMVfkNFPp0rX42mvooUfCYXoaj8QunzsbtGMl6cf1_5mqF_YUoe0rKjSt-m1GUbd9W5UYkx62JHpF-RyDh1r7N4aScG0hh7rD6FpJvGDzya3-oDoNgosWtavoh-EbLc%26cry%3D1%26dbm_d%3DAKAmf-CTERzenVEW1ab8SajXHftPrvKrsAU9Llgw-gHE-REeHDtBfRE6N4Oe9mRm2nkTkCYQDrA1uJ_9v-cwyI3W1VQP485xNX_ujlJTrTZ0YRjUOq24vh8lVOyP0RDnhvwuoj7VVTDzlYnH3CLb7vOGX-J1rA87HuKCv5NaFImR_RBd_XoxkbT9OtzT6qqic8n7Lk6_Tx9XAuISL5LptYoLGw8RlUnqSKbwUeTsF4mQY8Ol75BmoDPD3NrHIaPN8eecTcMBHqae_09znaaKTfc0XDIKCLVVDaZkvMn7Zeagy5ZRes94T7tJ6AgCS5BowNdYY6AFT5XOEmPjfvasIJbRumKIwAeD3-vIUIz6pcEHxMQ1Pz6p1Yp5GRjusS59Ud46H4H--FKBBH73AcL2D2VRMzQjsq2qx8eVVNNXexoIbgfQ5G9hSY5FCCQA5Bs2vYyPCbl_p11YhtBz3EtHVBf6VypNSk4R0fWd_FtWnH6gZpEDpRSXzmze4MWaNrfrunepAzsMJ0gPX00KZQ-aunWKS3FfAq72OX__ipYtc9-4B18TA6oM-JhtBo_yeAiPjzzCT8GDbCQwBVULFGlwoxoz0On1FF6jzC1sP3L983TNJ8BeEff9UzA%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: c09985c53ac05df8f524fb62f17830ad905b136d20f455e1b651990ff70b6fab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Wed, 08 Nov 2023 16:02:19 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4247
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 8E03 41 KB
14 KB 32ms
30ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bmaxv0EVjSGHLQvdw1VuBFYCtDFfzcmczbpikkQ4zBbifk3mVDxUTFq_DnsXXWNleTgV5aJsGfvdyrEvaUPouzHNb4Wv2BVJzr4bhMNNHZAl-9iDEk78XPmfFWz1p-eTIwxDHSTI738PMODsk2BHxtdq4oGUEMyjqC3-jvCS5i651d2vc&cry=1&dbm_d=AKAmf-DrRgF48sRJ5wY7EmeTEjLCnl-VmgY-rw5kry8gNvPWGCPpvaQ9mkLPK6KuYWeCOiSDZrHg1b_2jY93QjnE956CI5-J5AmUd47sOBdkCBcXtsLMF2PW-1V1xvetn_bW149UJtW3DV1z4rlr68ZJYuD6SDqKYGCh5LapqDK0zWluz-mWHPUYquds0XtlTOtdP7DOjwmXoFhreDSMA9Z13TuJYMZ--V7rax3ZD_4ZuyIwve3UAQ5P1wXFz60Cb0ViP-kbbYgsffTSDg9QfMO5_5_CO0dapHJscoZ6xKZX4zdJftL-P9kex-U3zFWSZeOmuHAwDOqD_W3TTmhiFwJI6ktFYdJF-shPZxXjFmxoglvz5qnoQePOk15d0SKSgqoyBbVaL3g4PoZt6D44snTyn5AEiRzWxwUMcJfQD9WtHIGQHZMMeh1-bNOIstOmP70jaG1t-ns2sGPjdJvAUnPIkyiANgI5Jd1exsUtjmHWHaSDElqSZdKL6ilq8xsOA0rfpR6vebvJLlffc6HC0icVU99mxeAnW-YBV96up3HM6SXkQGUeFaSpq1cM-ZScPOirgSOL5wq_--0vKz_HmnBmWiembUunYhqbPsePUPn3MET-Un3fIHJlxvIVW5FabpXvK3H4AgMFdAQjW2-hyMV3q9xOpIqweQ5sPOgtd9RnpuNn637d86RkC2Uji6niNGkUK__i8Pjmjf8TTgjjBOqs_fSsOqnk37z8VBr2g445eKYTIekrDWblTuLWkBIHza-_Mn3ueNhbq92nz5Q7XQFQvt8kSZs6ANxuj-jNoTitbarWfUM1U_ycqOXXRNVnD16o3u2kb9g0fb934LxDEBXXoWkv_B-J4QltHS_30B9C8Rhe4SRwhXrWlFNTGMWUphypyyfeXWvshviKmRfM8MtsNLvC-6BYbons7dNcFlhoDluA5PZnCs8eNFhJVKDw64-paH2xxAfdq3qs9cjCpR643RPbrh_1HOSZ1LIP34NdHbidw-L_bcDfW50AgPbYxv5xasvhdD4BwGPlKmkQs-aw4_XXfUZlycSVkebWjGUIXIuWlJdcOFOTsgiq4_kdGmthdrLpC48of7ZfJf-WoVPApc7qR12XQiNThXZYE5av0RvAs-OzT20SQkMtTootrtGyRpTFwn6zkUdl0CVgsRijah2OmtIIOPLbsien-bntmletNaemPUiOVPN9U9Xjr2dWdtFWy68UBSuFyJwgUcdyo1Zyzrq5FwdlURC2QkS80LUKgvZFGEvJFDZzSqFgBWC5IX_72mK8lFytb_ZSENDGGArUT9akJgJLhVr8HqMwc787HKK7A--IEefCl8ZZs6xvk0vsVsW2wK-Cq0jV8rcPPKj6hmc4YHbEvAOt9ktCRel1HUsnqcKn619vrnnnRpNQKQMaLRJ8oLao0RFvFj_-iRW8vk_sBQtrOfjIMRqI97bmABHEQci34nUaUzL3xcC9jd5xDHU_Jl15OBaj6QJVBqTgayqdpuPbZlUl9c1eftE94AsjgXUav48NdyphvCzoxDqjpPeDSaJbdZbUmR1CVeY1KZ1FDLlXb-ypxH_Xa84qqjiMiH1T4b9RCrQAA2XZ5_bhFxWoDdUmsDbISh_PvexIsSoJ7I3qWDzplqcHfsEGD0adVb0c5maTKtp4WC9Fn_NmnsytB9_Rix3vBDBcAoCYGIDb6wmHcyWfyF1KbISPcgLUO9tpRbjdnF6HLNhUmwbPzntABlGjbrqmI-L-jhMYayrsrPiTQvxgJZmzBJfPI603bauUfBKvod8eC-he7t0xBD7WOjqkJfoR6LiKeDhd78BbKVdXP5bGVsE6Rgejlr2BSfa2EJ9Z3geJdFRnSaqI_L_MoaF-CCjCsuXLwfheacmT1xTyKcgDF2faQmY0LOP374FlYG8smBpUN8aGvr9k0_-jjxkbaBHe5S5T7tBUrXYgFnOFOJPdD1udkD0uYskaM3-_ItezTec6JRLmyuodTkDxhNMMQVaYZ7Pod_b_x6vuAONjgbZDcJDoNPeUiOiEyPwW9FeV_manfFBofNri8irhJikoyiIGGYS2AcioCiafb1dgrkVV8vfyXP6o1cJikTdbcNM9mVgg1UYZwKTK8Bc7xX7TUrFnohkmexubtGpN9BnCrraPN1-YxXuJtw0exe9tzD_86tDrNvQdQDCG4wy-4xDUmjEtONBZrjaGd8FYGkZhT7L546_3DjVfRLrqbutxFj59LSLp05zeaUng2FgZZ9NiFWAQyyUtLQhDs1TjS_xBON9JOIJs3GrB6TRFDpfKqb8c81GUkY-BnYGqYJMd4vV8XgD7G-T8bHz-Xq3RVpKrPTnSp5acGVWh3hO_a_odmU4Pw9udVT5Fl7XRZ67KvHil9VIJ0YabHpen4OevCC_auAqxB_EYuGqTnsfdMe41LW-j-c4fknRLq11o4n17RUhOkyYtLxBG23zqOTGcugORrIg3qS0uk-j8UtxEHyJDuOGPxzKD2NzJgwonE1AZmcIqnYgh3QtaHICrDqFKg3KxCNnLcz_AwqgkNg0nvkMFaC1448NdF-TbapHTGCJ-OQdEc3OcYRsfoY1EBCsTkc4lpsLkpxWm5L6aMmZSNJfxn467qxrasG1N27T3K0QIKkwrutTmOjxC9mkPNMdlgrvNRIxuB_cpRSkwhpyFia_6qZUB_4pI_svWahZj9iWL_4Ly9tNYPJG2GiYVRudCAWFH6M0kJGVuvq_ShRNgmpfo5XvFGOaXhWMVbHdWU9OhA18QW2w1o3823mYTh8-hQVZr2Ww7XyEjTeWemx_qiA0UembomKnvvCKDrFd5Dlq-dXSPQfixPiIcgKA0_M8-_YE0F6O9rISqgp3CBOYWzGtKslHsuuWEizpcNb0AIWGuoTNZ-SLWOyMRUVddcUIxDUH36bR6LoCUgjhwjuknm7UmZHTQib0ZA2YAwA2Jl7yCNLtGJKkrddnaYQfJ8rfc2WNsf8sqLuixRjSZPjXcfIWr8m1fvHZXkNxXBIkJWrVesc-LXw7iyAG3zd4XNfG_ECYLqXuvPUFz0l8I27a27rEjBzqoY_GTS_vtJIbob0usbMH0bon-p3kzjIdKYpmZExw-EFoqQVvDCF1FlsaARZby6ogcouiGl41Jz9ZAPmU1cGQev1Mj9texm_XvM1AepfQX3jZXV_90vT7GLelTWKKtsJHZNHX-aQ2iaP6NElm_ApRNZUJQmyuuoaBbAPl1aBN1mn8MO2TN_vZsFmjeSGlmieIWAqTfEFHSGbpiuzSaWMR1KTKHAWsVfaU-FgewaOcvW-XhCniWIGGOFsp2ZMgwmeer3JAItDJ5TsfSudKglP_j8VS-AOAjxOfj4VcZ5ov25KbflItol7Fc0-DlZr4Oliv9VYhh3f_5FKmwXemeq-zp3Y6OpjiDFwy9bGJAwbl4I9iXaKxM2V95V1u6V4WFBAd3gT1zOD9NJmFD8o-alznfz6Pfon1Fr70UhI8wH8BgvxY8YOxmVH_RszAAs7GAicWCSwtFakRktg19kRbgMnOZoTXSf7obIm2TgQIP36guGDZhlwzfFw1lXV5mQLZz6qXCo_Cmycvaq1nM4p3ufGN73cj0Avup7gOy7kdeHC5P07ngtWSyw4QSf0UNaAizS1xD5JCPZkp97EhKsF2VgjpbgPSL87vWOXGDCtefmAmgcV_0JvE_fAHrSyAfX2E_xb7acWfPQ4-0igM3BXuyfOQPVhl-_3JmaVntzVrpY-G7U3qih5bBgnqEHVmiJL0OSMNVH7sx72KXomr7KrQyAbUWQxGbwiFwpEG_iE8VNQYlpdzZh5J2bQwqzOYhH8yzD7fhTrr0tuk5iCYXwhjzVkDCXJ7x0Q2uH6KEvwTIVaERUfrJisjHyl9-59ZiQJF_KwN6tJMiatFiH3mTRR8bgCegn4gLhbEA75OA3cRsx9Meyuax0nKcejzUb7dwwTvyrfDzsqo66C2kcWycM6VRpSchWf_9KCoMmA2vZ_8NUe8ZWblDET4p9o1iYX-XysuSMZQi0fnq1UKR6eGZR8ne2shoyDjjXwQWCwP5UvDLAA&cid=CAQSOwDICaaNyd8AMPD2TzTvMtd0QMYAEK_sgy_fE6YlOvuUmyjM2AKdL98Ey2XaEazXLZWSEytdyCzAm9oHGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fcybernews.com&ds=l&xdt=1&iif=1&cor=7945756343880057000&adk=1033480531&idt=123&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 06:26:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 207357
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2024 06:26:22 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTY5OTQ1OTMzOTQ3NjIwMwogIHNlcnZlcl9pcDogMTM0MDYyNDU4CiAgcHJvY2Vzc19pZDogMTk4MDY2ODYxOAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame 8E03 0
859 B 75ms
58ms Image
image/png 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTY5OTQ1OTMzOTQ3NjIwMwogIHNlcnZlcl9pcDogMTM0MDYyNDU4CiAgcHJvY2Vzc19pZDogMTk4MDY2ODYxOAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxMDYzNTA1NjI0OTg5MzIyNTI5MwpkZWJ1Z19rZXk6IDQzODQ3NjEwMDMyMzIzMzc2NjMKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDIzLTExLTA4IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIxNjA0MTYKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIxNjk4NgogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vYWQtc3J2Lm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2tsaWNrLXdlbHQuZGUiCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3NTQ5NzQ3MjAK

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x93a26508889116400000000000000000","13":"0xd831cb87674617340000000000000000","14":"0x6180ddc4d3dcfbbe0000000000000000","15":"0xe7f2cb4678f129060000000000000000"},"debug_key":"4384761003232337663","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"10635056249893225293"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AEE8
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFCB7wScQeENPnwL1fOrhM0&google_cver=1&google_push=AXcoOmSBFMMt-sOyrifUfGIdJl11z1ewlbE1089FhHYeSz3yDMzfwS4niD...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmSBFMMt-sOyrifUfGIdJl11z1ewlbE1089FhHYeSz3yDMzfwS4niDxNfg3N3wQgkZrfBaKzVLiQYoAe2MoQ1vv8lUs8rA2847U&google_hm=PKxmLsPsq...

170 B
188 B

36ms
35ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmSBFMMt-sOyrifUfGIdJl11z1ewlbE1089FhHYeSz3yDMzfwS4niDxNfg3N3wQgkZrfBaKzVLiQYoAe2MoQ1vv8lUs8rA2847U&google_hm=PKxmLsPsqU5vTenrquudTg

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmSBFMMt-sOyrifUfGIdJl11z1ewlbE1089FhHYeSz3yDMzfwS4niDxNfg3N3wQgkZrfBaKzVLiQYoAe2MoQ1vv8lUs8rA2847U&google_hm=PKxmLsPsqU5vTenrquudTg
pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 i.match
a.tribalfusion.com/ Frame AEE8 43 B
394 B 235ms
227ms Image
image/gif 2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEOfQTN76VQCek7ORtPZpLrs&google_cver=1&google_push=AXcoOmR9zFat2D5Ea0vmBIxf8y6J5y8z-sCEx-k7hvuEC9RnPdkHSantWKfoLC1N6CEE8PO056lXPWJJQ8xsV3Y-n50IMnSj_LDghA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmR9zFat2D5Ea0vmBIxf8y6J5y8z-sCEx-k7hvuEC9RnPdkHSantWKfoLC1N6CEE8PO056lXPWJJQ8xsV3Y-n50IMnSj_LDghA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2895910089&adk=4004477476&adf=3455423724&pi=t.ma~as.2895910089&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337886&bpp=1&bdt=284&idt=398&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4019e175c95576ce%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MbRkZpwDWvwgImp4hT4MxuOzfwlyg&gpic=UID%3D00000ccc31a35fda%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYOaxCzChjXiL5NQ3guXhLuXwECNQ&prev_fmts=0x0%2C749x280%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4766&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tz4yikkSlt&p=https%3A//cybernews.com&dtd=736
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 822f0a297aa003a6-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AEE8
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEOL48nYlDFxmcVq-UKzjZvA&google_cver=1&google_push=AXcoOmSEiTaMQfFntkHInNEuIu24kJzP7gGAv7pZa2nvcncwQ-7yI3TLzowkPTcGDpNq2eH2bwUzYYC1Rewr3xIM_0lhPCpwp-Na0wY
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmSEiTaMQfFntkHInNEuIu24kJzP7gGAv7pZa2nvcncwQ-7yI3TLzowkPTcGDpNq2eH2bwUzYYC1Rewr3xI...

170 B
188 B

36ms
36ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmSEiTaMQfFntkHInNEuIu24kJzP7gGAv7pZa2nvcncwQ-7yI3TLzowkPTcGDpNq2eH2bwUzYYC1Rewr3xIM_0lhPCpwp-Na0wY

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 08 Nov 2023 16:02:19 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmSEiTaMQfFntkHInNEuIu24kJzP7gGAv7pZa2nvcncwQ-7yI3TLzowkPTcGDpNq2eH2bwUzYYC1Rewr3xIM_0lhPCpwp-Na0wY
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 07 Nov 2023 16:02:19 GMT

GET
H2 200 sync
x.bidswitch.net/ Frame AEE8 43 B
145 B 30ms
23ms Image
image/gif 3.123.196.74
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEA_btIz0Ih--gmyh4xG9mE4&google_cver=1&google_push=AXcoOmS_cCUkWmGXD0OwL9-uIJpvbJ2c7cOyL9l5fV53OhzyFp5_t6DmROISMb9lqarXU4XDQrIBcGyqQWuLdnz2ozoLA_tWrwfnnw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2895910089&adk=4004477476&adf=3455423724&pi=t.ma~as.2895910089&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337886&bpp=1&bdt=284&idt=398&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4019e175c95576ce%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MbRkZpwDWvwgImp4hT4MxuOzfwlyg&gpic=UID%3D00000ccc31a35fda%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYOaxCzChjXiL5NQ3guXhLuXwECNQ&prev_fmts=0x0%2C749x280%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4766&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tz4yikkSlt&p=https%3A//cybernews.com&dtd=736
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.196.74 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-196-74.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AEE8
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEHkJAUL1bXrcz9vbQq3mUcA&google_cver=1&google_push=AXcoOmRu86UNLe3vBuHiXwyBnHMKgxQ4LRKiE9xPASSC_1LlN2oiiicCBphDhZFOE0-mZdF6X6Mgdr5uriud7Jj8fhwKdHq...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRu86UNLe3vBuHiXwyBnHMKgxQ4LRKiE9xPASSC_1LlN2oiiicCBphDhZFOE0-mZdF6X6Mgdr5uriud7Jj8fhwKdHqsq7TZIN8&google_hm=eS0wX1pMMEkxRTJwR18...

170 B
188 B

30ms
30ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRu86UNLe3vBuHiXwyBnHMKgxQ4LRKiE9xPASSC_1LlN2oiiicCBphDhZFOE0-mZdF6X6Mgdr5uriud7Jj8fhwKdHqsq7TZIN8&google_hm=eS0wX1pMMEkxRTJwR181cXBwaHFBd1hURUw5UF9ZWGE4TX5B

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 08 Nov 2023 16:02:19 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRu86UNLe3vBuHiXwyBnHMKgxQ4LRKiE9xPASSC_1LlN2oiiicCBphDhZFOE0-mZdF6X6Mgdr5uriud7Jj8fhwKdHqsq7TZIN8&google_hm=eS0wX1pMMEkxRTJwR181cXBwaHFBd1hURUw5UF9ZWGE4TX5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AEE8
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEOCCPIXjaQCWy3G1z-Lwe20&google_cver=1&google_push=AXcoOmSSUR9lEoW4CKYW5_FG4hUFL4jRNbKdDE8PcuHwmrUBfv_HeS6lueoWEcePfnd-KEISEd-y_a4dln3Fzk99PxxPjiN...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEOCCPIXjaQCWy3G1z-Lwe20&google_cver=1&google_push=AXcoOmSSUR9lEoW4CKYW5_FG4hUFL4jRNbKdDE8PcuHwmrUBfv_HeS6lueoWEcePfnd-KEISEd-y_a4dln3Fzk99PxxPj...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmSSUR9lEoW4CKYW5_FG4hUFL4jRNbKdDE8PcuHwmrUBfv_HeS6lueoWEcePfnd-KEISEd-y_a4dln3Fzk99PxxPjiNYWwg8U-8

170 B
188 B

46ms
45ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmSSUR9lEoW4CKYW5_FG4hUFL4jRNbKdDE8PcuHwmrUBfv_HeS6lueoWEcePfnd-KEISEd-y_a4dln3Fzk99PxxPjiNYWwg8U-8

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmSSUR9lEoW4CKYW5_FG4hUFL4jRNbKdDE8PcuHwmrUBfv_HeS6lueoWEcePfnd-KEISEd-y_a4dln3Fzk99PxxPjiNYWwg8U-8
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AEE8
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEAHByvUFgTpxdlo29FvaLLc&google_cver=1&google_push=AXcoOmTtL5_gFiImA_A8csvoUSO3eXy7KsLkHBrT7fZHVp3GR_QG7T2J3k77GFDMZk6dr9FHEnf9uT-0...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMjQ4ODk4MzMxMzc3NjgyNA&google_push=AXcoOmTtL5_gFiImA_A8csvoUSO3eXy7KsLkHBrT7fZHVp3GR_QG7T2J3k77GFDMZk6dr9FHEnf9uT...

170 B
188 B

32ms
31ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMjQ4ODk4MzMxMzc3NjgyNA&google_push=AXcoOmTtL5_gFiImA_A8csvoUSO3eXy7KsLkHBrT7fZHVp3GR_QG7T2J3k77GFDMZk6dr9FHEnf9uT-00tY4PjieukHMIVd7Cw9vPQ

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjYyMjQ4ODk4MzMxMzc3NjgyNA&google_push=AXcoOmTtL5_gFiImA_A8csvoUSO3eXy7KsLkHBrT7fZHVp3GR_QG7T2J3k77GFDMZk6dr9FHEnf9uT-00tY4PjieukHMIVd7Cw9vPQ
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame AEE8 0
12 B 40ms
35ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KnSNQJaewaruMJvpRHz7zqMyCIxFlZimNImC4f_VkMB2taugZmjqGjk2ZpXhbDaXYN73ns

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2895910089&adk=4004477476&adf=3455423724&pi=t.ma~as.2895910089&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337886&bpp=1&bdt=284&idt=398&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4019e175c95576ce%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MbRkZpwDWvwgImp4hT4MxuOzfwlyg&gpic=UID%3D00000ccc31a35fda%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYOaxCzChjXiL5NQ3guXhLuXwECNQ&prev_fmts=0x0%2C749x280%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4766&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tz4yikkSlt&p=https%3A//cybernews.com&dtd=736

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-56-205-163.deploy.static.akamaitechnologies.com

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 0B32 0
0 72ms
69ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C6yAaCrFLZcvhJ8OLtwfogaPQBMHfuId0gZrq-4oS8C4QASC21-l7YJWCgICgB8gBBakCNPb5UM_ksT6oAwGqBKECT9AoN-jWKACFwaD-SiG-nPsxR6i2bw2v9Rr95daVn9ZPYsqARE-YM9IJ5l2Aoe3wD4-v4s-e5C6wbjcmDtVjjM9nr0I-mNLOx1hzoLtdp8dbjZZUPRMVgfH-Xs7VnjkMjWvJOHSp8HKQgjITd5J0NMMxmhQ2jzp11KmeJVLQcPCo0z5PnR478k7VAwfdaRAg_qd958GLKKkcQLQrFEahh9EGl6VuaBMwuhPlWgMGYQY1PFlCL-UqhpuKBUChF52yujI_OhoM98xxcRDol5B5fOp2ehlhNRBYDS23DTMiaIO8_jDEXReyy2aHxK7ZYFkGvPIDZ5muNWeE03gv_6foQZ1UiMoC4Tf4A6m183rcYwATqItRVTXc02lW4EAL5SdQxsAEp8exkMQE4AQDiAXd2MOoTZIFCwgiEAEYAUjmpJICkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAZ2gAet0_2aBagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcKEJjWCRisyJP9AdIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgHICwGiDAwqCgoI5LSxAu61sQKwE8mptBXIE9K57uMD0BMA2BMKiBQG2BQB0BUBgBcBshccChoIABIUcHViLTU5MjgxNjEwNzQ3NzkzODAYAOgXBQ&sigh=L5IoobUyVgQ&uach_m=[UACH]&ase=2&nis=4&cid=CAQSOwDICaaNPt7W-QjMwt0RY3TORX89f3w-a94vV6MC0Hk-nDYMxQyFiifZzzHMNycyk8SK19vRy1oClM8IGAE&vt=10&cbvp=2&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2895910089&adk=4004477476&adf=3455423724&pi=t.ma~as.2895910089&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337886&bpp=1&bdt=284&idt=398&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4019e175c95576ce%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MbRkZpwDWvwgImp4hT4MxuOzfwlyg&gpic=UID%3D00000ccc31a35fda%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYOaxCzChjXiL5NQ3guXhLuXwECNQ&prev_fmts=0x0%2C749x280%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4766&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tz4yikkSlt&p=https%3A//cybernews.com&dtd=736

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=2895910089&adk=4004477476&adf=3455423724&pi=t.ma~as.2895910089&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337886&bpp=1&bdt=284&idt=398&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4019e175c95576ce%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MbRkZpwDWvwgImp4hT4MxuOzfwlyg&gpic=UID%3D00000ccc31a35fda%3AT%3D1699459338%3ART%3D1699459338%3AS%3DALNI_MYOaxCzChjXiL5NQ3guXhLuXwECNQ&prev_fmts=0x0%2C749x280%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4766&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=tz4yikkSlt&p=https%3A//cybernews.com&dtd=736
Attribution-Reporting-Eligible: event-source
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK jf2y0amzcvu0 Show response
hal9000.redintelligence.net/zone/ Frame 8E03 12 KB
4 KB 96ms
26ms Script
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/jf2y0amzcvu0?subid=&gdpr=&gdpr_consent=&rnd=1699459338557676&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvANlCrFLZeyEIsWwgAe29oqYCKblvaBpvZicp8kP8C4QASDP0NudAWCVgoCAoAfIAQmpAkgBjp9_57E-qAMByAObBKoEpAJP0McVoeSXTz_57FqOng-_RGPjyokY0Vu_iS949zEcPA8s39TlEyh8PfXeFJF56NEeyKSGJ77-cVoJGuF1_eqvhNj7IcpEeBEeDRxjibEMTmH3Gu2UldDp_jtUmiuIfaEul3LSXdU9ZL3H80jHd4a4wQ7zK12X15VPGELFDqqavT9AuL-ncS2f0GNfbT15P8ciNMUs_jdgvU-NFuiwfdOygLawBPG0amJF9T6H0pVb0q0DW9wj_Qdx9wkzea25U57aS4WZWolDVOuExSmDsLB090kBQG1dnqpaoZMRs7uBxrs4fRNCSFLoR8vN9KjA6rNc8rq7u-F8wg-Kt9xwkFz0pyYFO9GhMACZ42KpZiXf3614Jh1KtW5M0r0HykDUzG3fWaDFwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwMKgoKCOS0sQLutbECqg0CREXiDRMI9b-8seO0ggMVRRjgCh02uwKDsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26num%3D1%26cid%3DCAQSOwDICaaNyd8AMPD2TzTvMtd0QMYAEK_sgy_fE6YlOvuUmyjM2AKdL98Ey2XaEazXLZWSEytdyCzAm9oHGAE%26sig%3DAOD64_0G-9PJghANpC-NtSxHxMZhO6Mq_w%26client%3Dca-pub-4647811890505995%26dbm_c%3DAKAmf-C7TIuuhkPfLPhFrxRD81wuHmMKqG52ybxl0yVyx07B6CTy9w6OyR1hdqy6RcLksTQlJxd8U4Du1IDDxPkR8KgFotFkssOeJvY_DfB42LEAH4sX6n5F5Rx6Hd3zMxR-bBVTjxU33p0VnOLJXEXbZAjdLzjLWzVMx0eLouFOA5megs7Nd3w%26cry%3D1%26dbm_d%3DAKAmf-D-MdKVUE7u_8I-1YEF6NBwheLpa9Z8PNWsxD9LRNIwUe3GSY3Yo41NJXrg-UFb8pCwNvVtjVsNaulbFArc2AgFTIaEMSRIj5wp90aiLcGYB0zxoGh2Qpvu6k6hyXA4tw-KcAviKbobQm39xwD44fCf683wVfKj5KYhhp01cZ8GkukM5Q6zQDr57dA3a6UXg_N4mNnRJ_JMFvOt_l2n5jEqAU9R-ta48b3REKlRUQkKN0WHK4tvvP-zpFwQLX5rYL57QdJDhofqNiHgvB69rX5uHI4U7NCIe1DSx-MlMOeWml4noryrOpDWEoP1_AMa5yuwVFvch7O8aKqn0MKX7c3I6ImmiJGRAJIfLrVUD2OMibMMwUCawPhqSncBqvf0bUv5aPYYTGTFrLMl5uBY9oz7CGTjmPBnlGPovnZTtQFjkwfVvXd2e5N-Gy_vAfH1B_oaoue1XE9zTESLdIjxv1jBwLOnjBVr8ROtDaSRau0uVeCWBwbB34qbWu10k41zFU6NrzABq4yQxq5V8THfYUNH6usXCWEd40i183D0QEqfakd-_1n-emxzYjnSyRpnXuMve3rLgdcNjCogRwydhXfjxJFQN7kOXgIrfa1KQOfcy9LGybo%26adurl%3D
Requested by: Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: c5cda53891ea9378ffa564e80984834ccda9e478f0da44824990ba6f32399920

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Wed, 08 Nov 2023 16:02:19 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4268
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 QFuvQnGphQ6GO9QABj_Aqe7B_rJiyTlA9JcZ7sKm_jE.js Show response
pagead2.googlesyndication.com/bg/ Frame 7890 50 KB
19 KB 24ms
21ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/QFuvQnGphQ6GO9QABj_Aqe7B_rJiyTlA9JcZ7sKm_jE.js

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

405baf4271a9850e863bd400063fc0a9eec1feb262c93940f49719eec2a6fe31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 592732
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19777
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 31 Oct 2024 19:23:27 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame D19E 38 KB
13 KB 27ms
23ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 207357
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 06 Nov 2023 06:26:22 GMT
expires: Tue, 05 Nov 2024 06:26:22 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 5081 0
0 63ms
62ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C2v-_CrFLZfXmEszhtwfDwJ1Iwd-4h3SBmur7ihLwLhABILbX6XtglYKAgKAHyAEFqQI09vlQz-SxPqgDAaoEoQJP0G9MpEPAOUxVaOfOwuikmZYo6zhdfqNRSPsTEYmAC2tNtmDVw5mgf6idCsuE46C5201h5HOivC3DMA6SaCtbvf28MlJEnMwx9DRnVLT2YvUBS5t5-bQixXiZ5F_fopGCawOoKYHvzubCskzGePHyEqjfHykQWliVEp-clv42QGkk6OUhGQfuqpg7RqHbOQMn-UTxgfqw6RHwTcfGmjx4mQfnrOT7wGJnGoJoEwQ5cDh3EDInVO_y2kz3cE65gxm4BZLGHQu7jHQ0VTMzhn-6ufQcq7vwnSp1fYh2Om6kQrsTMwmszFPbZVEqNDPmumc4rYyi4ciKtwhSl7DxwQJt-eHAU6ucOsFPesaUEW7jtFHwrrEhE_BwvUTi2UODvnxywASnx7GQxATgBAOIBd3Yw6hNkgULCCIQARgBSOakkgKSBQYIHRAEGAGSBQYIHRABGAGSBQYIHhABGAGQBgGgBnaAB63T_ZoFqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwoQp8sLGKzIk_0B0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAcgLAbATyam0FcgT0rnu4wPQEwDYEwqIFAbYFAHQFQGAFwGyFxwKGggAEhRwdWItNTkyODE2MTA3NDc3OTM4MBgA6BcF&sigh=apeULaBYeYM&uach_m=[UACH]&ase=2&nis=4&cid=CAQSOwDICaaNUvG-g4dBrxiTrGCL8B7NMI6DMZ23brYbGi3pBIfwiET0eiZqoZTH6WULeZAAAq8EjS_VQD80GAE&vt=10&cbvp=2&vis=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5928161074779380&output=html&h=280&slotname=9812672228&adk=3541318952&adf=1004996698&pi=t.ma~as.9812672228&w=749&fwrn=4&fwrnh=100&lmt=1699450935&rafmt=1&format=749x280&url=https%3A%2F%2Fcybernews.com%2Fcyber-war%2Firan-spyware-breached-exposed-ghostsec%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699459337885&bpp=1&bdt=283&idt=367&shv=r20231106&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C749x280%2C749x280&nras=1&correlator=60113865226&frm=20&pv=1&ga_vid=841652769.1699459337&ga_sid=1699459338&ga_hid=861620033&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=226&ady=4558&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44807455%2C44807462%2C31078301%2C44808148&oid=2&pvsid=2784811193083586&tmod=1830791895&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=yEOzzq4M2D&p=https%3A//cybernews.com&dtd=372
Attribution-Reporting-Eligible: event-source
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js Show response
pagead2.googlesyndication.com/bg/ Frame F13E 38 KB
15 KB 24ms
19ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e16c1a19f5b378301e1afb3466bb6658c2541bb7eeeb318f049cd0b7876e3a40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 15:27:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2063
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15096
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 07 Nov 2024 15:27:56 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 74EC 38 KB
13 KB 28ms
22ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 207357
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 06 Nov 2023 06:26:22 GMT
expires: Tue, 05 Nov 2024 06:26:22 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 86B0 38 KB
13 KB 33ms
26ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 207357
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 06 Nov 2023 06:26:22 GMT
expires: Tue, 05 Nov 2024 06:26:22 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 206 file.mp4
r2---sn-4g5lzned.c.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995338/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 0B32 337 KB
0 53ms
21ms Media
video/mp4 2a00:1450:4001:13::7
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:13::7 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Range: bytes=0-

Response headers

expires: Wed, 08 Nov 2023 16:02:19 GMT
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-4188248/4188249
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000
Content-Length: 4188249
last-modified: Wed, 08 Nov 2023 09:11:46 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://googleads.g.doubleclick.net
client-protocol: quic

GET
H3 206 file.mp4
r2---sn-4g5lzned.c.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995339/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 5081 478 KB
0 50ms
21ms Media
video/mp4 2a00:1450:4001:13::7
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-4g5lzned.c.2mdn.net/videoplayback/id/07d835a0a2fbaefc/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1730995339/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/4571E5A1B001EC9FEDA1CA7BF704B1B2B935DCD0.26CB6E65D34A500486339F22DAB5EF8D55AC8288/key/cms1/cms_redirect/yes/mh/98/mip/2001:1b60:2:240:3247::6/mm/42/mn/sn-4g5lzned/ms/onc/mt/1699457892/mv/u/mvi/2/pl/36/file/file.mp4

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:13::7 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Range: bytes=0-

Response headers

expires: Wed, 08 Nov 2023 16:02:19 GMT
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-4188248/4188249
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000
Content-Length: 4188249
last-modified: Wed, 08 Nov 2023 09:11:46 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://googleads.g.doubleclick.net
client-protocol: quic

GET
H/1.1

200
OK

request.php Show response
hal90002.redintelligence.net/ Frame BB16
Redirect Chain

https://hal90002.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=7d97f2ce26&subid=&uid=9f6e7c32aa6b81c5&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90002.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=7d97f2ce26&subid=&uid=9f6e7c32aa6b81c5&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

3 KB
2 KB

523ms
469ms

Script
application/x-javascript

46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=7d97f2ce26&subid=&uid=9f6e7c32aa6b81c5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC2mbzCrFLZfWYDv-PwuIPup-7gA6m5b2gaZ2cnKfJD_AuEAEgttfpe2CVgoCAoAfIAQmpAjT2-VDP5LE-qAMByAObBKoEnwJP0MoBeZvo7q_ta-PBIcStN11S7fuqLtTkXfzAAzP-6qQsUIpUQqSAyT6y1qL_fFOfPkhM1b4rck6eRqpgFWMW8icz96RJq2v4EMJrk_HDherbztz2YbOvTgM-Ms3CbcH60kRzeafHA0nHP_qHMuoUR8-AUqIsjtRQJN8VBU9fBxlAVruoBKXzPXma0awllY_eBcpgKtad5QMojAHQGGBbWt_-BVpy3oY766hQfhFgDQ6mLTqgJJrtsXd5u6vgoduOQP1vAOLXQA56Zcrbp633djLpIcUJ6Eqd298jxfarI9C4kW45u6kihhh9_3HZAhxtxh7eRqtNtvaX8J3vvBrvgOKBw-S-pRUfdcy_s1-42eQfVOn5DJfH52Hwe-CLTMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB%26sig%3DAOD64_2LLfF4xeUB9JCobCAu67Mhmn4jog%26client%3Dca-pub-5928161074779380%26dbm_c%3DAKAmf-DeIfZHGoWnT06yeo4Yma5TpKGSCw3X6kh3Fa2bt2z65h2RedDoGdnht7HvW8NY8ZKqyu75ap1vg2B9WuMPuUu-gnQ7rzzxQw5gfmjrMGczm8QDb2SDw2QgUf3aGqr0IYjKrrVn73340AuUoEOIty6GQZy-3lvv-O3e3WVjZzNE_gTWvrE%26cry%3D1%26dbm_d%3DAKAmf-BglPN-28nuaf72W07dZhhuZA85jxWTYJYg-pa1YEnFTYwDVDbNhGs-x39k5oCjX18Q7jCICdqU8Bljh_L4KxEMFObWvwMX2LcoDjUCrYtl_vDdgyzRQBd3xnZBCINCT6ENa2LnyogsQ45XsdOPeNDOpj-GV9bpj4fDrgyMpaJSxxWuO3BGis75eKkYyRV5NkRlY5cCHLZ63BU97YrQsQPuGHMauXSqUDeshFlt_JCntykMMcTlkQG_uz-UA5yZpg-rER72m9HewB3D1Wm2VWhULAk3edRluOd34fgNcYP7relSeAElveaCS3ufufJnOp_MOxC7yJOK8tXuUDj-uGVwyBloNdCPVGD1GR6Jgf65r7zbsv2bwHEMFXUzFtWUGJJvA2cbinP2v6d_V5KJtzn240fvQgFwwjjCzv-mdyQxk83b9AFFW5mOSbgTojoIm9Zd1J-yRtkCtutODFZ1Zm3qz-qooUuT-dxpkYg9xI-HZGkYidxZkwly0tsp7qwAf9dkeHwrKxKW3RQ6SV9Q5Y7ay3tU8S51X_OLpQTinHfyDz91oDl02m7BmpH-GLZygwHVtsu6fStdLOwHiqLAMCBE4GUtSilHabKzwg_KvcAOx65U-zg%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231106%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-1-%26adk%3D1812271804%26client%3Dca-pub-5928161074779380%26fa%3D4%26ifi%3D8%26uci%3Da!8%26btvi%3D4%26xpc%3DeKeosRUNgx%26p%3Dhttps%253A%2F%2Fcybernews.com&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fcybernews.com&random=7167401521338&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: HTTP/1.1
Server: 46.4.10.47 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 475271e67e117be8fbc715bc740b99631c95687c72a015a03569693c1626d8b8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 08 Nov 2023 16:02:20 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 81530600115245104444556012502002
Connection: close
Content-Length: 1121
Expires: Wed, 08 Nov 2023 16:02:20 +0100

Redirect headers

Pragma: no-cache
Date: Wed, 08 Nov 2023 16:02:19 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=7d97f2ce26&subid=&uid=9f6e7c32aa6b81c5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC2mbzCrFLZfWYDv-PwuIPup-7gA6m5b2gaZ2cnKfJD_AuEAEgttfpe2CVgoCAoAfIAQmpAjT2-VDP5LE-qAMByAObBKoEnwJP0MoBeZvo7q_ta-PBIcStN11S7fuqLtTkXfzAAzP-6qQsUIpUQqSAyT6y1qL_fFOfPkhM1b4rck6eRqpgFWMW8icz96RJq2v4EMJrk_HDherbztz2YbOvTgM-Ms3CbcH60kRzeafHA0nHP_qHMuoUR8-AUqIsjtRQJN8VBU9fBxlAVruoBKXzPXma0awllY_eBcpgKtad5QMojAHQGGBbWt_-BVpy3oY766hQfhFgDQ6mLTqgJJrtsXd5u6vgoduOQP1vAOLXQA56Zcrbp633djLpIcUJ6Eqd298jxfarI9C4kW45u6kihhh9_3HZAhxtxh7eRqtNtvaX8J3vvBrvgOKBw-S-pRUfdcy_s1-42eQfVOn5DJfH52Hwe-CLTMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB%26sig%3DAOD64_2LLfF4xeUB9JCobCAu67Mhmn4jog%26client%3Dca-pub-5928161074779380%26dbm_c%3DAKAmf-DeIfZHGoWnT06yeo4Yma5TpKGSCw3X6kh3Fa2bt2z65h2RedDoGdnht7HvW8NY8ZKqyu75ap1vg2B9WuMPuUu-gnQ7rzzxQw5gfmjrMGczm8QDb2SDw2QgUf3aGqr0IYjKrrVn73340AuUoEOIty6GQZy-3lvv-O3e3WVjZzNE_gTWvrE%26cry%3D1%26dbm_d%3DAKAmf-BglPN-28nuaf72W07dZhhuZA85jxWTYJYg-pa1YEnFTYwDVDbNhGs-x39k5oCjX18Q7jCICdqU8Bljh_L4KxEMFObWvwMX2LcoDjUCrYtl_vDdgyzRQBd3xnZBCINCT6ENa2LnyogsQ45XsdOPeNDOpj-GV9bpj4fDrgyMpaJSxxWuO3BGis75eKkYyRV5NkRlY5cCHLZ63BU97YrQsQPuGHMauXSqUDeshFlt_JCntykMMcTlkQG_uz-UA5yZpg-rER72m9HewB3D1Wm2VWhULAk3edRluOd34fgNcYP7relSeAElveaCS3ufufJnOp_MOxC7yJOK8tXuUDj-uGVwyBloNdCPVGD1GR6Jgf65r7zbsv2bwHEMFXUzFtWUGJJvA2cbinP2v6d_V5KJtzn240fvQgFwwjjCzv-mdyQxk83b9AFFW5mOSbgTojoIm9Zd1J-yRtkCtutODFZ1Zm3qz-qooUuT-dxpkYg9xI-HZGkYidxZkwly0tsp7qwAf9dkeHwrKxKW3RQ6SV9Q5Y7ay3tU8S51X_OLpQTinHfyDz91oDl02m7BmpH-GLZygwHVtsu6fStdLOwHiqLAMCBE4GUtSilHabKzwg_KvcAOx65U-zg%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231106%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-1-%26adk%3D1812271804%26client%3Dca-pub-5928161074779380%26fa%3D4%26ifi%3D8%26uci%3Da!8%26btvi%3D4%26xpc%3DeKeosRUNgx%26p%3Dhttps%253A%2F%2Fcybernews.com&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fcybernews.com&random=7167401521338&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Wed, 08 Nov 2023 16:02:19 +0100

GET
H/1.1

200
OK

request.php Show response
hal900024.redintelligence.net/ Frame C50A
Redirect Chain

https://hal900024.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=67ea83ffd7&subid=&uid=11ea180b3bc46cb2&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900024.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=67ea83ffd7&subid=&uid=11ea180b3bc46cb2&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

3 KB
2 KB

196ms
132ms

Script
application/x-javascript

138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=67ea83ffd7&subid=&uid=11ea180b3bc46cb2&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLgwLCrFLZfaYDv-PwuIPup-7gA6m5b2gaZ2cnKfJD_AuEAEgttfpe2CVgoCAoAfIAQmpAjT2-VDP5LE-qAMByAObBKoEoAJP0Nrx9IyKj8xDNVrnTtXa3dyVd9xz2797OPyq0jEOpBYMQeyAgCssRWGZz1TcY-0vgBcLeFOmoUNUAkh1X1fdiAK8fNzwOi370tjpHhq3bb6O2Dv4l9XlgGzjq22-sVFDsJ__2z8A-YtcXQ9CNVWefRDoYvUM8kg7QhNA7pc2Lbc99eZvNqIGBs080SaHz-Ubv6oC-SxEmhPORIMvuZroVu2MCokR33pJXMMaWRxUh0FMOu9LY9j7_FSv26MQ3ZCdqPBbGxyfm-a8isESgBUXiHQOPAGYpOrtayRIZr2s2rpbyiSB7PZGi9Z0aEhMLi0j516VqANJZY8b8od2aK51IWuLvh8p7Dzv6FekvIgSM_1e4s9uCb--sKSm3ooOrL_ABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGiDAwqCgoI5LSxAu61sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB%26sig%3DAOD64_0xkGm96nyt1VC0ckM1_q4f1opEIw%26client%3Dca-pub-5928161074779380%26dbm_c%3DAKAmf-Da2jXNEj4sL32OPJnRP6IHI3x2tl122lLVaJ9gQqvjQ_I0vxKEsMVfkNFPp0rX42mvooUfCYXoaj8QunzsbtGMl6cf1_5mqF_YUoe0rKjSt-m1GUbd9W5UYkx62JHpF-RyDh1r7N4aScG0hh7rD6FpJvGDzya3-oDoNgosWtavoh-EbLc%26cry%3D1%26dbm_d%3DAKAmf-CTERzenVEW1ab8SajXHftPrvKrsAU9Llgw-gHE-REeHDtBfRE6N4Oe9mRm2nkTkCYQDrA1uJ_9v-cwyI3W1VQP485xNX_ujlJTrTZ0YRjUOq24vh8lVOyP0RDnhvwuoj7VVTDzlYnH3CLb7vOGX-J1rA87HuKCv5NaFImR_RBd_XoxkbT9OtzT6qqic8n7Lk6_Tx9XAuISL5LptYoLGw8RlUnqSKbwUeTsF4mQY8Ol75BmoDPD3NrHIaPN8eecTcMBHqae_09znaaKTfc0XDIKCLVVDaZkvMn7Zeagy5ZRes94T7tJ6AgCS5BowNdYY6AFT5XOEmPjfvasIJbRumKIwAeD3-vIUIz6pcEHxMQ1Pz6p1Yp5GRjusS59Ud46H4H--FKBBH73AcL2D2VRMzQjsq2qx8eVVNNXexoIbgfQ5G9hSY5FCCQA5Bs2vYyPCbl_p11YhtBz3EtHVBf6VypNSk4R0fWd_FtWnH6gZpEDpRSXzmze4MWaNrfrunepAzsMJ0gPX00KZQ-aunWKS3FfAq72OX__ipYtc9-4B18TA6oM-JhtBo_yeAiPjzzCT8GDbCQwBVULFGlwoxoz0On1FF6jzC1sP3L983TNJ8BeEff9UzA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231106%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-2-%26adk%3D1812271803%26client%3Dca-pub-5928161074779380%26fa%3D3%26ifi%3D9%26uci%3Da!9%26btvi%3D5%26xpc%3DCe9LLCwpQW%26p%3Dhttps%253A%2F%2Fcybernews.com&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fcybernews.com&random=8682864036725&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: HTTP/1.1
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 97b998c19639131874fa0342b2fe559cab254fb317136c5572f95dddd5db3c34

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 08 Nov 2023 16:02:20 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 61732500117167904444556012502024
Connection: close
Content-Length: 1028
Expires: Wed, 08 Nov 2023 16:02:20 +0100

Redirect headers

Pragma: no-cache
Date: Wed, 08 Nov 2023 16:02:20 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=67ea83ffd7&subid=&uid=11ea180b3bc46cb2&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLgwLCrFLZfaYDv-PwuIPup-7gA6m5b2gaZ2cnKfJD_AuEAEgttfpe2CVgoCAoAfIAQmpAjT2-VDP5LE-qAMByAObBKoEoAJP0Nrx9IyKj8xDNVrnTtXa3dyVd9xz2797OPyq0jEOpBYMQeyAgCssRWGZz1TcY-0vgBcLeFOmoUNUAkh1X1fdiAK8fNzwOi370tjpHhq3bb6O2Dv4l9XlgGzjq22-sVFDsJ__2z8A-YtcXQ9CNVWefRDoYvUM8kg7QhNA7pc2Lbc99eZvNqIGBs080SaHz-Ubv6oC-SxEmhPORIMvuZroVu2MCokR33pJXMMaWRxUh0FMOu9LY9j7_FSv26MQ3ZCdqPBbGxyfm-a8isESgBUXiHQOPAGYpOrtayRIZr2s2rpbyiSB7PZGi9Z0aEhMLi0j516VqANJZY8b8od2aK51IWuLvh8p7Dzv6FekvIgSM_1e4s9uCb--sKSm3ooOrL_ABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGiDAwqCgoI5LSxAu61sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB%26sig%3DAOD64_0xkGm96nyt1VC0ckM1_q4f1opEIw%26client%3Dca-pub-5928161074779380%26dbm_c%3DAKAmf-Da2jXNEj4sL32OPJnRP6IHI3x2tl122lLVaJ9gQqvjQ_I0vxKEsMVfkNFPp0rX42mvooUfCYXoaj8QunzsbtGMl6cf1_5mqF_YUoe0rKjSt-m1GUbd9W5UYkx62JHpF-RyDh1r7N4aScG0hh7rD6FpJvGDzya3-oDoNgosWtavoh-EbLc%26cry%3D1%26dbm_d%3DAKAmf-CTERzenVEW1ab8SajXHftPrvKrsAU9Llgw-gHE-REeHDtBfRE6N4Oe9mRm2nkTkCYQDrA1uJ_9v-cwyI3W1VQP485xNX_ujlJTrTZ0YRjUOq24vh8lVOyP0RDnhvwuoj7VVTDzlYnH3CLb7vOGX-J1rA87HuKCv5NaFImR_RBd_XoxkbT9OtzT6qqic8n7Lk6_Tx9XAuISL5LptYoLGw8RlUnqSKbwUeTsF4mQY8Ol75BmoDPD3NrHIaPN8eecTcMBHqae_09znaaKTfc0XDIKCLVVDaZkvMn7Zeagy5ZRes94T7tJ6AgCS5BowNdYY6AFT5XOEmPjfvasIJbRumKIwAeD3-vIUIz6pcEHxMQ1Pz6p1Yp5GRjusS59Ud46H4H--FKBBH73AcL2D2VRMzQjsq2qx8eVVNNXexoIbgfQ5G9hSY5FCCQA5Bs2vYyPCbl_p11YhtBz3EtHVBf6VypNSk4R0fWd_FtWnH6gZpEDpRSXzmze4MWaNrfrunepAzsMJ0gPX00KZQ-aunWKS3FfAq72OX__ipYtc9-4B18TA6oM-JhtBo_yeAiPjzzCT8GDbCQwBVULFGlwoxoz0On1FF6jzC1sP3L983TNJ8BeEff9UzA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231106%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-2-%26adk%3D1812271803%26client%3Dca-pub-5928161074779380%26fa%3D3%26ifi%3D9%26uci%3Da!9%26btvi%3D5%26xpc%3DCe9LLCwpQW%26p%3Dhttps%253A%2F%2Fcybernews.com&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fcybernews.com&random=8682864036725&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Wed, 08 Nov 2023 16:02:20 +0100

GET
H/1.1

200
OK

request.php Show response
hal90007.redintelligence.net/ Frame 8E03
Redirect Chain

https://hal90007.redintelligence.net/request.php?zone=jf2y0amzcvu0&nw=20&renderingType=javascript&namespace=3531c86597&subid=&uid=206017a8460e277d&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90007.redintelligence.net/request.php?zone=jf2y0amzcvu0&nw=20&renderingType=javascript&namespace=3531c86597&subid=&uid=206017a8460e277d&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

3 KB
2 KB

405ms
124ms

Script
application/x-javascript

138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/request.php?zone=jf2y0amzcvu0&nw=20&renderingType=javascript&namespace=3531c86597&subid=&uid=206017a8460e277d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x600&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvANlCrFLZeyEIsWwgAe29oqYCKblvaBpvZicp8kP8C4QASDP0NudAWCVgoCAoAfIAQmpAkgBjp9_57E-qAMByAObBKoEpAJP0McVoeSXTz_57FqOng-_RGPjyokY0Vu_iS949zEcPA8s39TlEyh8PfXeFJF56NEeyKSGJ77-cVoJGuF1_eqvhNj7IcpEeBEeDRxjibEMTmH3Gu2UldDp_jtUmiuIfaEul3LSXdU9ZL3H80jHd4a4wQ7zK12X15VPGELFDqqavT9AuL-ncS2f0GNfbT15P8ciNMUs_jdgvU-NFuiwfdOygLawBPG0amJF9T6H0pVb0q0DW9wj_Qdx9wkzea25U57aS4WZWolDVOuExSmDsLB090kBQG1dnqpaoZMRs7uBxrs4fRNCSFLoR8vN9KjA6rNc8rq7u-F8wg-Kt9xwkFz0pyYFO9GhMACZ42KpZiXf3614Jh1KtW5M0r0HykDUzG3fWaDFwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwMKgoKCOS0sQLutbECqg0CREXiDRMI9b-8seO0ggMVRRjgCh02uwKDsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26num%3D1%26cid%3DCAQSOwDICaaNyd8AMPD2TzTvMtd0QMYAEK_sgy_fE6YlOvuUmyjM2AKdL98Ey2XaEazXLZWSEytdyCzAm9oHGAE%26sig%3DAOD64_0G-9PJghANpC-NtSxHxMZhO6Mq_w%26client%3Dca-pub-4647811890505995%26dbm_c%3DAKAmf-C7TIuuhkPfLPhFrxRD81wuHmMKqG52ybxl0yVyx07B6CTy9w6OyR1hdqy6RcLksTQlJxd8U4Du1IDDxPkR8KgFotFkssOeJvY_DfB42LEAH4sX6n5F5Rx6Hd3zMxR-bBVTjxU33p0VnOLJXEXbZAjdLzjLWzVMx0eLouFOA5megs7Nd3w%26cry%3D1%26dbm_d%3DAKAmf-D-MdKVUE7u_8I-1YEF6NBwheLpa9Z8PNWsxD9LRNIwUe3GSY3Yo41NJXrg-UFb8pCwNvVtjVsNaulbFArc2AgFTIaEMSRIj5wp90aiLcGYB0zxoGh2Qpvu6k6hyXA4tw-KcAviKbobQm39xwD44fCf683wVfKj5KYhhp01cZ8GkukM5Q6zQDr57dA3a6UXg_N4mNnRJ_JMFvOt_l2n5jEqAU9R-ta48b3REKlRUQkKN0WHK4tvvP-zpFwQLX5rYL57QdJDhofqNiHgvB69rX5uHI4U7NCIe1DSx-MlMOeWml4noryrOpDWEoP1_AMa5yuwVFvch7O8aKqn0MKX7c3I6ImmiJGRAJIfLrVUD2OMibMMwUCawPhqSncBqvf0bUv5aPYYTGTFrLMl5uBY9oz7CGTjmPBnlGPovnZTtQFjkwfVvXd2e5N-Gy_vAfH1B_oaoue1XE9zTESLdIjxv1jBwLOnjBVr8ROtDaSRau0uVeCWBwbB34qbWu10k41zFU6NrzABq4yQxq5V8THfYUNH6usXCWEd40i183D0QEqfakd-_1n-emxzYjnSyRpnXuMve3rLgdcNjCogRwydhXfjxJFQN7kOXgIrfa1KQOfcy9LGybo%26adurl%3D&documentReferer=https%3A%2F%2F108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fcybernews.com&random=3066871059774&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.63.157 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 853a2c8ffbe4d528a155a6d309519f4683fd3e2a07fbef869b23bf24224897ca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 08 Nov 2023 16:02:20 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 11589600104350404444978012502007
Connection: close
Content-Length: 1101
Expires: Wed, 08 Nov 2023 16:02:20 +0100

Redirect headers

Pragma: no-cache
Date: Wed, 08 Nov 2023 16:02:20 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=jf2y0amzcvu0&nw=20&renderingType=javascript&namespace=3531c86597&subid=&uid=206017a8460e277d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x600&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvANlCrFLZeyEIsWwgAe29oqYCKblvaBpvZicp8kP8C4QASDP0NudAWCVgoCAoAfIAQmpAkgBjp9_57E-qAMByAObBKoEpAJP0McVoeSXTz_57FqOng-_RGPjyokY0Vu_iS949zEcPA8s39TlEyh8PfXeFJF56NEeyKSGJ77-cVoJGuF1_eqvhNj7IcpEeBEeDRxjibEMTmH3Gu2UldDp_jtUmiuIfaEul3LSXdU9ZL3H80jHd4a4wQ7zK12X15VPGELFDqqavT9AuL-ncS2f0GNfbT15P8ciNMUs_jdgvU-NFuiwfdOygLawBPG0amJF9T6H0pVb0q0DW9wj_Qdx9wkzea25U57aS4WZWolDVOuExSmDsLB090kBQG1dnqpaoZMRs7uBxrs4fRNCSFLoR8vN9KjA6rNc8rq7u-F8wg-Kt9xwkFz0pyYFO9GhMACZ42KpZiXf3614Jh1KtW5M0r0HykDUzG3fWaDFwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwMKgoKCOS0sQLutbECqg0CREXiDRMI9b-8seO0ggMVRRjgCh02uwKDsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26num%3D1%26cid%3DCAQSOwDICaaNyd8AMPD2TzTvMtd0QMYAEK_sgy_fE6YlOvuUmyjM2AKdL98Ey2XaEazXLZWSEytdyCzAm9oHGAE%26sig%3DAOD64_0G-9PJghANpC-NtSxHxMZhO6Mq_w%26client%3Dca-pub-4647811890505995%26dbm_c%3DAKAmf-C7TIuuhkPfLPhFrxRD81wuHmMKqG52ybxl0yVyx07B6CTy9w6OyR1hdqy6RcLksTQlJxd8U4Du1IDDxPkR8KgFotFkssOeJvY_DfB42LEAH4sX6n5F5Rx6Hd3zMxR-bBVTjxU33p0VnOLJXEXbZAjdLzjLWzVMx0eLouFOA5megs7Nd3w%26cry%3D1%26dbm_d%3DAKAmf-D-MdKVUE7u_8I-1YEF6NBwheLpa9Z8PNWsxD9LRNIwUe3GSY3Yo41NJXrg-UFb8pCwNvVtjVsNaulbFArc2AgFTIaEMSRIj5wp90aiLcGYB0zxoGh2Qpvu6k6hyXA4tw-KcAviKbobQm39xwD44fCf683wVfKj5KYhhp01cZ8GkukM5Q6zQDr57dA3a6UXg_N4mNnRJ_JMFvOt_l2n5jEqAU9R-ta48b3REKlRUQkKN0WHK4tvvP-zpFwQLX5rYL57QdJDhofqNiHgvB69rX5uHI4U7NCIe1DSx-MlMOeWml4noryrOpDWEoP1_AMa5yuwVFvch7O8aKqn0MKX7c3I6ImmiJGRAJIfLrVUD2OMibMMwUCawPhqSncBqvf0bUv5aPYYTGTFrLMl5uBY9oz7CGTjmPBnlGPovnZTtQFjkwfVvXd2e5N-Gy_vAfH1B_oaoue1XE9zTESLdIjxv1jBwLOnjBVr8ROtDaSRau0uVeCWBwbB34qbWu10k41zFU6NrzABq4yQxq5V8THfYUNH6usXCWEd40i183D0QEqfakd-_1n-emxzYjnSyRpnXuMve3rLgdcNjCogRwydhXfjxJFQN7kOXgIrfa1KQOfcy9LGybo%26adurl%3D&documentReferer=https%3A%2F%2F108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fcybernews.com&random=3066871059774&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Wed, 08 Nov 2023 16:02:20 +0100

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4BC1 42 B
64 B 72ms
69ms Fetch
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstkbbdX12PfzR55dHXLphmaNP1ymEvP5_tCYauNj_G3i4a2VBj_tDRnjfA5cMexOIu0Nrz_j9UewFcKsAr2CG6g5AMUklUqmQwj1viuAHz6TnBmBtOGE1CDiolfoh3GieWZ_Ic1tEHPerVP&sai=AMfl-YSJSr5-pfZlfulwfW7qqogmzT3kP9xLBK-pdaa7220xA4Q2OG4WHguyXKWQdMzTlqPoHJoVd986ks7ndB2Rk9Jt_fPAff1MHKfA6AOHFoRGZUjwlbXEl3YdVDw&sig=Cg0ArKJSzJLdojFcnkKaEAE&cid=CAQSOwDICaaNZ1i1PoagFybewxYsXN8X1CsCdAN_lyNWl7EAxaXqir86pw9CrAD6kocGsEHe4X8yVGH9hbXxGAE&id=lidar2&mcvt=1063&p=0,0,193,749&mtos=0,1063,1063,1063,1063&tos=0,1063,0,0,0&v=20231106&bin=7&avms=nio&bs=0,0&mc=0.78&if=1&vu=1&app=0&itpl=4&adk=652042997&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1699459338209&rpt=658&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js Show response
pagead2.googlesyndication.com/bg/ Frame D19E 38 KB
15 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e16c1a19f5b378301e1afb3466bb6658c2541bb7eeeb318f049cd0b7876e3a40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 15:27:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2063
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15096
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 07 Nov 2024 15:27:56 GMT

GET
H3 200 4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js Show response
pagead2.googlesyndication.com/bg/ Frame 74EC 38 KB
15 KB 23ms
18ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e16c1a19f5b378301e1afb3466bb6658c2541bb7eeeb318f049cd0b7876e3a40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 15:27:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2064
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15096
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 07 Nov 2024 15:27:56 GMT

GET
H3 200 4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js Show response
pagead2.googlesyndication.com/bg/ Frame 86B0 38 KB
15 KB 25ms
21ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e16c1a19f5b378301e1afb3466bb6658c2541bb7eeeb318f049cd0b7876e3a40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 15:27:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2064
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15096
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 07 Nov 2024 15:27:56 GMT

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/ 0
239 B 474ms
23ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/sync.php?p=prebid
Requested by: Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 / Show response
adv.office-partner.de/ Frame B138 930 B
923 B 138ms
34ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=67ea83ffd7&subid=&uid=11ea180b3bc46cb2&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLgwLCrFLZfaYDv-PwuIPup-7gA6m5b2gaZ2cnKfJD_AuEAEgttfpe2CVgoCAoAfIAQmpAjT2-VDP5LE-qAMByAObBKoEoAJP0Nrx9IyKj8xDNVrnTtXa3dyVd9xz2797OPyq0jEOpBYMQeyAgCssRWGZz1TcY-0vgBcLeFOmoUNUAkh1X1fdiAK8fNzwOi370tjpHhq3bb6O2Dv4l9XlgGzjq22-sVFDsJ__2z8A-YtcXQ9CNVWefRDoYvUM8kg7QhNA7pc2Lbc99eZvNqIGBs080SaHz-Ubv6oC-SxEmhPORIMvuZroVu2MCokR33pJXMMaWRxUh0FMOu9LY9j7_FSv26MQ3ZCdqPBbGxyfm-a8isESgBUXiHQOPAGYpOrtayRIZr2s2rpbyiSB7PZGi9Z0aEhMLi0j516VqANJZY8b8od2aK51IWuLvh8p7Dzv6FekvIgSM_1e4s9uCb--sKSm3ooOrL_ABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGiDAwqCgoI5LSxAu61sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB%26sig%3DAOD64_0xkGm96nyt1VC0ckM1_q4f1opEIw%26client%3Dca-pub-5928161074779380%26dbm_c%3DAKAmf-Da2jXNEj4sL32OPJnRP6IHI3x2tl122lLVaJ9gQqvjQ_I0vxKEsMVfkNFPp0rX42mvooUfCYXoaj8QunzsbtGMl6cf1_5mqF_YUoe0rKjSt-m1GUbd9W5UYkx62JHpF-RyDh1r7N4aScG0hh7rD6FpJvGDzya3-oDoNgosWtavoh-EbLc%26cry%3D1%26dbm_d%3DAKAmf-CTERzenVEW1ab8SajXHftPrvKrsAU9Llgw-gHE-REeHDtBfRE6N4Oe9mRm2nkTkCYQDrA1uJ_9v-cwyI3W1VQP485xNX_ujlJTrTZ0YRjUOq24vh8lVOyP0RDnhvwuoj7VVTDzlYnH3CLb7vOGX-J1rA87HuKCv5NaFImR_RBd_XoxkbT9OtzT6qqic8n7Lk6_Tx9XAuISL5LptYoLGw8RlUnqSKbwUeTsF4mQY8Ol75BmoDPD3NrHIaPN8eecTcMBHqae_09znaaKTfc0XDIKCLVVDaZkvMn7Zeagy5ZRes94T7tJ6AgCS5BowNdYY6AFT5XOEmPjfvasIJbRumKIwAeD3-vIUIz6pcEHxMQ1Pz6p1Yp5GRjusS59Ud46H4H--FKBBH73AcL2D2VRMzQjsq2qx8eVVNNXexoIbgfQ5G9hSY5FCCQA5Bs2vYyPCbl_p11YhtBz3EtHVBf6VypNSk4R0fWd_FtWnH6gZpEDpRSXzmze4MWaNrfrunepAzsMJ0gPX00KZQ-aunWKS3FfAq72OX__ipYtc9-4B18TA6oM-JhtBo_yeAiPjzzCT8GDbCQwBVULFGlwoxoz0On1FF6jzC1sP3L983TNJ8BeEff9UzA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231106%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-2-%26adk%3D1812271803%26client%3Dca-pub-5928161074779380%26fa%3D3%26ifi%3D9%26uci%3Da!9%26btvi%3D5%26xpc%3DCe9LLCwpQW%26p%3Dhttps%253A%2F%2Fcybernews.com&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fcybernews.com&random=8682864036725&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Wed, 08 Nov 2023 16:02:20 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Wed, 15 Nov 2023 16:02:20 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 link.html Show response
track.webgains.com/ Frame C50A 2 KB
2 KB 231ms
96ms Script
text/html 13.43.153.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=61732500117167904444556012502024&nw=1
Requested by: Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.153.42 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-153-42.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 4a47f5c2c3c2292a5b555c2736eb9442048c6249df180e2ddb1e7b5ae57c8d70

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:20 GMT
last-modified: Wed, 08 Nov 2023 16:02:20 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Wed, 08 Nov 2023 16:03:20 GMT

GET
H/1.1 200
OK request_content.php Show response
hal900024.redintelligence.net/ Frame D38F 7 KB
2 KB 84ms
29ms Document
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/request_content.php?s=61732500117167904444556012502024&a=ce3ddc3a
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=67ea83ffd7&subid=&uid=11ea180b3bc46cb2&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLgwLCrFLZfaYDv-PwuIPup-7gA6m5b2gaZ2cnKfJD_AuEAEgttfpe2CVgoCAoAfIAQmpAjT2-VDP5LE-qAMByAObBKoEoAJP0Nrx9IyKj8xDNVrnTtXa3dyVd9xz2797OPyq0jEOpBYMQeyAgCssRWGZz1TcY-0vgBcLeFOmoUNUAkh1X1fdiAK8fNzwOi370tjpHhq3bb6O2Dv4l9XlgGzjq22-sVFDsJ__2z8A-YtcXQ9CNVWefRDoYvUM8kg7QhNA7pc2Lbc99eZvNqIGBs080SaHz-Ubv6oC-SxEmhPORIMvuZroVu2MCokR33pJXMMaWRxUh0FMOu9LY9j7_FSv26MQ3ZCdqPBbGxyfm-a8isESgBUXiHQOPAGYpOrtayRIZr2s2rpbyiSB7PZGi9Z0aEhMLi0j516VqANJZY8b8od2aK51IWuLvh8p7Dzv6FekvIgSM_1e4s9uCb--sKSm3ooOrL_ABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgGYCwHICwGADAGiDAwqCgoI5LSxAu61sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB%26sig%3DAOD64_0xkGm96nyt1VC0ckM1_q4f1opEIw%26client%3Dca-pub-5928161074779380%26dbm_c%3DAKAmf-Da2jXNEj4sL32OPJnRP6IHI3x2tl122lLVaJ9gQqvjQ_I0vxKEsMVfkNFPp0rX42mvooUfCYXoaj8QunzsbtGMl6cf1_5mqF_YUoe0rKjSt-m1GUbd9W5UYkx62JHpF-RyDh1r7N4aScG0hh7rD6FpJvGDzya3-oDoNgosWtavoh-EbLc%26cry%3D1%26dbm_d%3DAKAmf-CTERzenVEW1ab8SajXHftPrvKrsAU9Llgw-gHE-REeHDtBfRE6N4Oe9mRm2nkTkCYQDrA1uJ_9v-cwyI3W1VQP485xNX_ujlJTrTZ0YRjUOq24vh8lVOyP0RDnhvwuoj7VVTDzlYnH3CLb7vOGX-J1rA87HuKCv5NaFImR_RBd_XoxkbT9OtzT6qqic8n7Lk6_Tx9XAuISL5LptYoLGw8RlUnqSKbwUeTsF4mQY8Ol75BmoDPD3NrHIaPN8eecTcMBHqae_09znaaKTfc0XDIKCLVVDaZkvMn7Zeagy5ZRes94T7tJ6AgCS5BowNdYY6AFT5XOEmPjfvasIJbRumKIwAeD3-vIUIz6pcEHxMQ1Pz6p1Yp5GRjusS59Ud46H4H--FKBBH73AcL2D2VRMzQjsq2qx8eVVNNXexoIbgfQ5G9hSY5FCCQA5Bs2vYyPCbl_p11YhtBz3EtHVBf6VypNSk4R0fWd_FtWnH6gZpEDpRSXzmze4MWaNrfrunepAzsMJ0gPX00KZQ-aunWKS3FfAq72OX__ipYtc9-4B18TA6oM-JhtBo_yeAiPjzzCT8GDbCQwBVULFGlwoxoz0On1FF6jzC1sP3L983TNJ8BeEff9UzA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231106%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-2-%26adk%3D1812271803%26client%3Dca-pub-5928161074779380%26fa%3D3%26ifi%3D9%26uci%3Da!9%26btvi%3D5%26xpc%3DCe9LLCwpQW%26p%3Dhttps%253A%2F%2Fcybernews.com&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fcybernews.com&random=8682864036725&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: d8acb2714411f228502b60effa6d313ad0a97f455fdb9a520c1b1e8c6676b7cf

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2046
Content-Type: text/html; charset=utf-8
Date: Wed, 08 Nov 2023 16:02:20 GMT
Expires: Wed, 08 Nov 2023 16:02:20 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame C50A 43 B
702 B 276ms
150ms Image
image/gif 23.56.205.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2229232&v=11671&q=344795&r=296283&pref1=61732500117167904444556012502024&pv=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.56.205.163 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 08 Nov 2023 16:02:20 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame C50A 43 B
705 B 274ms
149ms Image
image/gif 23.56.205.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2519595&v=14098&q=379097&r=296283&pref1=61732500117167904444556012502024&pv=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.56.205.163 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-205-163.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 08 Nov 2023 16:02:20 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame EF87 1 KB
646 B 27ms
21ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 85223
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 16:21:57 GMT
etag: 48472445140208031
expires: Wed, 08 Nov 2023 16:21:57 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F13E 0
23 B 57ms
56ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=Bw7OAC7FLZdbED7XkmLAPztiq2AQAAAAAOAHgBAI&bg=!8POl87zNAAb4oU7C2KE7ADQBe5WfOJMf6X0GO0XfnllbH8EYS3RlvIh6Z0ybJfZwjJlSd5OiDtpfVtxnwMdXPl45UCN6AgAAAYRSAAAACWgBB5kC1zEwdzobgQU-z7aoWXzU4y5PO2O-2Y5_mmHa-1ZeRFgPQQRC8JN0wFCO0T42fQ2t_sAkHPqf4roIAdp7-Pw2w43gKnurBpq613J22A8TE1Anl661994GAy4y-wb2hf09rm1YaOKLNABGVbCPNg3XmZlx9hgbmqBKDuKyTsDM5zTFv9tICMvGR5eX8aJvaeyoJV0WFMvq0xOy5XwM0LHb52ejX8Cnxm_TJpjNpBSg7XMql1joAwBOt77zgPAxuLqFwoo8cX85L24P9DlZRRfpKNfV7ZHd8QK7MSaVK5vDTRIq2jkOTBrzGLsZMRRwB1UHVq__Nho2FKdoIGgVj7dI4_eYkyy_-TkSuIXnmLufGub7p58mf0qDDyQcismkKx2e2uASoTcjvXQDEROtMG5EhwAuuWABjXCXa4kjSvhaUD57RKLVYiUBPmbCjlRlCw_ZPkjX54XOCQmKlcGs9X5s9S9uW4WvzTPo_CvFLdNIDlOk2V0oWcVvR74lz8cIL58AShJev2UylWGdtyqD1aiEfua4_yh5Wo57OzxmkORWKbVN-gtLba5LrWcj_g7M9LLyF_488iLimUa32AvA58xw8CfJ2NEkwErg-z9GhQ4ASYWzMfWld_Vwhm2yjrsa-ngIqushleYrNJcsd-UaPT4G65P4b-MVovuLCXlMlloAsT-ENEDE0E3pqyB3IUo7OcPcyBHxZeDGcX6BIIv2mSQoQX6jkEreYXakL0LZ9PoUsVRpFcM5CtkrNcbhiwQ5SlRPVWYFguKjgFwvltIPih12oLHb2V8P_5Z4OlYuPzB6yPHogS3B64a6NANuJQfUFngKwOwQoXfJSJeEcJZHso4720yJeYVKvjedcsQ6SOfkIhDazQtFw4uZ6hXaodRxDmhJqQSlHd_T6e9msFQGwrTxlrmXf4WTy4S3itoz-9CHW23B2h1ZiDAS2twvDh_8yXcuNizssZD1_EA

Requested by

Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame D38F 5 KB
682 B 38ms
36ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=61732500117167904444556012502024&a=ce3ddc3a

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 08 Nov 2023 16:02:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 14:13:14 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Nov 2023 16:02:20 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame D38F 20 KB
21 KB 115ms
59ms Image
image/png 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=150&height=90&url=https://cdn.contentspread.net/24i/advertiser/71422/creativesup/1200x627.jpg
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=61732500117167904444556012502024&a=ce3ddc3a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: fb8196002fcf0a99233b8b0a2a39f802176fc54c9d498eecebae3792fc472fcf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Wed, 08 Nov 2023 16:02:20 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 20829
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame D38F 26 KB
26 KB 113ms
57ms Image
image/png 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=150&height=90&url=https://cdn.contentspread.net/24i/advertiser/3839/creativesup/father_daughter_1200x627.jpg
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=61732500117167904444556012502024&a=ce3ddc3a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: a8e0296068268a9ff68ff9f1fc44d35167913f96d2996a927baea44dfa3e1682

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Wed, 08 Nov 2023 16:02:20 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 26361
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame D38F 25 KB
25 KB 113ms
27ms Image
image/png 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=150&height=90&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=61732500117167904444556012502024&a=ce3ddc3a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: 7d7a63e04acccde3ebbae729228240f4390ee22d2dbdc0e8d66dae8c72c3fe86

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Wed, 08 Nov 2023 16:02:20 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 25830
Vary: Accept-Encoding
Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EF87
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEOL48nYlDFxmcVq-UKzjZvA&google_cver=1&google_push=AXcoOmQRKlLR8XW-6LQFLcAXtRIYdMsa40XKl8pFBHh_g6MsxeE-jBCli5xmz0-9bXvBIqbo2xJiQjpko0rXr3Uu172aqkkAKbZtS18
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmQRKlLR8XW-6LQFLcAXtRIYdMsa40XKl8pFBHh_g6MsxeE-jBCli5xmz0-9bXvBIqbo2xJiQjpko0rXr3U...

170 B
188 B

44ms
35ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmQRKlLR8XW-6LQFLcAXtRIYdMsa40XKl8pFBHh_g6MsxeE-jBCli5xmz0-9bXvBIqbo2xJiQjpko0rXr3Uu172aqkkAKbZtS18

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 08 Nov 2023 16:02:20 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmQRKlLR8XW-6LQFLcAXtRIYdMsa40XKl8pFBHh_g6MsxeE-jBCli5xmz0-9bXvBIqbo2xJiQjpko0rXr3Uu172aqkkAKbZtS18
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 07 Nov 2023 16:02:20 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame EF87 70 B
148 B 89ms
68ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEGwCeGbEK4A9K9i3GXwE9tY&google_cver=1&google_push=AXcoOmSS-LJK3hclsN9fqmyYiiha5YypMs6W9v5vTvAl6znIDEF23764YpcH5Xsc0QYYES6K_FRih9RXYIAruKhqj9NPnRlxSZgk-A
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:20 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EF87
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEBpHGy41RtWFB18_fSLyxX0&google_cver=1&google_push=AXcoOmRCyY_c_fBV1TRgPY6UOaEF8gkwxnQ0lPAGVA3sbrwIpgjN63RQeFt5t4Ul07EGiF2fXXOg6t9Uv08jaScM...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4f5q8xuyThAOtoh_ej3JUQ&google_push=AXcoOmRCyY_c_fBV1TRgPY6UOaEF8gkwxnQ0lPAGVA3sbrwIpgjN63RQeFt5t4Ul07EGiF2fXXOg6t9Uv08jaScMV_gz65e2B4_J6uY

170 B
188 B

28ms
28ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4f5q8xuyThAOtoh_ej3JUQ&google_push=AXcoOmRCyY_c_fBV1TRgPY6UOaEF8gkwxnQ0lPAGVA3sbrwIpgjN63RQeFt5t4Ul07EGiF2fXXOg6t9Uv08jaScMV_gz65e2B4_J6uY

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 08 Nov 2023 16:02:20 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4f5q8xuyThAOtoh_ej3JUQ&google_push=AXcoOmRCyY_c_fBV1TRgPY6UOaEF8gkwxnQ0lPAGVA3sbrwIpgjN63RQeFt5t4Ul07EGiF2fXXOg6t9Uv08jaScMV_gz65e2B4_J6uY
x-host: tde-deliveryengine-production-bb588bf9-mlx8p
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 sync
x.bidswitch.net/ Frame EF87 43 B
145 B 39ms
19ms Image
image/gif 3.123.196.74
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEA_btIz0Ih--gmyh4xG9mE4&google_cver=1&google_push=AXcoOmQSMuwiS1kC2lV_qhY90qLIJIWlP9mu4rAPvKZZ7C7UytnA2sn-sEuMhIR305B4NPbWj-soNYS7j1onGZ18mv0guxqT6OdNJ7w
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.196.74 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-196-74.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:20 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EF87
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEHkJAUL1bXrcz9vbQq3mUcA&google_cver=1&google_push=AXcoOmRpPPlXUHIYDClCwSg3t3EKSz-xLLc55gIVY2Nw0h0WeK3u6F_5llq7MLFYKDLC_HV5cR9sxeAqRbGi_CUMt4IuT6_...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRpPPlXUHIYDClCwSg3t3EKSz-xLLc55gIVY2Nw0h0WeK3u6F_5llq7MLFYKDLC_HV5cR9sxeAqRbGi_CUMt4IuT6_Phe4PXWM&google_hm=eS0wX1pMMEkxRTJwR18...

170 B
188 B

44ms
34ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRpPPlXUHIYDClCwSg3t3EKSz-xLLc55gIVY2Nw0h0WeK3u6F_5llq7MLFYKDLC_HV5cR9sxeAqRbGi_CUMt4IuT6_Phe4PXWM&google_hm=eS0wX1pMMEkxRTJwR181cXBwaHFBd1hURUw5UF9ZWGE4TX5B

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 08 Nov 2023 16:02:20 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRpPPlXUHIYDClCwSg3t3EKSz-xLLc55gIVY2Nw0h0WeK3u6F_5llq7MLFYKDLC_HV5cR9sxeAqRbGi_CUMt4IuT6_Phe4PXWM&google_hm=eS0wX1pMMEkxRTJwR181cXBwaHFBd1hURUw5UF9ZWGE4TX5B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame EF87 43 B
362 B 74ms
59ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmS_55OJxD0lqQCH_H4LhzNNGOmDkQ2HKJQ5SwtbsRLKIGUF-MmVMNxfkycpMa8Tega9AYta-yMbto3uzciZWlf-zTOneW1-DYk&google_gid=CAESEOHr73-HmgAwXkbGDoSv-po&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 297490
expires: Wed, 08 Nov 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EF87
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEPzstINqtWcTcPQ_Q6gpr00&google_cver=1&google_push=AXcoOmSJObn6jyp-K9i2Jyh8JM5gAe3i-TsjfmecIkliMtU2JVIXtNeQh7_L-AArPLuKhGqnPcOy82aKeZt-...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSJObn6jyp-K9i2Jyh8JM5gAe3i-TsjfmecIkliMtU2JVIXtNeQh7_L-AArPLuKhGqnPcOy82aKeZt-UhUKvAAG5KOwA4J9W0w

170 B
188 B

41ms
35ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSJObn6jyp-K9i2Jyh8JM5gAe3i-TsjfmecIkliMtU2JVIXtNeQh7_L-AArPLuKhGqnPcOy82aKeZt-UhUKvAAG5KOwA4J9W0w

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSJObn6jyp-K9i2Jyh8JM5gAe3i-TsjfmecIkliMtU2JVIXtNeQh7_L-AArPLuKhGqnPcOy82aKeZt-UhUKvAAG5KOwA4J9W0w
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame EF87 0
12 B 37ms
27ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Jn2dpbhGksc7i7bv_QZPsD9hyFN_EjC70WGpqC5ciE4xx2vAu6AVJghIE6a4nvPN_zMv1t

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:20 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 130D
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=11589600104350404444978012502007&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=11589600104350404444978012502007&actionid=879111&produktid=ratenkredit&dt_url=

0
178 B

52ms
49ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=11589600104350404444978012502007&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request.php?zone=jf2y0amzcvu0&nw=20&renderingType=javascript&namespace=3531c86597&subid=&uid=206017a8460e277d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x600&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvANlCrFLZeyEIsWwgAe29oqYCKblvaBpvZicp8kP8C4QASDP0NudAWCVgoCAoAfIAQmpAkgBjp9_57E-qAMByAObBKoEpAJP0McVoeSXTz_57FqOng-_RGPjyokY0Vu_iS949zEcPA8s39TlEyh8PfXeFJF56NEeyKSGJ77-cVoJGuF1_eqvhNj7IcpEeBEeDRxjibEMTmH3Gu2UldDp_jtUmiuIfaEul3LSXdU9ZL3H80jHd4a4wQ7zK12X15VPGELFDqqavT9AuL-ncS2f0GNfbT15P8ciNMUs_jdgvU-NFuiwfdOygLawBPG0amJF9T6H0pVb0q0DW9wj_Qdx9wkzea25U57aS4WZWolDVOuExSmDsLB090kBQG1dnqpaoZMRs7uBxrs4fRNCSFLoR8vN9KjA6rNc8rq7u-F8wg-Kt9xwkFz0pyYFO9GhMACZ42KpZiXf3614Jh1KtW5M0r0HykDUzG3fWaDFwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwMKgoKCOS0sQLutbECqg0CREXiDRMI9b-8seO0ggMVRRjgCh02uwKDsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26num%3D1%26cid%3DCAQSOwDICaaNyd8AMPD2TzTvMtd0QMYAEK_sgy_fE6YlOvuUmyjM2AKdL98Ey2XaEazXLZWSEytdyCzAm9oHGAE%26sig%3DAOD64_0G-9PJghANpC-NtSxHxMZhO6Mq_w%26client%3Dca-pub-4647811890505995%26dbm_c%3DAKAmf-C7TIuuhkPfLPhFrxRD81wuHmMKqG52ybxl0yVyx07B6CTy9w6OyR1hdqy6RcLksTQlJxd8U4Du1IDDxPkR8KgFotFkssOeJvY_DfB42LEAH4sX6n5F5Rx6Hd3zMxR-bBVTjxU33p0VnOLJXEXbZAjdLzjLWzVMx0eLouFOA5megs7Nd3w%26cry%3D1%26dbm_d%3DAKAmf-D-MdKVUE7u_8I-1YEF6NBwheLpa9Z8PNWsxD9LRNIwUe3GSY3Yo41NJXrg-UFb8pCwNvVtjVsNaulbFArc2AgFTIaEMSRIj5wp90aiLcGYB0zxoGh2Qpvu6k6hyXA4tw-KcAviKbobQm39xwD44fCf683wVfKj5KYhhp01cZ8GkukM5Q6zQDr57dA3a6UXg_N4mNnRJ_JMFvOt_l2n5jEqAU9R-ta48b3REKlRUQkKN0WHK4tvvP-zpFwQLX5rYL57QdJDhofqNiHgvB69rX5uHI4U7NCIe1DSx-MlMOeWml4noryrOpDWEoP1_AMa5yuwVFvch7O8aKqn0MKX7c3I6ImmiJGRAJIfLrVUD2OMibMMwUCawPhqSncBqvf0bUv5aPYYTGTFrLMl5uBY9oz7CGTjmPBnlGPovnZTtQFjkwfVvXd2e5N-Gy_vAfH1B_oaoue1XE9zTESLdIjxv1jBwLOnjBVr8ROtDaSRau0uVeCWBwbB34qbWu10k41zFU6NrzABq4yQxq5V8THfYUNH6usXCWEd40i183D0QEqfakd-_1n-emxzYjnSyRpnXuMve3rLgdcNjCogRwydhXfjxJFQN7kOXgIrfa1KQOfcy9LGybo%26adurl%3D&documentReferer=https%3A%2F%2F108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fcybernews.com&random=3066871059774&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 08 Nov 2023 16:02:19 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Wed, 08 Nov 2023 05:02:20 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Wed, 08 Nov 2023 16:02:20 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=11589600104350404444978012502007&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40028
x-iplb-request-id: D972DA1D:8D0C_91EFC182:01BB_654BB10C_25FC4BB:1A428

GET
H2 200 / Show response
adv.office-partner.de/ Frame 2022 930 B
922 B 55ms
54ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request.php?zone=jf2y0amzcvu0&nw=20&renderingType=javascript&namespace=3531c86597&subid=&uid=206017a8460e277d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x600&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvANlCrFLZeyEIsWwgAe29oqYCKblvaBpvZicp8kP8C4QASDP0NudAWCVgoCAoAfIAQmpAkgBjp9_57E-qAMByAObBKoEpAJP0McVoeSXTz_57FqOng-_RGPjyokY0Vu_iS949zEcPA8s39TlEyh8PfXeFJF56NEeyKSGJ77-cVoJGuF1_eqvhNj7IcpEeBEeDRxjibEMTmH3Gu2UldDp_jtUmiuIfaEul3LSXdU9ZL3H80jHd4a4wQ7zK12X15VPGELFDqqavT9AuL-ncS2f0GNfbT15P8ciNMUs_jdgvU-NFuiwfdOygLawBPG0amJF9T6H0pVb0q0DW9wj_Qdx9wkzea25U57aS4WZWolDVOuExSmDsLB090kBQG1dnqpaoZMRs7uBxrs4fRNCSFLoR8vN9KjA6rNc8rq7u-F8wg-Kt9xwkFz0pyYFO9GhMACZ42KpZiXf3614Jh1KtW5M0r0HykDUzG3fWaDFwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwMKgoKCOS0sQLutbECqg0CREXiDRMI9b-8seO0ggMVRRjgCh02uwKDsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26num%3D1%26cid%3DCAQSOwDICaaNyd8AMPD2TzTvMtd0QMYAEK_sgy_fE6YlOvuUmyjM2AKdL98Ey2XaEazXLZWSEytdyCzAm9oHGAE%26sig%3DAOD64_0G-9PJghANpC-NtSxHxMZhO6Mq_w%26client%3Dca-pub-4647811890505995%26dbm_c%3DAKAmf-C7TIuuhkPfLPhFrxRD81wuHmMKqG52ybxl0yVyx07B6CTy9w6OyR1hdqy6RcLksTQlJxd8U4Du1IDDxPkR8KgFotFkssOeJvY_DfB42LEAH4sX6n5F5Rx6Hd3zMxR-bBVTjxU33p0VnOLJXEXbZAjdLzjLWzVMx0eLouFOA5megs7Nd3w%26cry%3D1%26dbm_d%3DAKAmf-D-MdKVUE7u_8I-1YEF6NBwheLpa9Z8PNWsxD9LRNIwUe3GSY3Yo41NJXrg-UFb8pCwNvVtjVsNaulbFArc2AgFTIaEMSRIj5wp90aiLcGYB0zxoGh2Qpvu6k6hyXA4tw-KcAviKbobQm39xwD44fCf683wVfKj5KYhhp01cZ8GkukM5Q6zQDr57dA3a6UXg_N4mNnRJ_JMFvOt_l2n5jEqAU9R-ta48b3REKlRUQkKN0WHK4tvvP-zpFwQLX5rYL57QdJDhofqNiHgvB69rX5uHI4U7NCIe1DSx-MlMOeWml4noryrOpDWEoP1_AMa5yuwVFvch7O8aKqn0MKX7c3I6ImmiJGRAJIfLrVUD2OMibMMwUCawPhqSncBqvf0bUv5aPYYTGTFrLMl5uBY9oz7CGTjmPBnlGPovnZTtQFjkwfVvXd2e5N-Gy_vAfH1B_oaoue1XE9zTESLdIjxv1jBwLOnjBVr8ROtDaSRau0uVeCWBwbB34qbWu10k41zFU6NrzABq4yQxq5V8THfYUNH6usXCWEd40i183D0QEqfakd-_1n-emxzYjnSyRpnXuMve3rLgdcNjCogRwydhXfjxJFQN7kOXgIrfa1KQOfcy9LGybo%26adurl%3D&documentReferer=https%3A%2F%2F108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fcybernews.com&random=3066871059774&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Wed, 08 Nov 2023 16:02:20 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Wed, 15 Nov 2023 16:02:20 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame AAFF
Redirect Chain

https://pv.medialead.de/trck/epv/89f7480c0afa0150827cf163f8728151?subid=11589600104350404444978012502007&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=654bb10ce042321e092f456c&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=

0
606 B

44ms
38ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=654bb10ce042321e092f456c&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 08 Nov 2023 16:02:19 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Wed, 08 Nov 2023 05:02:20 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"25200521800103636","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Wed, 08 Nov 2023 16:02:20 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=654bb10ce042321e092f456c&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40027
x-iplb-request-id: D972DA1D:8D0A_91EFC182:01BB_654BB10C_25D1855:1E879

GET
H2 200 link.html Show response
track.webgains.com/ Frame 8E03 2 KB
2 KB 95ms
95ms Script
text/html 13.43.153.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=11589600104350404444978012502007&nw=1
Requested by: Host: cybernews.com
URL: https://cybernews.com/cyber-war/iran-spyware-breached-exposed-ghostsec/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.153.42 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-153-42.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 03398a9a6b3df380615e7773f6cf87bfff6698da17464bc26fde8451009705a5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:20 GMT
last-modified: Wed, 08 Nov 2023 16:02:20 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Wed, 08 Nov 2023 16:03:20 GMT

GET
H/1.1 200
OK request_content.php Show response
hal90007.redintelligence.net/ Frame 3A49 7 KB
2 KB 101ms
24ms Document
text/html 138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/request_content.php?s=11589600104350404444978012502007&a=aacd681e
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request.php?zone=jf2y0amzcvu0&nw=20&renderingType=javascript&namespace=3531c86597&subid=&uid=206017a8460e277d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x600&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvANlCrFLZeyEIsWwgAe29oqYCKblvaBpvZicp8kP8C4QASDP0NudAWCVgoCAoAfIAQmpAkgBjp9_57E-qAMByAObBKoEpAJP0McVoeSXTz_57FqOng-_RGPjyokY0Vu_iS949zEcPA8s39TlEyh8PfXeFJF56NEeyKSGJ77-cVoJGuF1_eqvhNj7IcpEeBEeDRxjibEMTmH3Gu2UldDp_jtUmiuIfaEul3LSXdU9ZL3H80jHd4a4wQ7zK12X15VPGELFDqqavT9AuL-ncS2f0GNfbT15P8ciNMUs_jdgvU-NFuiwfdOygLawBPG0amJF9T6H0pVb0q0DW9wj_Qdx9wkzea25U57aS4WZWolDVOuExSmDsLB090kBQG1dnqpaoZMRs7uBxrs4fRNCSFLoR8vN9KjA6rNc8rq7u-F8wg-Kt9xwkFz0pyYFO9GhMACZ42KpZiXf3614Jh1KtW5M0r0HykDUzG3fWaDFwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwMKgoKCOS0sQLutbECqg0CREXiDRMI9b-8seO0ggMVRRjgCh02uwKDsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26num%3D1%26cid%3DCAQSOwDICaaNyd8AMPD2TzTvMtd0QMYAEK_sgy_fE6YlOvuUmyjM2AKdL98Ey2XaEazXLZWSEytdyCzAm9oHGAE%26sig%3DAOD64_0G-9PJghANpC-NtSxHxMZhO6Mq_w%26client%3Dca-pub-4647811890505995%26dbm_c%3DAKAmf-C7TIuuhkPfLPhFrxRD81wuHmMKqG52ybxl0yVyx07B6CTy9w6OyR1hdqy6RcLksTQlJxd8U4Du1IDDxPkR8KgFotFkssOeJvY_DfB42LEAH4sX6n5F5Rx6Hd3zMxR-bBVTjxU33p0VnOLJXEXbZAjdLzjLWzVMx0eLouFOA5megs7Nd3w%26cry%3D1%26dbm_d%3DAKAmf-D-MdKVUE7u_8I-1YEF6NBwheLpa9Z8PNWsxD9LRNIwUe3GSY3Yo41NJXrg-UFb8pCwNvVtjVsNaulbFArc2AgFTIaEMSRIj5wp90aiLcGYB0zxoGh2Qpvu6k6hyXA4tw-KcAviKbobQm39xwD44fCf683wVfKj5KYhhp01cZ8GkukM5Q6zQDr57dA3a6UXg_N4mNnRJ_JMFvOt_l2n5jEqAU9R-ta48b3REKlRUQkKN0WHK4tvvP-zpFwQLX5rYL57QdJDhofqNiHgvB69rX5uHI4U7NCIe1DSx-MlMOeWml4noryrOpDWEoP1_AMa5yuwVFvch7O8aKqn0MKX7c3I6ImmiJGRAJIfLrVUD2OMibMMwUCawPhqSncBqvf0bUv5aPYYTGTFrLMl5uBY9oz7CGTjmPBnlGPovnZTtQFjkwfVvXd2e5N-Gy_vAfH1B_oaoue1XE9zTESLdIjxv1jBwLOnjBVr8ROtDaSRau0uVeCWBwbB34qbWu10k41zFU6NrzABq4yQxq5V8THfYUNH6usXCWEd40i183D0QEqfakd-_1n-emxzYjnSyRpnXuMve3rLgdcNjCogRwydhXfjxJFQN7kOXgIrfa1KQOfcy9LGybo%26adurl%3D&documentReferer=https%3A%2F%2F108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fcybernews.com&random=3066871059774&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.157 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: f2e935f7e6c2d148c70f27c20de42c51c7ae7ef3ced54e4aa39f840e348db453

Request headers

Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2055
Content-Type: text/html; charset=utf-8
Date: Wed, 08 Nov 2023 16:02:20 GMT
Expires: Wed, 08 Nov 2023 16:02:20 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame 8E03
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=11589600104350404444978012502007&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=11589600104350404444978012502007&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
666 B

126ms
52ms

Image
image/gif

145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=11589600104350404444978012502007&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:20 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: D972DA1D:8D0A_91EFC182:01BB_654BB10C_25D185F:1E879
x-iplb-instance: 40027
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=11589600104350404444978012502007&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Wed, 08 Nov 2023 16:02:20 GMT
server: nginx
content-length: 154
content-type: text/html

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D19E 0
23 B 76ms
56ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B8IwEC7FLZcf3FcaGjuwPzYiBsAoAAAAAOAHgBAI&bg=!np2lndLNAAb4oU7C2KE7ADQBe5WfOFqSOPbbM_t2BwLQYP62GdTaL1Z_tQnwzec-QmCktd35NmxLKUUDeBJrnf8hTqGSAgAAAaxSAAAAC2gBB5kDBR4cfbsnzetAs7tQMG0Zdr75rhSqdYWmGxrDYL__FdqzU2V7ePV0JZ_Q2yQdWPS5WSgWYY6oRe788SWg-KID_OvIs55_wAf8ackDojWGZ8cH1WZCjWLjTNYs0KWse8ZZbJK51g_YB-5ws28Gy_6tl9QMl5MH5oHD0pcKGsSnxwgnh0DR5hGFutKdKCqd2cpxUf9GHGJQ_BAZm11eu8osnCsAWXY0UTliqBagXQ6C2tJKOfAGXfhiLAF0nje-QpdEThGqmJ4-LCq25qW6qTIEyCppQOy2wetW6J4gGS4kn1loaCOp_0RrS5ZsVdNtKDjy6KWI5qz9w4WAz_ad3w_9fyAkK0LgibxRI3FiJPBexPPMQq3BTsJq8ELdx0QQhslYcoTlxz5bwTJw3PC82NTSHYYbiMUmmMC5ifmUTmMxcsApyskxiFXWqpkV1rOoPN-lWpHqJPRAwA64qk1pM03-3CPluDMKkAdm_nwVOqiilIF3Kqw6HoaeSXybjDY8Xi5mmHcBq6ZHPUhEIN_66W-oMnqveYk1hZSejcofrf4tWV8gT2byqVkZfD__qw524mk7TUw5MzmiA7ME_xVZdloQKkMv9VGDjy4-q6EGEj8nSnUEs6yhEdsntCuH0hj96mDx1l_s4II80QmU6Uz8tELODveRz7hYbAk14P64q4eJcj_7HSLi1ceRhWCugP-hDeImkmoeN8P7hMa-UU2qDHE6rP3rCoQ9Yl_k9KWI3njT4JVjZrZ-4iPaqWiIigxj9pQIBUX289Ht-8FpEl0WN9ioOhfj00scCsNT7nM8WDjdSgHdfjIOWvahhzskDkfH3UXUlfITMuAhNRe0uvRHxZ4dQnMs25t_tLnd-_93S63-i-qwbVSKFQxtAfv8fDoQNxsZ5wZugohPJsrBDTgi_0fXNo43XXgjKO77yyhAk9vqvTw_aYbmziqDjvBbhzIAxJYFsIwyEnE9TmndK8gyvpDR-ZmZrULBvbDKbrxcScLTIgKbYwo9bZT82jLBrHA8xEsETFUO00Zm

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame B138 174 KB
62 KB 57ms
37ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9356bb8505913db4ab7c8152d6cd53f971a60d561358d8de24b437705e21ea7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63851
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 08 Nov 2023 16:02:20 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 7CD5 1 KB
646 B 27ms
19ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 85223
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 16:21:57 GMT
etag: 48472445140208031
expires: Wed, 08 Nov 2023 16:21:57 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 8E03 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c34f54a7c6884632387532966e1254f4a3aee28c7bb41684ace40736874acedc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame C50A 53 KB
19 KB 91ms
22ms Script
application/javascript 18.66.147.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=61732500117167904444556012502024&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75b11328827bb635b369ee1f4c8e9dad82b7b609d5bfc736d8ce1994a6f4c03b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 18:38:11 GMT
content-encoding: gzip
via: 1.1 ed7f977b6d983a16331e3fe3f4764e9a.cloudfront.net (CloudFront)
last-modified: Wed, 01 Nov 2023 16:51:16 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 77050
x-amz-server-side-encryption: AES256
etag: W/"5d5bc5942e2e0a61b44429bb852bdc91"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: GGUJtBmTALdRXxgGZS7d9C9L_AHAWDfP4MgtibCccqbTJWu7mGhTsg==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame C50A 3 KB
3 KB 88ms
19ms Image
image/png 13.32.121.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1699459640&Signature=eoSWZhH0LmxCtzX21T8qt6uFLTk~4bCWTSuWSEDpVFqGUekG50O~Hq6yiIB41LaW7l5glYZECgOH5wzKWMztSo4n386CFmZFCa6B0V4m0nXz3VPcerNy8JQ-D83H1kP2~UWDtvtAaQ3PPLSE5yl8HM-c7DMNvJCxaDrVR6ysWkQtygAj0veJiUU~2E32doeaLyCqLMKnNzcAYfql0VYLQBgIg2ZI2V1bZ6bp54unXWGkAGesZKVO9bQ1QLtTrhxHzq4RrRtoUj75gKoHJEjImUmyxZmYbyPtZemrVz62-lrIXHQOJ2KscuhnzGgDQH~fhFCDm71HPP0jPda~SVZ0dg__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-109.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: null
date: Wed, 08 Nov 2023 02:05:44 GMT
via: 1.1 adc51edbb4dc468fb382e40b115a2f62.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1
age: 50197
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: 260kR-jEjxL60dgikJ69M0LKzYQ8hku8dkt-YOyxeh1FglHyl7enTg==

GET
H/1.1 200
OK viewability Show response
hal900024.redintelligence.net/ Frame D38F 0
150 B 85ms
26ms Script
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/viewability?s=61732500117167904444556012502024&a=d162366b&vb=m
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=61732500117167904444556012502024&a=ce3ddc3a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/request_content.php?s=61732500117167904444556012502024&a=ce3ddc3a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Wed, 08 Nov 2023 16:02:20 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 5066
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=81530600115245104444556012502002&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=81530600115245104444556012502002&actionid=879111&produktid=ratenkredit&dt_url=

0
179 B

53ms
50ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=81530600115245104444556012502002&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=7d97f2ce26&subid=&uid=9f6e7c32aa6b81c5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC2mbzCrFLZfWYDv-PwuIPup-7gA6m5b2gaZ2cnKfJD_AuEAEgttfpe2CVgoCAoAfIAQmpAjT2-VDP5LE-qAMByAObBKoEnwJP0MoBeZvo7q_ta-PBIcStN11S7fuqLtTkXfzAAzP-6qQsUIpUQqSAyT6y1qL_fFOfPkhM1b4rck6eRqpgFWMW8icz96RJq2v4EMJrk_HDherbztz2YbOvTgM-Ms3CbcH60kRzeafHA0nHP_qHMuoUR8-AUqIsjtRQJN8VBU9fBxlAVruoBKXzPXma0awllY_eBcpgKtad5QMojAHQGGBbWt_-BVpy3oY766hQfhFgDQ6mLTqgJJrtsXd5u6vgoduOQP1vAOLXQA56Zcrbp633djLpIcUJ6Eqd298jxfarI9C4kW45u6kihhh9_3HZAhxtxh7eRqtNtvaX8J3vvBrvgOKBw-S-pRUfdcy_s1-42eQfVOn5DJfH52Hwe-CLTMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB%26sig%3DAOD64_2LLfF4xeUB9JCobCAu67Mhmn4jog%26client%3Dca-pub-5928161074779380%26dbm_c%3DAKAmf-DeIfZHGoWnT06yeo4Yma5TpKGSCw3X6kh3Fa2bt2z65h2RedDoGdnht7HvW8NY8ZKqyu75ap1vg2B9WuMPuUu-gnQ7rzzxQw5gfmjrMGczm8QDb2SDw2QgUf3aGqr0IYjKrrVn73340AuUoEOIty6GQZy-3lvv-O3e3WVjZzNE_gTWvrE%26cry%3D1%26dbm_d%3DAKAmf-BglPN-28nuaf72W07dZhhuZA85jxWTYJYg-pa1YEnFTYwDVDbNhGs-x39k5oCjX18Q7jCICdqU8Bljh_L4KxEMFObWvwMX2LcoDjUCrYtl_vDdgyzRQBd3xnZBCINCT6ENa2LnyogsQ45XsdOPeNDOpj-GV9bpj4fDrgyMpaJSxxWuO3BGis75eKkYyRV5NkRlY5cCHLZ63BU97YrQsQPuGHMauXSqUDeshFlt_JCntykMMcTlkQG_uz-UA5yZpg-rER72m9HewB3D1Wm2VWhULAk3edRluOd34fgNcYP7relSeAElveaCS3ufufJnOp_MOxC7yJOK8tXuUDj-uGVwyBloNdCPVGD1GR6Jgf65r7zbsv2bwHEMFXUzFtWUGJJvA2cbinP2v6d_V5KJtzn240fvQgFwwjjCzv-mdyQxk83b9AFFW5mOSbgTojoIm9Zd1J-yRtkCtutODFZ1Zm3qz-qooUuT-dxpkYg9xI-HZGkYidxZkwly0tsp7qwAf9dkeHwrKxKW3RQ6SV9Q5Y7ay3tU8S51X_OLpQTinHfyDz91oDl02m7BmpH-GLZygwHVtsu6fStdLOwHiqLAMCBE4GUtSilHabKzwg_KvcAOx65U-zg%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231106%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-1-%26adk%3D1812271804%26client%3Dca-pub-5928161074779380%26fa%3D4%26ifi%3D8%26uci%3Da!8%26btvi%3D4%26xpc%3DeKeosRUNgx%26p%3Dhttps%253A%2F%2Fcybernews.com&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fcybernews.com&random=7167401521338&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 08 Nov 2023 16:02:19 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Wed, 08 Nov 2023 05:02:20 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Wed, 08 Nov 2023 16:02:20 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=81530600115245104444556012502002&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40027
x-iplb-request-id: D972DA1D:8DC4_91EFC182:01BB_654BB10C_25D185B:1E879

GET
H2 200 / Show response
adv.office-partner.de/ Frame B328 930 B
922 B 43ms
31ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=7d97f2ce26&subid=&uid=9f6e7c32aa6b81c5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC2mbzCrFLZfWYDv-PwuIPup-7gA6m5b2gaZ2cnKfJD_AuEAEgttfpe2CVgoCAoAfIAQmpAjT2-VDP5LE-qAMByAObBKoEnwJP0MoBeZvo7q_ta-PBIcStN11S7fuqLtTkXfzAAzP-6qQsUIpUQqSAyT6y1qL_fFOfPkhM1b4rck6eRqpgFWMW8icz96RJq2v4EMJrk_HDherbztz2YbOvTgM-Ms3CbcH60kRzeafHA0nHP_qHMuoUR8-AUqIsjtRQJN8VBU9fBxlAVruoBKXzPXma0awllY_eBcpgKtad5QMojAHQGGBbWt_-BVpy3oY766hQfhFgDQ6mLTqgJJrtsXd5u6vgoduOQP1vAOLXQA56Zcrbp633djLpIcUJ6Eqd298jxfarI9C4kW45u6kihhh9_3HZAhxtxh7eRqtNtvaX8J3vvBrvgOKBw-S-pRUfdcy_s1-42eQfVOn5DJfH52Hwe-CLTMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNQTya0-07L-BD34o0ARYzYvaykmMW-SFJqqZGm9a0f8UnbsGF-B1MyOCb7OnrF0DXlp7H-VCK2hgB%26sig%3DAOD64_2LLfF4xeUB9JCobCAu67Mhmn4jog%26client%3Dca-pub-5928161074779380%26dbm_c%3DAKAmf-DeIfZHGoWnT06yeo4Yma5TpKGSCw3X6kh3Fa2bt2z65h2RedDoGdnht7HvW8NY8ZKqyu75ap1vg2B9WuMPuUu-gnQ7rzzxQw5gfmjrMGczm8QDb2SDw2QgUf3aGqr0IYjKrrVn73340AuUoEOIty6GQZy-3lvv-O3e3WVjZzNE_gTWvrE%26cry%3D1%26dbm_d%3DAKAmf-BglPN-28nuaf72W07dZhhuZA85jxWTYJYg-pa1YEnFTYwDVDbNhGs-x39k5oCjX18Q7jCICdqU8Bljh_L4KxEMFObWvwMX2LcoDjUCrYtl_vDdgyzRQBd3xnZBCINCT6ENa2LnyogsQ45XsdOPeNDOpj-GV9bpj4fDrgyMpaJSxxWuO3BGis75eKkYyRV5NkRlY5cCHLZ63BU97YrQsQPuGHMauXSqUDeshFlt_JCntykMMcTlkQG_uz-UA5yZpg-rER72m9HewB3D1Wm2VWhULAk3edRluOd34fgNcYP7relSeAElveaCS3ufufJnOp_MOxC7yJOK8tXuUDj-uGVwyBloNdCPVGD1GR6Jgf65r7zbsv2bwHEMFXUzFtWUGJJvA2cbinP2v6d_V5KJtzn240fvQgFwwjjCzv-mdyQxk83b9AFFW5mOSbgTojoIm9Zd1J-yRtkCtutODFZ1Zm3qz-qooUuT-dxpkYg9xI-HZGkYidxZkwly0tsp7qwAf9dkeHwrKxKW3RQ6SV9Q5Y7ay3tU8S51X_OLpQTinHfyDz91oDl02m7BmpH-GLZygwHVtsu6fStdLOwHiqLAMCBE4GUtSilHabKzwg_KvcAOx65U-zg%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231106%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-1-%26adk%3D1812271804%26client%3Dca-pub-5928161074779380%26fa%3D4%26ifi%3D8%26uci%3Da!8%26btvi%3D4%26xpc%3DeKeosRUNgx%26p%3Dhttps%253A%2F%2Fcybernews.com&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fcybernews.com&random=7167401521338&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Wed, 08 Nov 2023 16:02:20 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Wed, 15 Nov 2023 16:02:20 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 4169
Redirect Chain

https://pv.medialead.de/trck/epv/89f7480c0afa0150827cf163f8728151?subid=81530600115245104444556012502002&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=654bb10ce042321e092f45bc&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=

0
179 B

50ms
48ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=654bb10ce042321e092f45bc&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 08 Nov 2023 16:02:19 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Wed, 08 Nov 2023 05:02:20 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"25200521800103636","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Wed, 08 Nov 2023 16:02:20 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=654bb10ce042321e092f45bc&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40028
x-iplb-request-id: D972DA1D:8DD0_91EFC182:01BB_654BB10C_25FD72D:1A42B

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame BB16
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=81530600115245104444556012502002&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=81530600115245104444556012502002&actionid=879111&produktid=ratenkredit&dt_url=

0
179 B

109ms
39ms

Script
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=81530600115245104444556012502002&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:19 GMT
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 08 Nov 2023 05:02:20 GMT
server: Microsoft-IIS/10.0
access-control-allow-methods: GET,POST
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Wed, 08 Nov 2023 16:02:20 GMT
strict-transport-security: max-age=15768000
x-iplb-instance: 40028
content-length: 0
proxy-host: pv.medialead.de
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: D972DA1D:8DD2_91EFC182:01BB_654BB10C_25F7731:1A429
vary: Origin
content-type: application/javascript
access-control-allow-origin: *
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=81530600115245104444556012502002&actionid=879111&produktid=ratenkredit&dt_url=
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame BB16 43 B
666 B 189ms
129ms Image
image/gif 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=81530600115245104444556012502002&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:20 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: D972DA1D:8DE0_91EFC182:01BB_654BB10C_25D0529:1E87A
x-iplb-instance: 40027
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 74EC 0
23 B 65ms
55ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BzbREC7FLZaimG-eKjuwP19G_-AIAAAAAOAHgBAI&bg=!jY6ljsHNAAb4oU7C2KE7ADQBe5WfOHXN-R7AlHcERjCI85gjzHkhGddavSHGqegOPYqrzc0w0zHw63J_2dHc6adOcN9eAgAAAblSAAAACmgBB5kC-Rlqslly6QwgULABpLG7cdogTnRaSHxPq9IACM6TLmGjXwLlpGZd5JQ2YpqSsuajf_rZUz7TEjqfd7pJoKCOdwZeZpLc8zzQyFK2riuDL7iIjohHsF9LfBoNMtZug2fnBrSJ1Q7z6DMmNGbc7qPVupCqgXv6zYgSDeFpYNucE6oCektyQck1fSOl4kQ6oKSezvzeRUPIKlJFsHdLb87BpAXIrI96J5fVFAHYcpBAzzDoQEJGn4dr1wh5p7aGjf4qrRvGdTtrEilHk1p5g9Yd5RvkgWouTU3XfU0HxnYwQFLofjFzoNBIU2pG-Zxu0fPLN0Ky6efNDKeNSZEbYUi-k1ReQ0wsJFKkiAQfwAZZI6aRj2abnLWO5HSPrU2sv9xUXLVd3zSc42owp75Y9j6g2gOSTU1LU2U09XnXW-w0Yy7B47o34OShLDmdyg0QY1AslgCNYqNHO3YUP00duCwAccn53I9_hxH-D863ZdA__2InW4nuRMuZA0GflLRUCQUdbH2uAuJE69DH_VaHeSbPushseudKkoyK6ni7H40UDh13pgNOz36i3IE0WuhLDQkv3fLKrWKn4c_UOmGww7GHZED7uBd8_Sj8tdKJVbM_yB9n7RUXBJj0jCTS54pmhfTcG5rsBfzx2EprCkoMwzey07aDFV_SGocSV3SRU9T-UWArBaoaZ4Bv3Qld7ZLN_oph1QaSmRgCnxUKGJjcFN2sluV3CWXrHXtUlvouQ-zbzqkm-2wLx6QJDTWK30ZbKQM2sZ0aSw_IjVFFOURUnr8GKH-RCuc5JcTdWMj5OpUfkPBjJ6kOdunvYjWA8kGEGMtc0CL_UJNNESQaKb-mq5OhGYnPZSwLd8eAKZXXlvu03aWxgfehhD0Toa0ExaZBhExmBdjcFnBilAnZXHb5_LxeTP-cIzVp_Td-r5S5JqUu11bs6W48uDLlnpRRL34iFgSRoS5oTTD8VognX58otX6ra_bupA2wWG5UdW19RckpJZ0Sfof9Uptj1r-n

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 86B0 0
23 B 63ms
61ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B4Z4JC7FLZauIHfrC9u8PyrW6sAcAAAAAOAHgBAI&bg=!-vml-bbNAAb4oU7C2KE7ADQBe5WfOOTh5FYGxTeYpF8gSALMdbRB7FlmgtcQN3QkmoYriOlRM_FUHSBzgahvGpg8c_QAAgAAAa1SAAAAB2gBBwoAG188AIT73HWn6jp1U0CeSpHpxreNQ1LV2WBN6pkC_kmkA8fdEbJAQeXbMI6QYJgbu_JB9YE2zeapuxZQSmK4cuJWTH18gn8EfyNavg87h-r5jgz0-KagBspdiGJR9hZnUYJvNfEJWvhcF2M62axqZep95S2BPmAIevDPSuQiV9lV2wZbc7M85bNRIJkKitdctCWKwNsQczc6t9sXKYRHdMKmJ22mtrTuTMu3MdzwtZbWZxwya0ZKhJc_01enoYR7umNA6Dh8ScYCP9RNGxJC1VZOd-T1pCkPDt4kEQBatgEp3K2DND3m1Gwrbzdg_k18SgiP5CLR14yAm53CdtDI9w7pakBPd8or9srrerIB44mfl1CY-nNv2li24SUEdeDkYrDXjaRtVgNaFDwd-CO06dBB7iTz3XYILqZ2cGapu5P9avycKMh46eK7VhaPrsFQrTo9FtFBC9MXSOHGl0CbrU79P0162dk6CO8IMkx5Ek3Rqnaeo5HmgP4i6TXHaV-uq3hu1eJ2VHiC0eswwMdb1NmNCHZwi_EhWUEjvsTB6iGoFbhCc8dIGfKTaEsTa8ifwJ-DVxr_7-axeIb0sy1ov-seu0vPBogK4UBHpfGS8ND0U9rgSQtIsF7PIB18WqveVHr52VMEsU6mf_DKPFSGfKr-islHza8HPiEy1hfs-GlAJQY4E6S8KJXBCA_ZZgnNdAgXuZK3EHy0mNhSgAJ4_t2CFpJJDHewOXAVCbpfQkM6qgY_4b9laX8HggiO5wUoMKGuUWA3eAnEgNkgQAZY-wKsuuAPJpv6eKSRXqcltD-KZFn37sXCuAAQEIWDQy_9RwnM-4ZFaZhc-VCSsM3VtTq9a8v3LqAQnCOwWUN-qxcb4Ax35FQFb59rQraBAQmiXn7Y8DZFEHPJizCtFVtAQjsmVymnf84uL_KR-ZMFo1fzfpPsZN0ExdJmIxOUq6AYnYJaOUiveuOiswtN5X6v461dLTi4ZuX9Lz89rWrIh4g_MsKVBk_0S2xCvJ8fivweaDRXeQx0dc1ABXhJUgAqY4-7vLFn_rmHV8H2i5k

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 2022 174 KB
62 KB 31ms
30ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9356bb8505913db4ab7c8152d6cd53f971a60d561358d8de24b437705e21ea7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63851
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 08 Nov 2023 16:02:20 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 3A49 5 KB
682 B 33ms
28ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=11589600104350404444978012502007&a=aacd681e

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 08 Nov 2023 16:02:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:50:13 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Nov 2023 16:02:20 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3A49 95 KB
95 KB 86ms
33ms Image
image/png 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=300&height=200&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=11589600104350404444978012502007&a=aacd681e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: 6c265ba59d1397e906b30383fcf907cb37eec472f332b59285c4c4e1a8de64d0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Wed, 08 Nov 2023 16:02:20 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3A49 81 KB
81 KB 85ms
33ms Image
image/png 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=300&height=200&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=11589600104350404444978012502007&a=aacd681e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: 4d8d02f05b1b6b7c70c8f32a6ac40bb62e3fdbf4622862fc0af2fc961371092d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Wed, 08 Nov 2023 16:02:20 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3A49 55 KB
55 KB 75ms
27ms Image
image/png 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=300&height=200&url=https://cdn.contentspread.net/24i/advertiser/50502/creativesup/Fyrst-1200x627.jpg
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=11589600104350404444978012502007&a=aacd681e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: 9a683ac65907e7556e869a44dab125006e0b1f93d84ee48aae1814def12ee946

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Wed, 08 Nov 2023 16:02:20 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 56072
Vary: Accept-Encoding
Content-Type: image/png

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 7CD5
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEDwFDaKmWikuqVyVd8q4q_M&google_cver=1&google_push=AXcoOmTu3_9jb9Eh6gCrpc0au5Py3qFxCQt8HN5KEkC1I4GxNFGOoa-HzE6yKiREMb_pMpkCvuJ_0RsHONZoZArgQ6C-C8Y3fPPipg
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mzc3Mjk2MzUzMTkzMjY3OTU1NA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDwFDaKmWikuqVyVd8q4q_M&google_cver=1

43 B
398 B

27ms
26ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDwFDaKmWikuqVyVd8q4q_M&google_cver=1
Requested by: Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDwFDaKmWikuqVyVd8q4q_M&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 7CD5 0
103 B 49ms
38ms Image
text/plain 2a02:fa8:8806:13::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEFbFTyyacaAl887MMR09lqk&google_cver=1&google_push=AXcoOmR5QgaKQ3o3l9CZH23I8YWR8PyenHIyNZHoGvEetMFXd-XlOM61zm8Hlzvz9NxCtNwoca7quzjYqRzGwd9HJz9RLX14C6TP
Requested by: Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:13::1370 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7CD5
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlV1eENnQUFBUHJQblFBag==&google_gid=CAESEE04w_YyWC3sDnm35VWgJP4&google_cver=1&google_push=AXcoOmSzwmLkThUHtNM1PhdrYWdY0r8C_H...

170 B
188 B

31ms
30ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlV1eENnQUFBUHJQblFBag==&google_gid=CAESEE04w_YyWC3sDnm35VWgJP4&google_cver=1&google_push=AXcoOmSzwmLkThUHtNM1PhdrYWdY0r8C_HayNUoaDqNXtJeBM0hSrvSX999-wsd2R99vu_Pb0yMjK3i6hfqpw4QlY-h-pVFHZgwF2Q

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-cph2320040-CPH
pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1699459341.727368,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlV1eENnQUFBUHJQblFBag==&google_gid=CAESEE04w_YyWC3sDnm35VWgJP4&google_cver=1&google_push=AXcoOmSzwmLkThUHtNM1PhdrYWdY0r8C_HayNUoaDqNXtJeBM0hSrvSX999-wsd2R99vu_Pb0yMjK3i6hfqpw4QlY-h-pVFHZgwF2Q
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7CD5
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESELyWjRviIVlMrn5RPXjxrwc&google_cver=1&google_push=AXcoOmShfwdKlzGfOStnfaD-EShXe3LGNfg0eWMIh4UiX9zJcSgtJIYJXznvrSbY0CFVhhCr5_IpraMwHAUQacdp3f4BjCD...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmShfwdKlzGfOStnfaD-EShXe3LGNfg0eWMIh4UiX9zJcSgtJIYJXznvrSbY0CFVhhCr5_IpraMwHAUQacdp3f4BjCDcDGTwdQ

170 B
188 B

30ms
30ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmShfwdKlzGfOStnfaD-EShXe3LGNfg0eWMIh4UiX9zJcSgtJIYJXznvrSbY0CFVhhCr5_IpraMwHAUQacdp3f4BjCDcDGTwdQ

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmShfwdKlzGfOStnfaD-EShXe3LGNfg0eWMIh4UiX9zJcSgtJIYJXznvrSbY0CFVhhCr5_IpraMwHAUQacdp3f4BjCDcDGTwdQ
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7CD5
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESELiS35P1ZzrpumPijNkgaCM&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESELiS35P1ZzrpumPijNkgaCM&google_hm=ZUuxC3IQQP_Km-B4CnTlUwAAFKEAAAAB&google_nid=index&google_push=AXcoOmSEJISlHOC5LsyOTOfLDTZPu9aKDsV03...

170 B
188 B

31ms
29ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESELiS35P1ZzrpumPijNkgaCM&google_hm=ZUuxC3IQQP_Km-B4CnTlUwAAFKEAAAAB&google_nid=index&google_push=AXcoOmSEJISlHOC5LsyOTOfLDTZPu9aKDsV03MjL7rHt2x283xAn_bRCAcdsHo7LIjLp_4k0jpNKf8nqJ9mp_SeH4Iz0P_CTiKwN

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4X0wbh3I1uIVV%2FW2pLHQVePmOEwkQIwFVC%2FVKrYEN7O838%2FdzBdm%2BjTQHOa3obRP%2BGToWcXyYB5UbIUVBDf4Ykl0FgX9LwNVM%2BjkzYE9VU8nGrS3RIb6sAzOCNIMzY1VNtqX46F%2Fv6WP5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESELiS35P1ZzrpumPijNkgaCM&google_hm=ZUuxC3IQQP_Km-B4CnTlUwAAFKEAAAAB&google_nid=index&google_push=AXcoOmSEJISlHOC5LsyOTOfLDTZPu9aKDsV03MjL7rHt2x283xAn_bRCAcdsHo7LIjLp_4k0jpNKf8nqJ9mp_SeH4Iz0P_CTiKwN
cache-control: no-cache
cf-ray: 822f0a2f9be239c1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 7CD5
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEHe8Ts_0y3BRJJuonSQQYtY&google_cver=1&google_push=AXcoOmR9dgXmxjRUyju86rUrIBjGyG2UHuAzt1ZxR926np8QremhZe2i3_R-YbKm8iIFGJLzTdoDk0ln-mE...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmR9dgXmxjRUyju86rUrIBjGyG2UHuAzt1ZxR926np8QremhZe2i3_R-YbKm8iIFGJLzTdoDk0ln-mEjifgwbQLT_RHr4mN1CKM
https://onetag-sys.com/match/?int_id=19&google_error=5

0
200 B

24ms
21ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip253.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7CD5
Redirect Chain

https://csync.loopme.me/?pubid=11537&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_109}&redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dloopme_eb_%26google_hm%3D{viewer_token}&google_...
https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=a5e18942-624f-499c-bb05-4e1b6db4986c&google_cver=1&google_gid=CAESEB1oeWKkKR2-rBN_ykjOIg8&gdpr_consent=${GDPR_CONSENT_109}&google_...

170 B
188 B

28ms
28ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=a5e18942-624f-499c-bb05-4e1b6db4986c&google_cver=1&google_gid=CAESEB1oeWKkKR2-rBN_ykjOIg8&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmRBU0tGaELEYWRjQGLsM10Wu7i-WIWgDcWQG5a82-AEea2Pe8Gi252Hdmc4pIilVsVa3MavnVDCZaEPZRe4gmVgOu-H4VAs910&gdpr=${GDPR}

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=a5e18942-624f-499c-bb05-4e1b6db4986c&google_cver=1&google_gid=CAESEB1oeWKkKR2-rBN_ykjOIg8&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmRBU0tGaELEYWRjQGLsM10Wu7i-WIWgDcWQG5a82-AEea2Pe8Gi252Hdmc4pIilVsVa3MavnVDCZaEPZRe4gmVgOu-H4VAs910&gdpr=${GDPR}
date: Wed, 08 Nov 2023 16:02:20 GMT
server: _
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 7CD5 0
12 B 33ms
31ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IHuH4pFI6obDEwmwo_SNy3f8Ot-qdrCZTcHbYTTsX-5zjweDMfOm3PTcoOqEq8l3Vb7ncAo_U

Requested by

Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:20 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 8E03 53 KB
19 KB 42ms
26ms Script
application/javascript 18.66.147.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=11589600104350404444978012502007&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75b11328827bb635b369ee1f4c8e9dad82b7b609d5bfc736d8ce1994a6f4c03b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 18:38:11 GMT
content-encoding: gzip
via: 1.1 ed7f977b6d983a16331e3fe3f4764e9a.cloudfront.net (CloudFront)
last-modified: Wed, 01 Nov 2023 16:51:16 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 77050
x-amz-server-side-encryption: AES256
etag: W/"5d5bc5942e2e0a61b44429bb852bdc91"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: u3P1iU2Wq9IPttpd59JJm77-RyAqpLOkKLIcB1sAr023OVsms6-xdg==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame 8E03 85 B
438 B 36ms
20ms Image
image/gif 13.32.121.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1699459640&Signature=kla2uzTSyJVLTtbIotVeWpQ7y8sYRzix-AEHzPKWJ17DMD~zPQ-hL4SYCza0ddi-3bcf17GBs2bPPplqyYuz13u2jnVH2UnF8S1XddE4-ksMBFSAUp9MS3G2t9-2ZiJBl6H2VuXB4gRvBTB4NVyGlIKR7mlTWgyWgELXGKzAzer~BTz0c7-m7qjAbUeghW71VmOS1Co06cMwwOOY9wzs6qfnpbESL2lHIk8~MKEzXM-oVGl2H-3dkPssLL0an1JaptZRhydUqFJi8SU1JFs7VMPXaoF4P8sBzPelLj0h-IuvcxJnnNAS9gcnY7Whso3Vpbia7xokEh9uSZGzpJjzKg__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com
URL: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-109.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://108f59394603b736cb1da0196c3d04de.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: null
date: Wed, 08 Nov 2023 03:55:18 GMT
via: 1.1 adc51edbb4dc468fb382e40b115a2f62.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1
age: 43623
etag: "70af33d70b6810475aae19743c8c435b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: 5ljG8Ip5eLyd8UP2q9jlwOKX0tkrmbZuuQH3NS9ZiOoHuEDwN_mzlw==

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame B138 273 KB
91 KB 30ms
28ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0ac203dce0348048daf79c4591ae98b774d0ab41b6b6643ca286e0b1592d432a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92673
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 08 Nov 2023 16:02:20 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame B328 174 KB
62 KB 39ms
38ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2991aafdee56b52847cdd491465e3a7e4ad5a240ebcd3dc31228ed76b8dd621c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63855
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 08 Nov 2023 16:02:20 GMT

GET
H/1.1 200
OK viewability Show response
hal90007.redintelligence.net/ Frame 3A49 0
150 B 73ms
25ms Script
text/html 138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/viewability?s=11589600104350404444978012502007&a=4e09e4b4&vb=m
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=11589600104350404444978012502007&a=aacd681e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.157 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/request_content.php?s=11589600104350404444978012502007&a=aacd681e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Wed, 08 Nov 2023 16:02:20 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 2022 273 KB
91 KB 41ms
40ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0fa89e024ffd4b5257eda6b9f24d38699bf7363cd15a75102572f9b799c773d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92672
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 08 Nov 2023 16:02:20 GMT

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 3A49 14 KB
15 KB 22ms
19ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90007.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 16:23:45 GMT
x-content-type-options: nosniff
age: 517115
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Nov 2024 16:23:45 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 3A49 15 KB
15 KB 25ms
23ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90007.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 09:02:57 GMT
x-content-type-options: nosniff
age: 457163
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Nov 2024 09:02:57 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 0B32 0
17 B 59ms
58ms Ping
image/gif 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=3~lopy7mnf&c=3796831317714&slotId=1898415658857&qqid=CMuOw7HjtIIDFcPF7Qod6MAISg&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=Infinity&br=2099&mt=video%2Fmp4&vs=576x1024&msm=1&aits=0%2C18%2C22%2C37%2C692%2C59%2C342%2C343%2C344%2C345%2C346%2C347&webm=0&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4&hvmf=false&vms=1&bit=347&vsrc=web_video_ads&hcn=0&met.4=arp_a_e.kx~vil.15u&ua_e=1&ape=1&ple=0&umsem=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 5081 0
17 B 44ms
44ms Ping
image/gif 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=4~lopy7mnu&c=3070742655433&slotId=1535371327716.5&qqid=CPWTrrHjtIIDFczw7QodQ2AHCQ&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=Infinity&br=2099&mt=video%2Fmp4&vs=576x1024&msm=1&aits=0%2C18%2C22%2C37%2C692%2C59%2C342%2C343%2C344%2C345%2C346%2C347&webm=0&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4&hvmf=false&vms=1&bit=347&vsrc=web_video_ads&hcn=0&met.4=arp_a_e.vd~vil.1fy&ua_e=1&ape=1&ple=0&umsem=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231106_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:20 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame B328 273 KB
91 KB 45ms
44ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0ac203dce0348048daf79c4591ae98b774d0ab41b6b6643ca286e0b1592d432a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92673
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 08 Nov 2023 16:02:20 GMT

GET
H2 200 link.html Show response
track.webgains.com/ Frame BB16 2 KB
2 KB 118ms
117ms Script
text/html 13.43.153.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=81530600115245104444556012502002&nw=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.153.42 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-153-42.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: dfa37dadb51682f34319e945a03e6d15404d39f9779740d026e734e38efec227

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:21 GMT
last-modified: Wed, 08 Nov 2023 16:02:21 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Wed, 08 Nov 2023 16:03:21 GMT

GET
H/1.1 200
OK request_content.php Show response
hal90002.redintelligence.net/ Frame CCCA 7 KB
2 KB 76ms
26ms Document
text/html 46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/request_content.php?s=81530600115245104444556012502002&a=7355a340
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.47 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: f806a50ec3e4c112138ca7fa7571ad45d4b31e10f295b73a08394b732763bacc

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2067
Content-Type: text/html; charset=utf-8
Date: Wed, 08 Nov 2023 16:02:21 GMT
Expires: Wed, 08 Nov 2023 16:02:21 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame DF8E 1 KB
646 B 22ms
19ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 85224
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 16:21:57 GMT
etag: 48472445140208031
expires: Wed, 08 Nov 2023 16:21:57 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 node.php Show response
node.setupad.com/node/ 0
241 B 83ms
20ms XHR
text/html 159.89.25.223
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://node.setupad.com/node/node.php
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/5774
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.89.25.223 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:21 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: X-Requested-With

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame BB16 53 KB
19 KB 24ms
23ms Script
application/javascript 18.66.147.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=81530600115245104444556012502002&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75b11328827bb635b369ee1f4c8e9dad82b7b609d5bfc736d8ce1994a6f4c03b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 18:38:11 GMT
content-encoding: gzip
via: 1.1 ed7f977b6d983a16331e3fe3f4764e9a.cloudfront.net (CloudFront)
last-modified: Wed, 01 Nov 2023 16:51:16 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 77051
x-amz-server-side-encryption: AES256
etag: W/"5d5bc5942e2e0a61b44429bb852bdc91"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: sZk13xKEs8kCcbPKEuCZBd0N-MHxQSPgLjDja01jleAsphkVInLyWQ==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame BB16 85 B
437 B 21ms
21ms Image
image/gif 13.32.121.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1699459641&Signature=iWgMr02t1plrGaXGlxlJlGm4J-J1pbBP9gtGo1GXk4wfQbo4iTQ0v2EaEmaCZlLDhqwIsNdE9If-D-qQ0D74pKg7o32bsOhbk5QxgNXxpKjUjhtMJhA7tylGAmob-nuVcIujGpljP6QEPrz6smB~-DwqUM6bUXrCKFxy-POUci6TTLGcx3ovap-O1QOXwYb1DumFFRne2OJn5C79UDHVfs0tLg1acnwOqYEnf6hz9ly-mHm-4OcEnX0okCAJIJP9pXYdLwQ1FYBcgFabBadvehN5msPicb~VaPDEPpwp1kMweQy0TPptCOT16H7sORESz2eHaLHvZtT~IZsZvQjivQ__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-109.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-amz-version-id: null
date: Wed, 08 Nov 2023 03:55:18 GMT
via: 1.1 adc51edbb4dc468fb382e40b115a2f62.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1
age: 43624
etag: "70af33d70b6810475aae19743c8c435b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: uDUceLQ8Zvx6IaodxpfmDB0b6bJj-fpXI4X9YjuwysSeE-ee2b8O8w==

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame DF8E
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEGFcaASaqHMU9hvIxYAYc08&google_cver=1&google_push=AXcoOmRn2KYFIRBV36XmaBus1M1lc5EgzerSurifR9IhMm5WbIlhDqGpzHS-0fm8JWBDU483nMDCQphbAT_xbLbmf2tnJVAr2ePt44E
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mzc3Mjk2MzUzMTkzMjY3OTU1NA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDwFDaKmWikuqVyVd8q4q_M&google_cver=1

43 B
398 B

27ms
25ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDwFDaKmWikuqVyVd8q4q_M&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 08 Nov 2023 16:02:21 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:21 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDwFDaKmWikuqVyVd8q4q_M&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DF8E
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEDOIoDhqsPropPGe2fHX_hQ&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEDOIoDhqsPropPGe2fHX_hQ&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=NTUzV0oxd0gxUjBMMHg1&google_gid=CAESEDOIoDhqsPropPGe2fHX_hQ&google_cver=1&google_push=AXcoOmQHtqGZcHViq4dVhFYMhKC6MD2hYpU0p7dRHEBdpM9...

170 B
188 B

30ms
29ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=NTUzV0oxd0gxUjBMMHg1&google_gid=CAESEDOIoDhqsPropPGe2fHX_hQ&google_cver=1&google_push=AXcoOmQHtqGZcHViq4dVhFYMhKC6MD2hYpU0p7dRHEBdpM9p50kN26TgWsHfMs2rLhdkJMaSkszfoLZ3JeDvsgY441fqKNM2fWFCp78

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 08 Nov 2023 16:02:21 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-794-ga594423#rel-ec2-master i-062149d55703cc53e@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=NTUzV0oxd0gxUjBMMHg1&google_gid=CAESEDOIoDhqsPropPGe2fHX_hQ&google_cver=1&google_push=AXcoOmQHtqGZcHViq4dVhFYMhKC6MD2hYpU0p7dRHEBdpM9p50kN26TgWsHfMs2rLhdkJMaSkszfoLZ3JeDvsgY441fqKNM2fWFCp78
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 i.match
a.tribalfusion.com/ Frame DF8E 43 B
609 B 202ms
201ms Image
image/gif 2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEOfQTN76VQCek7ORtPZpLrs&google_cver=1&google_push=AXcoOmQWvmpH6BwMUGaocV8jWxkIx5IAZNaCJNSOCkOwKkmdgxx2YtwYedJcL1E6HOHGIDLCUGnz0uShRdqQcd2ok8y5Sda92zzB2Gg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQWvmpH6BwMUGaocV8jWxkIx5IAZNaCJNSOCkOwKkmdgxx2YtwYedJcL1E6HOHGIDLCUGnz0uShRdqQcd2ok8y5Sda92zzB2Gg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:21 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 822f0a32bc29bba1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DF8E
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlV1eENnQUFBUHJQblFBag==&google_gid=CAESEAXunFfiru-LYeQoSctfnMk&google_cver=1&google_push=AXcoOmRuEuOD0qTk9e7w2ThbzOaXplFfWf...

170 B
188 B

32ms
30ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlV1eENnQUFBUHJQblFBag==&google_gid=CAESEAXunFfiru-LYeQoSctfnMk&google_cver=1&google_push=AXcoOmRuEuOD0qTk9e7w2ThbzOaXplFfWfVt6si-Y8FsqYGvNe0zZbPymF7EBYPRz1QLMny9t0ZuqEX-i4yv5J4tUsNy_c20RyPEA1I

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-cph2320040-CPH
pragma: no-cache
date: Wed, 08 Nov 2023 16:02:21 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1699459341.241938,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlV1eENnQUFBUHJQblFBag==&google_gid=CAESEAXunFfiru-LYeQoSctfnMk&google_cver=1&google_push=AXcoOmRuEuOD0qTk9e7w2ThbzOaXplFfWfVt6si-Y8FsqYGvNe0zZbPymF7EBYPRz1QLMny9t0ZuqEX-i4yv5J4tUsNy_c20RyPEA1I
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DF8E
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEOL48nYlDFxmcVq-UKzjZvA&google_cver=1&google_push=AXcoOmReytOW3TpRTIZnEh-JmE0ceGh7cTMFl0-lrmEuyRYCRhi_KA-0fj-f8SEFaNSgS6xQa3eR_A_qkKWjs21JqRg4ZbX3ywEdYek
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmReytOW3TpRTIZnEh-JmE0ceGh7cTMFl0-lrmEuyRYCRhi_KA-0fj-f8SEFaNSgS6xQa3eR_A_qkKWjs21...

170 B
188 B

32ms
32ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmReytOW3TpRTIZnEh-JmE0ceGh7cTMFl0-lrmEuyRYCRhi_KA-0fj-f8SEFaNSgS6xQa3eR_A_qkKWjs21JqRg4ZbX3ywEdYek

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 08 Nov 2023 16:02:21 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=79FB703A7FD447A48595A35E3AD77218&google_push=AXcoOmReytOW3TpRTIZnEh-JmE0ceGh7cTMFl0-lrmEuyRYCRhi_KA-0fj-f8SEFaNSgS6xQa3eR_A_qkKWjs21JqRg4ZbX3ywEdYek
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 07 Nov 2023 16:02:21 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DF8E
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEBpHGy41RtWFB18_fSLyxX0&google_cver=1&google_push=AXcoOmTkclo4zjqsxGlK4wAOzYZ73OzNFM6NGgRsxsekSSgx_yoM4yXp_nO_n0ulUOZxmuokVxpO7uWoxwEC0EqI...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4f5q8xuyThAOtoh_ej3JUQ&google_push=AXcoOmTkclo4zjqsxGlK4wAOzYZ73OzNFM6NGgRsxsekSSgx_yoM4yXp_nO_n0ulUOZxmuokVxpO7uWoxwEC0EqINUzQMNB-vHn1MXc

170 B
188 B

28ms
28ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4f5q8xuyThAOtoh_ej3JUQ&google_push=AXcoOmTkclo4zjqsxGlK4wAOzYZ73OzNFM6NGgRsxsekSSgx_yoM4yXp_nO_n0ulUOZxmuokVxpO7uWoxwEC0EqINUzQMNB-vHn1MXc

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Nov 2023 16:02:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 08 Nov 2023 16:02:21 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4f5q8xuyThAOtoh_ej3JUQ&google_push=AXcoOmTkclo4zjqsxGlK4wAOzYZ73OzNFM6NGgRsxsekSSgx_yoM4yXp_nO_n0ulUOZxmuokVxpO7uWoxwEC0EqINUzQMNB-vHn1MXc
x-host: tde-deliveryengine-production-bb588bf9-2pmkc
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 sync
x.bidswitch.net/ Frame DF8E 43 B
145 B 21ms
20ms Image
image/gif 3.123.196.74
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEA_btIz0Ih--gmyh4xG9mE4&google_cver=1&google_push=AXcoOmTTxO9-NOQyVaogrS0HYUvq-rQaikpccyr6WZ9sGBJPFOGQWpIdQPzBg7nhld18j51LjzboOi7kHcjA1AbWVFFjgTkV42VBG5U
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.196.74 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-196-74.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:02:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame DF8E 0
12 B 30ms
30ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J4fJ_HHP2sGtW0mlUGVcAJsWNIpN3Yd3UDHA4ErlMWhID-UofUPhAcsvx4UA7RIP8czWKh

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231106/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS