pcloak.blob.core.windows.net Open in urlscan Pro
20.60.220.36 Public Scan

Software

nginx/1.23.2 /

Resource Hash

c74aed49a9a6d896f2ec8afba48d8bebc54b3b227e8dfa19047373de81ce3f5a

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 05 Jun 2023 22:45:13 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 80.255.7.100; 80.255.7.100; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 26d9372e-3e51-47de-91eb-3b177cb6c444
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://ye-mek.net
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ Frame AE4D 24 B
397 B 151ms
50ms XHR
application/json 216.52.2.86
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.38.0
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.86 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: 5008e4abf614e33473a98f996013b852518345d3751efd4ddf92dccf4fff3a42

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 05 Jun 2023 22:45:13 GMT
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://ye-mek.net
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap4ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 24

POST /
hb.emxdgt.com/ Frame AE4D 0
0

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame AE4D 0
189 B 184ms
64ms XHR
text/plain 2a02:2638:d::a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=35&wv=7.38.0&cb=3686827584&lsavail=0

Requested by

Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ye-mek.net
date: Mon, 05 Jun 2023 22:45:13 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 204 prebid Show response
mp.4dex.io/ Frame AE4D 0
281 B 184ms
92ms XHR
text/plain 2606:4700::6812:372
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:372 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
x-err: Parsing the Prebid Request. adrequest and manager domains do not match
x-version: 3.0.0-gcp-ams
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
vary: Origin, Accept-Encoding
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 7d2bf1d68a1e9244-FRA
expires: 0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame AE4D 0
112 B 233ms
128ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ye-mek.net
date: Mon, 05 Jun 2023 22:45:12 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 204 hb Show response
cpm.programattik.com/ Frame AE4D 0
142 B 254ms
80ms XHR
text/plain 85.111.6.48
TTNET

General

Check archive.org

Show headers Download Go to

Full URL: https://cpm.programattik.com/hb?zone=45&v=1.6
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.111.6.48 , Turkey, ASN9121 (TTNET, TR),
Reverse DNS: ns2.ttidc.com.tr
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ye-mek.net
pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
cache-control: no-store
access-control-allow-credentials: true
server: nginx
age: 0

POST
H2 204 hb Show response
cpm.programattik.com/ Frame AE4D 0
141 B 255ms
81ms XHR
text/plain 85.111.6.48
TTNET

General

Check archive.org

Show headers Download Go to

Full URL: https://cpm.programattik.com/hb?zone=44&v=1.6
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.111.6.48 , Turkey, ASN9121 (TTNET, TR),
Reverse DNS: ns2.ttidc.com.tr
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ye-mek.net
pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
cache-control: no-store
access-control-allow-credentials: true
server: nginx
age: 0

POST
H2 204 hb Show response
cpm.programattik.com/ Frame AE4D 0
141 B 254ms
80ms XHR
text/plain 85.111.6.48
TTNET

General

Check archive.org

Show headers Download Go to

Full URL: https://cpm.programattik.com/hb?zone=80&v=1.6
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.111.6.48 , Turkey, ASN9121 (TTNET, TR),
Reverse DNS: ns2.ttidc.com.tr
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ye-mek.net
pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
cache-control: no-store
access-control-allow-credentials: true
server: nginx
age: 0

POST
H2 200 bid-request Show response
a.teads.tv/hb/ Frame AE4D 16 B
377 B 251ms
77ms XHR
application/json 2.18.232.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.7 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ye-mek.net
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Mon, 05 Jun 2023 22:45:13 GMT

POST
H2 204 openrtb Show response
adx.adform.net/adx/ Frame AE4D 0
528 B 196ms
94ms XHR
text/plain 37.157.6.254
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Requested by

Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.254 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

POST
H2 204 openrtb Show response
adx.adform.net/adx/ Frame AE4D 0
527 B 197ms
96ms XHR
text/plain 37.157.6.254
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Requested by

Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.254 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame AE4D 173 B
398 B 195ms
42ms XHR
application/json 52.29.115.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.115.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-29-115-187.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 232ba93696d6d66506542f182b631f1b2467dbbb5f253aaebe4d00d68c41006c

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
content-encoding: gzip
x-prebid: pbs-java/1.119.0
content-type: application/json
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 166
expires: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AE4D 416 B
741 B 242ms
132ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=13760&site_id=333016&zone_id=2862172&size_id=2&alt_size_ids=1&rp_schain=1.0,1!empower.net,5ed754bfe4b07a92411bbff0,1,,,&eid_pubcid.org=482e2e4d-0c0f-4d3e-bb62-de1c5b2a9235%5E1&rf=https%3A%2F%2Fye-mek.net%2F&tg_i.page=https%3A%2F%2Fye-mek.net%2F&tg_i.domain=ye-mek.net&tg_i.pbadslot=div-gpt-ad-1455783126174-15337921728129623web_yemeknet_kategori_sayfalari_728x90_repeating&tk_flint=pbjs_lite_v7.38.0&x_source.tid=c1d91051-bc2e-4630-b97a-bd1608a6ffa8&l_pb_bid_id=465206a7597d72c&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7528011495722167
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: d95804e392dea27b7e5fa5ff7d2be1d807716338330eb26367d6d77b7897009d

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ye-mek.net
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 416
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AE4D 410 B
957 B 220ms
110ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=13760&site_id=333016&zone_id=2862174&size_id=2&alt_size_ids=1&rp_schain=1.0,1!empower.net,5ed754bfe4b07a92411bbff0,1,,,&eid_pubcid.org=482e2e4d-0c0f-4d3e-bb62-de1c5b2a9235%5E1&rf=https%3A%2F%2Fye-mek.net%2F&tg_i.page=https%3A%2F%2Fye-mek.net%2F&tg_i.domain=ye-mek.net&tg_i.pbadslot=div-gpt-ad-1455783126174-15337721728129623web_yemeknet_kategori_sayfalari_ust_728x90&tk_flint=pbjs_lite_v7.38.0&x_source.tid=14a57a84-3578-4333-b26b-c8b933bafd77&l_pb_bid_id=47dc87ab021b796&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.053409787090509475
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 9242bc5aae1c4962fd39b151cd37349345ab4648498aee1243e154f43d159575

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ye-mek.net
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 410
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AE4D 398 B
723 B 244ms
134ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=13760&site_id=333016&zone_id=1746730&size_id=15&alt_size_ids=9%2C8%2C10&rp_schain=1.0,1!empower.net,5ed754bfe4b07a92411bbff0,1,,,&eid_pubcid.org=482e2e4d-0c0f-4d3e-bb62-de1c5b2a9235%5E1&rf=https%3A%2F%2Fye-mek.net%2F&tg_i.page=https%3A%2F%2Fye-mek.net%2F&tg_i.domain=ye-mek.net&tg_i.pbadslot=div-gpt-ad-1455783126174-15338221728129623web_yemeknet_right_tower&tk_flint=pbjs_lite_v7.38.0&x_source.tid=aaba3fb5-8ac7-46c6-92ac-b0c86bb0cfef&l_pb_bid_id=48ddd1f0a6a1771&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.6232072499428003
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 29608bba801070d52a9654028e64ca76bcef42d1437bbad8be49b0371c8458c9

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ye-mek.net
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 398
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AE4D 397 B
723 B 229ms
119ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=13760&site_id=333016&zone_id=1746580&size_id=15&alt_size_ids=9%2C8%2C10&rp_schain=1.0,1!empower.net,5ed754bfe4b07a92411bbff0,1,,,&eid_pubcid.org=482e2e4d-0c0f-4d3e-bb62-de1c5b2a9235%5E1&rf=https%3A%2F%2Fye-mek.net%2F&tg_i.page=https%3A%2F%2Fye-mek.net%2F&tg_i.domain=ye-mek.net&tg_i.pbadslot=div-gpt-ad-1455783126174-15338321728129623web_yemeknet_left_tower&tk_flint=pbjs_lite_v7.38.0&x_source.tid=6998b4a0-faea-489f-a679-b68e155a5694&l_pb_bid_id=491598ac299dee2&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.3790692031255245
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 00bda8eef5a1720322495f23ffd00ba9b8e983d94e6775e530e33a0573fc1fa5

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ye-mek.net
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 397
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame AE4D 408 B
735 B 396ms
287ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=13760&site_id=333016&zone_id=2862158&size_id=2&alt_size_ids=1&rp_schain=1.0,1!empower.net,5ed754bfe4b07a92411bbff0,1,,,&eid_pubcid.org=482e2e4d-0c0f-4d3e-bb62-de1c5b2a9235%5E1&rf=https%3A%2F%2Fye-mek.net%2F&tg_i.page=https%3A%2F%2Fye-mek.net%2F&tg_i.domain=ye-mek.net&tg_i.pbadslot=div-gpt-ad-1455783126174-15337821728129623web_yemeknet_kategori_sayfalari_728x90_2&tk_flint=pbjs_lite_v7.38.0&x_source.tid=e7a1cf43-3683-406a-9e8f-30631c1e335b&l_pb_bid_id=513bb717cdbcbec&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.87397112009923
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 6fcefc005dba080783c25f45ba4f66230bf617fd68644b3394140840bd0b05ab

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ye-mek.net
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 408
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AE4D 21 KB
14 KB 380ms
301ms XHR
application/json 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

38.243.102.34.bc.googleusercontent.com

Software

nginx/1.23.2 /

Resource Hash

ee0975dc040b3506fd5a1092a276f8e4027a69deddf0d23e0ced6cbae866e338

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 05 Jun 2023 22:45:13 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 80.255.7.100; 80.255.7.100; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 3c63511c-666f-4067-bb6c-685ee3ca5fb0
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://ye-mek.net
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AE4D 108 KB
39 KB 319ms
319ms XHR
text/plain 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1708178952928387&correlator=4310489301891610&eid=31075062&output=ldjh&gdfp_req=1&vrg=202306010101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_masthead_multibanner_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C300x250%7C250x250%7C200x200%7C300x100%7C300x150%7C320x100&fluid=height&ifi=3&adks=1400304711&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1686005112834%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvnet03f0366d-a599-434b-a4a4-0599471fc76b%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D%26amznbid%3D1%26amznp%3D1&ppid=vnet03f0366da599434ba4a40599471fc76b&sc=1&cdm=ye-mek.net&abxe=1&dt=1686005113280&lmt=1686005113&dlt=1686005112178&idt=1017&adxs=315&adys=158&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=y7k652ro73lo&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=970x-1&msz=300x-1&fws=388&ohw=300&ga_vid=1183107570.1686005113&ga_sid=1686005113&ga_hid=236457920&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b398313987f3214dac5951d172503f177b444d384b023f9405e061dcfc1328

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:13 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39584
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AE4D 49 KB
12 KB 554ms
554ms XHR
text/plain 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1708178952928387&correlator=4310489301891610&eid=31075062&output=ldjh&gdfp_req=1&vrg=202306010101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_masthead_multibanner_2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C300x250%7C250x250%7C200x200%7C300x100%7C300x150%7C320x100&fluid=height&ifi=4&adks=2117961374&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1686005112834%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvnet03f0366d-a599-434b-a4a4-0599471fc76b%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D%26amznbid%3D1%26amznp%3D1&ppid=vnet03f0366da599434ba4a40599471fc76b&sc=1&cdm=ye-mek.net&abxe=1&dt=1686005113283&lmt=1686005113&dlt=1686005112178&idt=1017&adxs=349&adys=158&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=fmjdlx4c3ono&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=970x-1&msz=300x-1&fws=388&ohw=300&ga_vid=1183107570.1686005113&ga_sid=1686005113&ga_hid=236457920&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2f290bef28d4cbc8d601d8cc7e9302a0818c81817df8779f4c1c282ac6e35a1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:13 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12058
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AE4D 21 KB
9 KB 734ms
734ms XHR
text/plain 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1708178952928387&correlator=4310489301891610&eid=31075062&output=ldjh&gdfp_req=1&vrg=202306010101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_masthead_multibanner_3&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C300x250%7C250x250%7C200x200%7C300x100%7C300x150%7C320x100&fluid=height&ifi=5&adks=2540336837&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1686005112834%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvnet03f0366d-a599-434b-a4a4-0599471fc76b%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D%26amznbid%3D1%26amznp%3D1&ppid=vnet03f0366da599434ba4a40599471fc76b&sc=1&cdm=ye-mek.net&abxe=1&dt=1686005113286&lmt=1686005113&dlt=1686005112178&idt=1017&adxs=985&adys=158&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=76niihp3i3d&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=970x-1&msz=300x-1&fws=388&ohw=300&ga_vid=1183107570.1686005113&ga_sid=1686005113&ga_hid=236457920&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5ce738c35e719e95726cda11ab481502fdf6e8fa13b2a6729a06826780341d6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:13 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9439
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 NoktaNpmPlayerApi.js Show response
c1.imgiz.com/player_others/html5/ Frame AE4D 7 KB
3 KB 355ms
82ms Script
application/javascript 185.7.176.223
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.imgiz.com/player_others/html5/NoktaNpmPlayerApi.js?dts=19513
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/empowerwebplayer3.js?v=20
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.223 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: 0b29697868cd68cfd1b5650054cc96ea755016b3242bd26469cdbd4e4f6fc18a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:13 GMT
content-encoding: gzip
last-modified: Wed, 13 Oct 2021 11:58:21 GMT
server: openresty/1.15.8.3
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
expires: Mon, 12 Jun 2023 22:45:13 GMT

GET
H2 200 zoneview
ng.virgul.com/ Frame AE4D 0
209 B 82ms
82ms Image
text/plain 185.7.176.221
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng.virgul.com/zoneview?c=&mt=1686005113294&v=https%3A%2F%2Fye-mek.net%2F&r=153394@153493:yemek_net&userId=vnet03f0366d-a599-434b-a4a4-0599471fc76b&tp=&os=&call=&vd=0&ses=0&dim=1600x1200&l=&y=&w=0&ext=,as,rc1,hf1,vv1,gprec%3Dyemek%26rec_ing%3D&info=&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&rdmt=0.983082874526304
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Mon, 05 Jun 2023 22:45:13 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H3 403 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3322 603 B
67 B 88ms
88ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&adk=1812271804&adf=3279755397&plat=1%3A512%2C2%3A512%2C3%3A512%2C4%3A512%2C8%3A512%2C9%3A33288%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A512%2C27%3A512%2C30%3A1081856%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686005113075&bpp=3&bdt=898&idt=252&shv=r20230531&mjsv=m202305310101&ptt=9&saldr=aa&nras=1&correlator=3213482652531&frm=24&ife=1&pv=2&ga_vid=1183107570.1686005113&ga_sid=1686005113&ga_hid=236457920&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1600&ish=1200&ifk=222437166&scr_x=-12245933&scr_y=-12245933&eid=44759927%2C44759842%2C44792108%2C44759876%2C31075004%2C44788441%2C44793499&oid=2&pvsid=1708178952928387&tmod=271883764&uas=0&nvt=1&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=1.ann0jpv6c4bk&fsb=1&dtd=266

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305310101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6593523210010154&plah=ye-mek.net&bust=31075004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 tag Show response
feed.pghub.io/ Frame 6775 13 B
257 B 140ms
52ms Document
text/html 34.102.243.38
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://feed.pghub.io/tag?referrer_url=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&page_url=https%3A%2F%2Fye-mek.net%2F&owner=P%26G&bp_id=noktacommedya&ch=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&initiator=js&data=%7B%22category%22%3A%22site_geneli%22%7D

Requested by

Host: pghub.io
URL: https://pghub.io/js/pandg-sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.102.243.38 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';img-src https://*.pghub.io https://match.adsrvr.org
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
access-control-max-age: 300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-store
content-security-policy: default-src 'none';img-src https://*.pghub.io https://match.adsrvr.org
content-type: text/html;charset=utf-8
date: Mon, 05 Jun 2023 22:45:13 GMT
strict-transport-security: max-age=31536000
via: 1.1 google

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/ Frame AE4D 74 KB
23 KB 128ms
48ms Fetch
application/javascript 2606:4700:20::681a:9a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:9a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed87a83a9df154b61d76e8b9b53bb9d23db3eea194e66bca6b575e3e4f7a57bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Mon, 05 Jun 2023 22:45:13 GMT
Content-Encoding: br
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 68697
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 23 Nov 2022 15:43:17 GMT
Server: cloudflare
ETag: W/"c56b6332dacf72f135afcd153ae22448"
Vary: Origin, Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C38Xs8KlmCNx%2Fnp9RIvzdfO3RuIGaZLPEhcfdmiWLW2bVp0Rs4UpJyWw2UdNO%2BkEvgYV4KSqzJSmOZ2Kzu5VDlaNAMdrDFVOMjOLLrPFsajuxOCmtY3fqV4oScYpHnwp6gWeir8tgJRWzf5n"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: public, max-age=1800
CF-RAY: 7d2bf1d72fe237cc-FRA

GET
H2 200 container.html Show response
4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7639 6 KB
3 KB 40ms
39ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:13 GMT
expires: Tue, 04 Jun 2024 22:45:13 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H/1.1 200
OK cache Show response
prebid.adnxs.com/pbc/v1/ Frame AE4D 63 B
320 B 157ms
44ms XHR
application/json 185.89.208.11
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.adnxs.com/pbc/v1/cache
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.89.208.11 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS: prebid.ams3.adnexus.net
Software: nginx/1.21.3 /
Resource Hash: 3efccc4b809235b0b1eb87190c466d2c9d28c78011b40b97607755a10f6a3391

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 05 Jun 2023 22:45:13 GMT
Server: nginx/1.21.3
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://ye-mek.net
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 63

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2BC9 624 B
246 B 57ms
56ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvN-gEQ3_CHsQMYnIes5gEwAQ&v=APEucNW0dKsnrSF7WY-fbPKOCnX9VhO3r_fb9pVYBkbIMBqGaz_25UlbLs2GAgWOgH1R2sftVhvxn4SM2pOhY1A13Hx9DeDMKR-HKUX7fa-Eb1bX81LHl9wWhIIJp0QL88RJe-sNlvf43-tW90R06UQ3E7qFvxariukOPDU3kH_NqaNErd-C1iw

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:13 GMT
expires: Mon, 05 Jun 2023 22:45:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 7639 78 KB
27 KB 68ms
68ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:13 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:13 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7639 42 B
63 B 76ms
75ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DwqRXe45A1Zf9pTLcIOZZ8e3h7nDtGfGTPUcutHuTIx_tKuPuhq9i6h-MxKTuQhJpHJTkarXu0but2OZCEQ3KVPNIe4eGT2xBMjnhIukfEEEX8yrU

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7639 0
20 B 77ms
76ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=15163451967167879646&x=1&ct=119

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame 7639 3 KB
1 KB 146ms
44ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:16:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19732
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 17:16:21 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame 7639 19 KB
8 KB 142ms
39ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 12:05:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38381
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 12:05:32 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7639 171 KB
54 KB 279ms
176ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:13 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2BC9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAsxLUMX2Ma5nmJgPpcDtrE&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAsxLUMX2Ma5nmJgPpcDtrE&google_cver=1&C=1

43 B
632 B

71ms
40ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAsxLUMX2Ma5nmJgPpcDtrE&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvN-gEQ3_CHsQMYnIes5gEwAQ&v=APEucNW0dKsnrSF7WY-fbPKOCnX9VhO3r_fb9pVYBkbIMBqGaz_25UlbLs2GAgWOgH1R2sftVhvxn4SM2pOhY1A13Hx9DeDMKR-HKUX7fa-Eb1bX81LHl9wWhIIJp0QL88RJe-sNlvf43-tW90R06UQ3E7qFvxariukOPDU3kH_NqaNErd-C1iw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jun 2023 22:45:13 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Mon, 05 Jun 2023 22:45:13 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEAsxLUMX2Ma5nmJgPpcDtrE&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2BC9
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZH5leVujdSf3OuTHNqAA1wAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAsxLUMX2Ma5nmJgPpcDtrE&google_cver=1

43 B
632 B

41ms
40ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAsxLUMX2Ma5nmJgPpcDtrE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvN-gEQ3_CHsQMYnIes5gEwAQ&v=APEucNW0dKsnrSF7WY-fbPKOCnX9VhO3r_fb9pVYBkbIMBqGaz_25UlbLs2GAgWOgH1R2sftVhvxn4SM2pOhY1A13Hx9DeDMKR-HKUX7fa-Eb1bX81LHl9wWhIIJp0QL88RJe-sNlvf43-tW90R06UQ3E7qFvxariukOPDU3kH_NqaNErd-C1iw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jun 2023 22:45:13 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAsxLUMX2Ma5nmJgPpcDtrE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 2BC9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEM_zW-k3FoJaIOHmVv1hMuM&google_cver=1

43 B
1 KB

39ms
39ms

Image
image/gif

37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEM_zW-k3FoJaIOHmVv1hMuM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvN-gEQ3_CHsQMYnIes5gEwAQ&v=APEucNW0dKsnrSF7WY-fbPKOCnX9VhO3r_fb9pVYBkbIMBqGaz_25UlbLs2GAgWOgH1R2sftVhvxn4SM2pOhY1A13Hx9DeDMKR-HKUX7fa-Eb1bX81LHl9wWhIIJp0QL88RJe-sNlvf43-tW90R06UQ3E7qFvxariukOPDU3kH_NqaNErd-C1iw

Protocol

HTTP/1.1

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.2 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jun 2023 22:45:13 GMT
AN-X-Request-Uuid: b9e35967-35f6-4586-930e-06ee75da1a0a
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 80.255.7.100; 80.255.7.100; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEM_zW-k3FoJaIOHmVv1hMuM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 2BC9
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTk0MTA0NzQzODA0Mjc5Nzk5MQ%3D%3D

170 B
243 B

84ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTk0MTA0NzQzODA0Mjc5Nzk5MQ%3D%3D

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 05 Jun 2023 22:45:13 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 80.255.7.100; 80.255.7.100; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 71d37150-51dc-4f9a-b2b1-1674ba975f25
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTk0MTA0NzQzODA0Mjc5Nzk5MQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 container.html Show response
4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame FC17 6 KB
3 KB 40ms
40ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:13 GMT
expires: Tue, 04 Jun 2024 22:45:13 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7639 0
20 B 73ms
73ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8535504170718&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7639 0
20 B 74ms
74ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8535504170718&version=m202301230201&ct=119&x=1&cor=15163451967167880000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7639 84 KB
35 KB 74ms
74ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BFJ8Q3Li4bDQWdEAGo2xYdfcCekkGY1TDsRTXkR3Jj7Y8WOxEmjUm_wDuKUqhoSb1fG97fKxKzkvzFXo9QGPyAjdhKa-VquYFskxTKzmXIdfKKLAFzqjutBETvzqcOlEhwEIiXLHji_rGArpkd8kK7nTtlV9P1vLEKV1Z_IIBShou3muU&cry=1&dbm_d=AKAmf-Dbf413aQpDyiMXoAJJCYVgAE-PH7GJ6s0MfAmsK0kBZb77UM5eJMgesGc5Njr3X6_Ub1Tm6GocnvlxPGICWprxigkzoLxQusgUTExiFgo1SjF7YEr3_ik1X-Ck2PkTp63CbyK8cHT4SYgdWNEcuvXO1EzTPwpJnPDQQiKDZdR8wirXm_KrxZKRLRXsD4D9vb0QpmGlNGt0CLhoIb8aHoCEAub82sxwkcaROFrBoNqEguCJkNXJ35aq5WevdnJ8reOLVi3aac291LIT18Ju_41VA7C4MHOQMDsNlrdM2FPCZk0LRrsbf8uZhzN06goAG9LEnQVtvx0SskHRRhhF24EMZzcmUWwqYVlR56HC_dBKqCMmWvYRMlQ0GPpScwhX3yq0ogqVyqkX1dvAux0oM6l-VDsAQyim92moA8qQWfSITXpnJ0DHP457Mr9WyCy54hSf6giU_wAmaVRqKT7CLzjUCDrCSe-7ejCvgcqVXYmgLgMQX-Oes7hpvuOqmS_PpN1VUueau2zmsgNf-hIIMk-EwkFmOE6Z5ekISr18dv8-XKT1rr_YA0-1msvRLZIG-Uyr3IB98d1KDogSoXeZ6ZOHGeBSva4HhulMeB8IW4yZzoOrSM4VGESgZnPWJcpT_GPcYwHWO69Jnfe7FTTrIr-MmI_VF-gKNsHSB3N6jbd9M6RsFnqv92rcImFJLuD8OVIIvJH19JB-syIBmFuxWiCExiYgojMF3DkwMEOPSbgnlis7wDvfgrAeb_EecpYeDPLS1iPTtcwHBRURK1IAqaXlxjSmjCdbL5bVd05Sei_niK-LJGozslNJRca3fI0Ebghrz3zwYSloBrkFpZxfz6WaCApzKcuKfvB1eFSph2v4PW74STyk_D_B9mIpxIRk6eABmN66E8L6sLKBx3NtPZwzS5sS3HBT3pvy4AAImTTyV9ZbgWpQOjYodEe3ZvTG83MQLP1wXyUJJwKiDEiTF9F_IkcbVuDNxlfTV6SzeIQWJM78mYm0hmP86y0or1TBcoB6XbRNzRSUL2FNfCS-Ek78fZ7ONCm5Nly7GfBgwnauV3DnVuwDv5FPtVUZCm-xzjnfJnoptYfkpk3rHUzVKgEZ3uENyvpoIo4og3RY_kpDZaQiCECUGXVIAeIv4WsFQ_A_dxS7nHJG_KrLDc_WdJpAYw6nVVGfx213IA_DOpvdLRv5edn68i6zhOxICi14rVjHQ7It3QyMNGYTxotyrfAQeQ_kHoM-TvW_aV4atTJ2XntZTJD7EqTgCj93Qt4-s5OUyQYci-dZ0cgLMycU7oLjieWyXDbynEeruj02Dr-uhhPvTCBy28K17ajJuyC00wv8fFSd-xV4rQT-KA75GeqjcYe5CRCYlqHlvDTzUCkoYRzigNwQw-RG3E2jbP5Hnzgxrp5Bz1i7OK9JoMAATqGcRMHKNk8kp4waiHuBZ4BssDqn8Gc2X1jrm9WWHD-MPO_Vjwq5tqtdRHq3oNJhHnqYZIln_-AusBNJXiD1lSd0NwUTuZ8BZ9jfKciBt5MaKU0ouX6-X8ANIRuWFpKGfgbK5yb2GKv5AFT8s93jBpft_3ENgsHSnN4LAVWlnnzg9TRzPIjbwvtsCoj0LNNZjjxbcBdLJb5r0omiVfkYwjuSDRtV0CzO1RqrVh1mytoI00r9mtVlYCty6S7iQF77odXlyGJR9GNZKGv2nI3d3jA07HOHUnbYOWE-Znu4F4UvOLehaNgUC0_onBQR0dJBnZlXsfJ8FUMiO1fc66xDtTZ8h55eSlGMblvAK7Zv-6E3Y6XS8IQ677vYzORCdwkFquhXXrMMLYI8bzkPBeqirP3OShfgKy_yFgfa7l7MC_YFiuVGD51OOIQitMCPfViA5IL0jL35SE2l7ILNWSi4JpZD7nV6jv9Rw_JQLsFA6XRmm6wEr3G1Hozp5EK-nVTF7jqsE2PqtGgk74Q3RQF1mss5MRghxBAu_cYNT-vL2hfAqw_aRox7D7UFos38MTcfrDh71FzYCKKTu1WqwB98Mt9CkFrO5rfRalrWR6m0HFdj8AOb_fZc56DjppMyM4IJqyZnua2lKe9Iv_uAXxPaURvfl9wwWlxJWyX5_FAutbd6AkPhsN6o52zOYaZPRqeumyt01-TS6YRSqe7dsK44hByALkjvrfVODib1TVA_qWLdDm5cLBYo8NFXrw8PSr5L89WGJT9c-shaTyvxG3eB0TrtYPoORlLGNS35SlHwaHJ81M38yDDVUJy1QGeL_Pkjt3zgFcMTDUVNEcz9lHwebfQi87opx-sLVz9C6EsZ4Ja05I3wdV0ZWoJ_o5dnzvbp3PzycwO-vHP06Ort_GN4qIYiFHoAkLQtoGO4bYqX2QSbag9Zea6ABGQQzE9CPAn0AKm4qyRz8M9Rk9HPZvHjmeSuWWeBFgbudIYxjjyExuxYCuo1wsWD9XYYW2dHqlWQ8qK17l6JbUPgybPoVd1lMFciu2XNVKRJsChWwD-2cyTAnhY-I3U49DeOltMSSvbps2SYIpLP-u8HllxV6bfe_KIQbRUOi5RqVFsvT-4RY46KcZlCZ_3yf2PTaigMpgutVmxWhBHOXRw_L3ShCP3-Y7LPWV3b8o7E4qIidGlXdyeJnH6WigzSXgiE6Q_tOZkVfYrduWjWAwtHv7gd1aLfzeQ3--QYuTk8DaR8b_dcW51G1ZxPSF4lNV97Ee41IUgHhUmXanYGVn7rQcBo58-PlIxTDzJBJaWm4vv30fZjQYjUUombTRug66X7zRAYyZQGQoy9LA2sM6ae7DGKkJauEQK1KEH4l5Kz5nYFpVJD_Ysw53KtMFgAWrvX6Tt-O9GufH1S4t0gXK5-98wCQoFbzNNhHYi8AuHEealW2zvmkJ5hZu2g7BJJa4z-a1GAml5eL8IbccjH5qluuy3LY-MwogAUZNmg7XsNaUtXxCHgIYmBaBtZtcIE9sftpIJ5KmtkABvIJbzj8Pm0OeX9Lg00s3v7VVZj-wX5BpVlAfhrb1-HOoN0nZwu2lNf0w_tpNLppbbOBZ0WP5lnlIoyFo0arQI7_NpCwWGJFXJhdqyTgDQA9qX-uWN3z2UlS1PLhSsw7iSeyjOO3P92i0NyI5YhTlzQ3_rfIq4Rq6kh_kZKWFx47VJO6-b_cRp0DRrOPuwptAij7GDvKZtxaEtPJYA6nMZtjj0H3yBsJDZmKFl3zJ33Zk5qFCxuOGk-UQjXE1ajP44LWVTOBpBziZeY4uWmyOUTxnzNVP9LXaVnoWpki1pTM5guJwutKVea4ANcaTJ4lGvLzsui_2EYq5w4EOMvRBBH_EMGIAQxtbEn3Dybb_agnNuAXdr6ioBc3_6oQAgBIVhdcc54krMPFv75Zv9NMC78cvyYhpX9nZ7AOiklENA5VZL74wxE3CsNP_uZLu1fCTS1z--FrLikDEqpKUx70qqZvXl9DCrRR29XIOPwjyHJ6jBiPI8mZp_7ua45QStrEDDpCgqKzRZm7-lmu7nszYHXA49HBa8ym7ZOScb6I6zI7rFBN-ewN8Obkx96fGbYDYDzgLx8Ag&cid=CAQSLQBygQiD446lnKciLK2K-54Wo_-4dak0EY4_gjEjCcGYzXp4BqUzY9k-YjaR2BgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=15163451967167880000&adk=3468572599&idt=77&cac=0&dtd=15

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3571ac848ac1390429dbb8e80987058915ac84fa9153cc825e083f31602e3b4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35874
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame AE4D 361 KB
121 KB 228ms
127ms Script
text/javascript 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: c1.imgiz.com
URL: https://c1.imgiz.com/player_others/html5/NoktaNpmPlayerApi.js?dts=19513

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

160d1864783c67f39eb03bef232d860b57aba8f26003317974a774a3d5146345

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 123219
x-xss-protection: 0
expires: Mon, 05 Jun 2023 22:45:13 GMT

GET
H2 200 NoktaPlayer.js Show response
c1.imgiz.com/player_others/html5/ Frame AE4D 398 KB
128 KB 86ms
85ms Script
application/javascript 185.7.176.223
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.imgiz.com/player_others/html5/NoktaPlayer.js?d=6/5/2023
Requested by: Host: c1.imgiz.com
URL: https://c1.imgiz.com/player_others/html5/NoktaNpmPlayerApi.js?dts=19513
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.223 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: bea17c8870ba8dae9515993b5c55b65437f03f0e2672e1c3d3dbe7872dd74e5c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:13 GMT
content-encoding: gzip
last-modified: Mon, 29 May 2023 18:51:56 GMT
server: openresty/1.15.8.3
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
expires: Mon, 12 Jun 2023 22:45:13 GMT

GET
H2 200 m_js_controller_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame FC17 34 KB
13 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/m_js_controller_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

787ed1e9f233b4252d8ed16a2ffe349ae6d520261f22eac2d2d543740878db1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sun, 04 Jun 2023 22:48:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 86190
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13388
x-xss-protection: 0
server: cafe
etag: 12354464270641361980
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 18 Jun 2023 22:48:43 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame FC17 24 KB
7 KB 52ms
52ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 08:18:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 570405
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 29 May 2024 08:18:28 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FC17 171 KB
53 KB 219ms
219ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:13 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/ Frame FC17 22 KB
9 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/abg_lite_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

551debe8c4f0db7b25699af72a204caf099af55413f90eb34b5f546330d6187c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 12:05:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38381
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8798
x-xss-protection: 0
server: cafe
etag: 11317101923912129037
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 12:05:32 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame FC17 3 KB
1 KB 44ms
43ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:16:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19732
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 17:16:21 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame FC17 19 KB
8 KB 58ms
57ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 12:05:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38381
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 12:05:32 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame AE4D 107 B
165 B 50ms
49ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=ye-mek.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame AE4D 107 B
165 B 49ms
48ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=ye-mek.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AE4D 23 KB
11 KB 289ms
289ms XHR
text/plain 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1708178952928387&correlator=1481092106295965&eid=31075062%2C44714449&output=ldjh&gdfp_req=1&vrg=202306010101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_kategori_sayfalari_728x90_2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C728x90%7C468x60&fluid=height&ifi=6&adks=345722362&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1686005112834%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvnet03f0366d-a599-434b-a4a4-0599471fc76b%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vnet03f0366da599434ba4a40599471fc76b&sc=1&cdm=ye-mek.net&abxe=1&dt=1686005113735&lmt=1686005113&dlt=1686005112178&idt=1017&adxs=436&adys=1389&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=cppnwpcedzqf&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=976x0&msz=996x0&fws=388&ohw=1600&ga_vid=1183107570.1686005113&ga_sid=1686005113&ga_hid=236457920&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef7140c95957b2110d06b630a494d1a5dd70b9d465ff3f9925f7dc9f85d4a994

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10749
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AE4D 24 KB
11 KB 306ms
305ms XHR
text/plain 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1708178952928387&correlator=2339693561993011&eid=31075062%2C44714449&output=ldjh&gdfp_req=1&vrg=202306010101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_left_tower&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600%7C120x600%7C120x240%7C160x800&fluid=height&ifi=7&adks=3299242717&sfv=1-0-40&prev_scp=hb_format%3Dbanner%26hb_size%3D300x600%26hb_pb%3D0.72%26hb_adid%3D570fc5a89b5bf4a%26hb_bidder%3Dappnexus%26hb_format_appnexus%3Dbanner%26hb_size_appnexus%3D300x600%26hb_pb_appnexus%3D0.72%26hb_adid_appnexus%3D570fc5a89b5bf4a%26hb_bidder_appnexus%3Dappnexus%26hg_pb%3D0.72&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1686005112834%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvnet03f0366d-a599-434b-a4a4-0599471fc76b%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vnet03f0366da599434ba4a40599471fc76b&sc=1&cdm=ye-mek.net&abxe=1&dt=1686005113738&lmt=1686005113&dlt=1686005112178&idt=1017&adxs=122&adys=150&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=ve7s0azhpie&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=160x-1&msz=160x-1&fws=900&ohw=160&ga_vid=1183107570.1686005113&ga_sid=1686005113&ga_hid=236457920&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f690819f26b024b1c35e6ce36423c3af37449df3a30d62ff0fd9714a9672bb87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11599
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AE4D 23 KB
11 KB 299ms
297ms XHR
text/plain 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1708178952928387&correlator=2713124018773548&eid=31075062%2C44714449&output=ldjh&gdfp_req=1&vrg=202306010101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_kategori_sayfalari_728x90_repeating&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C728x90%7C468x60&fluid=height&ifi=8&adks=2157304621&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1686005112834%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvnet03f0366d-a599-434b-a4a4-0599471fc76b%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vnet03f0366da599434ba4a40599471fc76b&sc=1&cdm=ye-mek.net&abxe=1&dt=1686005113740&lmt=1686005113&dlt=1686005112178&idt=1017&adxs=436&adys=2027&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=z37scxxb8qia&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=976x0&msz=996x0&fws=388&ohw=1600&ga_vid=1183107570.1686005113&ga_sid=1686005113&ga_hid=236457920&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

abcdf95cae988bb595c680ae564dab72bf44a6fa78b660aa0ff178ff65aef697

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10999
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AE4D 23 KB
11 KB 294ms
293ms XHR
text/plain 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1708178952928387&correlator=2112237751428820&eid=31075062%2C44714449&output=ldjh&gdfp_req=1&vrg=202306010101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_kategori_sayfalari_ust_728x90&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C728x90%7C468x60&fluid=height&ifi=9&adks=456810305&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1686005112834%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvnet03f0366d-a599-434b-a4a4-0599471fc76b%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vnet03f0366da599434ba4a40599471fc76b&sc=1&cdm=ye-mek.net&abxe=1&dt=1686005113743&lmt=1686005113&dlt=1686005112178&idt=1017&adxs=436&adys=751&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=ud3a5uij4zpd&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=976x0&msz=996x0&fws=388&ohw=1600&ga_vid=1183107570.1686005113&ga_sid=1686005113&ga_hid=236457920&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c71d86d5e1c5474ef727547c6b68684b05ec4968f176fb246c3e6d2f957e4f20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10766
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame AE4D 24 KB
11 KB 312ms
311ms XHR
text/plain 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1708178952928387&correlator=1330408351790592&eid=31075062%2C44714449&output=ldjh&gdfp_req=1&vrg=202306010101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_right_tower&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600%7C120x600%7C120x240%7C160x800&fluid=height&ifi=10&adks=3203893797&sfv=1-0-40&prev_scp=hb_format%3Dbanner%26hb_size%3D160x600%26hb_pb%3D0.82%26hb_adid%3D625ed56daed6752%26hb_bidder%3Dprojectagora%26hb_format_appnexus%3Dbanner%26hb_size_appnexus%3D300x600%26hb_pb_appnexus%3D0.49%26hb_adid_appnexus%3D56f9f1a3309a806%26hb_bidder_appnexus%3Dappnexus%26hb_format_projectago%3Dbanner%26hb_size_projectagora%3D160x600%26hb_pb_projectagora%3D0.82%26hb_adid_projectagora%3D625ed56daed6752%26hb_bidder_projectago%3Dprojectagora%26hg_pb%3D0.82&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1686005112834%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvnet03f0366d-a599-434b-a4a4-0599471fc76b%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vnet03f0366da599434ba4a40599471fc76b&sc=1&cdm=ye-mek.net&abxe=1&dt=1686005113746&lmt=1686005113&dlt=1686005112178&idt=1017&adxs=1318&adys=150&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=oj6zgri5nh7f&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=160x-1&msz=160x-1&fws=900&ohw=160&ga_vid=1183107570.1686005113&ga_sid=1686005113&ga_hid=236457920&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a2fdd8abddff51b3e7a09aa4a9e599449ac0233898c31528bf272861f32f7848

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11211
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 11262302460425599708
s0.2mdn.net/simgad/ Frame FC17 261 KB
262 KB 154ms
39ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/11262302460425599708

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0e2f6c277ff5d8359dec23dff73f2e1ea64f512f3cf966ba7432e76e90846fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 16:37:40 GMT
x-content-type-options: nosniff
age: 22053
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 267179
x-xss-protection: 0
last-modified: Tue, 04 Apr 2023 12:40:45 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jun 2024 16:37:40 GMT

GET
H2 200 8682746528586002864
s0.2mdn.net/simgad/ Frame FC17 10 KB
10 KB 199ms
84ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/8682746528586002864

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d3ebc5963c3ba449fc6f11b2d5ac883abaf7dbc046ac7c1b267518e0ca5fa27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 09:29:26 GMT
x-content-type-options: nosniff
age: 220547
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10020
x-xss-protection: 0
last-modified: Tue, 04 Apr 2023 12:40:49 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 09:29:26 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame FC17 42 B
63 B 68ms
67ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ABgrT87n1ksMemdcTEeHhRRjImdKzDevdmrqEac3UScSNtfdZ7ZljB-Qb0Ny3APqhA0VumgV9BuJk9bziJ7c9pNg4C1F3_xYfDuCQGbrTVxBGGiK-T9mIwe2xwqBWaKa1RybvIIFZlW7FO75m-18bRH5zpyw&dbm_d=AKAmf-Bu3ADhfDTX_4JBS0yC_P1Qhvh16F4_-q1IqoiuH8Z3ibm5Yn637IhpglPE-7RRIDqgPsI1sxgSv9n8NYZy-fJpv39D4XDl_nJtKdIXFxw55uwgK65QujPIBLXrm-rFCyDfd-q3hxGB_Ex1F-V0eaG2RIBiXgnmG8ltrNVhOcA9gs5VFL1WvKYpgqVuiZvIJkbrAFR0qR0jwlmz2etGSyfmwogsT57hcQ6g4ZoCLrM8MGPI9D73BW8pvLbSQDJiEtGMiodpORDH_mkyiAd6wX3yIwCPd-zWA-pv4L3SeeRSnQ-IX5sscMo2sMovoAQ4BVv_3TZFIJEwawqEOOfD5kNYwBkHhy6UMS5uxf3jIK2Vd-1XuTmQpYxmKYZ0RTLnzej-mVwntk1LsW2CNyfgJ7BqMZ9RkrjYomd6haJBnYjWC9IHK_xUgJrEuC1Tlm26vDtpWefBbRHrK11l4dSVtTsntHDF4RTE5RmMPmZiGuk9C1V8w5AtvASpnnpbJVoLBCF_jAv2DGZFJ38O_5gCbUw544DyRX4SnWTthqhy01M8MDiUc5RylgYCrfk82FwNQWF6F9YLaRBwcn13-gzNz4Jzujl0RFADlBceNLIjQBVyOZ-SGUAooHu5ctiKN1coOVses-gd_4iIB2NbqYqUYFu4zQJkKY3ZrWpuSwb9GhZqgMWCHllk-BdUisjrhkChduNVbZPtfcF5_JoEmEOyt4rYQyaHwbVYwq69npvfovArFc7BCP8sbwIgyUoPy_gM-YEZo9_NtzgT7Yo_GT6vdjO8FjbKURbY_H1qUGpStODM6sFOn4uMTtH4aOocp_EuvmljTRQjRIdvVDz-4sbutic1ZCTd803UQ5dG9-FMa91NO4BXBh91588qERRHHZRphG1HAwBj4xWwc_QcH2Hv02g4AyTqf1Y_7MujHOU9u45A3nNR2_bN_4b4jLycWie4GHelJWv5lMAWejTWp0Glq4cVsi5uFUS7nCVLJOBW2Mb5mzF7DoqQlkcqyc3wnU3hZKOAC5KJ617Ng-M13r48tvec5lR_CHXwYGo1k6JAGoK4oWghGA48fxlkDCNJVBvskeMhMqGnT3klT1S723hs41GNwIuSYcFPJQJpMLTQYIDdEsQkbmwFE25o-lpKc1iB_zLx8AE2KavWvTtUVCSgvAGEsb0leyoxtXnycao90BTwA1jhtoatzvsNZyQH7x497mHdYgRRi7rVV153JkfBnPtV8W2NliOSJm6PuT7vNK3KYkjTWmwuE_HxtHTWmH4iWp7lHXJwmIwk--brkwlLvIpVpXW-uiBJH2MSwqrdCeYynFUdeCNBZUGkAEkbV8xAj8NksykUf-0h5zOy_alLZxeEInFOoQgw554CSuFkRAJaITmnlaWFoUi8C3ZFQMHWwpzRDi9JDcVf3_KSR5h-7imiQPlplbWpS3AOjnW4G1fhpquy7vRKnBt4naMIKvMKPVFeOLRA1-6zu0s7ye6tesKmq5Tg6yGXpltA6Ag69u_Gn053-7t8S3z69IBLiJ_sewnYukDuCSDEttexH-Ny3GsXHFPKMeM-CkNGzz4jwsJUkwmG9dO_A35ajk8JprzDeESMDDVdxbVnkRaWnvsKztmxe8M8a1OAf0ffi27ASjHWMLsJqp-uu6nXpw6KQudWX9Ww-EIbpMupIYI_RmzamcMrvxVPKCP7jcMaArYFkoXdowqKTKEcuGrLbtpsrTBkuV_AzDRAkR_ppeDVgcwPN8I_8UAnA9GpvpXI_uEQZfywj-4shoa0imK5zETpKTFZ3PCu6IVx64csn1hVbOHABhdQHQz6l1c82Vy2Rd0Dp9b4oAwucRcO34wWdjG5i4xWT71tJ4j0ngCWSiE6oqV2Wpx3Q9lqLXW9G2v2E7cAVyjgT-lExVjYduI6iAt_QiGTIN3dCv_wy-ZK6aAu23dLYd-Iqk42oT_Rg0k058Dscf8R54MEa8FvEDeolTvBRVQOkGSUUuXnk6ra2LVBgtqfj40s5isYR7ONex7vI0A0DmEFtp1M4USae-aOTEvL32L-9UCDbu3Zd0R27i33ktD60m4V_Eoa96V2ruFHWkj4IxcbBwgrHGdjj1mdfgjLMR_8-77YfBQ66Y3oTKhofxHmkFiz20-wfMonP26MtrY5LoWiScJruKlxftHMfFaoa076EXMRmQdWfAU5vypN0qYRF9sl4vsnmCES-fxTXWWmHZIZa_A2GJ-ionJ9kUF1P-MUkiOm2D4wOIrvGDZRIbkq5gzYpjQQAkrYkfQimIRLn6ebAJDmBS6EXYnbXVn9BBscxxVqPjVzYmdYCEr3qqQY-fm6zHSTBTyyyb2YvlYLZiol3LI0nr2rXVX8hM4hgkYeVakQqvn9VNeTKJ-90jcT_Z8enXjF6HYrSQjxRURR8_K9MgedPeZ0tN7Uoli2EavHfWklcyJ1y_tYWx1tW0HGzmugbwAdDayHtKuPKNEMFxEMj1D20TZdszvuQW3K9AkdcKAjJpGVkbMuv3Rz5bggCKmrS7dJWBsMOEWuULQ4JAlPkEFVDHSeWjkMCMj5wzA4f6sXTb5u8HmuUdR2eQvABVQuc07zhdT0urbuc_1gJAUGgXgR1c46i2V1kgXBzblm5i3Qe-a5WKJI2hDMgjh4NrOihJnHI-rsOhj8sxxXK36pgjqG_cqB4SsnJr0JCsQc5S0vu63oTQHY45bdL6f2akecK59RyMC6xwQYNKd9p55NPfsK4ItaLXXOnXr8bXtbfM_jW1udtDzZR9tFbXPRhPqY3mQgr-UEW_zPxyDk-AyYZNksnUFcX8cmZWJ5u6YZkBw3hfqVjKBIG1WUrM6HPOLPepqhj5UvJBgalKEfoTGZENmoIDrH3_VqaZs_5SHupoxb8gXjhXFIt-FBevJ9aZD0y7zolorGtn41jMPjHpBnY-9Hm8AwgV8NgZyY_eOXXzCaT5vouWYXhXioHF0YecU2tg9bl_qYv4ExIZOOFM_5ukcn2U2Sllu10lpwv7AidTCDTvoJ1942pkVBNoHWzpJcihK2xg8_IDcrvc21ZRktaD_10NZAQ3E9iymxWHErTjiq14_TtLOpLJO3qgQdIkCIQK3u6kqXOMPzxruYox-S6vCmzWPg_DH3IejonzFWAG6GW1U-KpvoiQgNOk5NeHMJ0OCao3_7RTsXkPFTEObXR8YWd6IJSZg62yslsEbnLHyZIpb6D3FwA2dIGECsfue_MeyKo0ZSc4xMfyGXTLZtQmhm_BTOiHY8LpnHNYDMjDnnKRpa-tpYIfclojqZk2ollZZnkj36uMadmXmCK-pzwYxrL6AWC2_77vqRdOkl6jga2BJ-Df95Nq-T3qOT8Xw8dcBZpMfjFOCufrUwe3gNJQjq84kKk3e2TZZuLT14C9gbSGdhIibIDvbbzMTxzrGMzJMMyaYXv724OYjhxwfVdCf8bib0jVGf79Xv_R7BKY0e7f1GaqcPHKPJ893Psi2bhI5hENfcqgSYbWU7CnqsYyzDD8J8iwRRXdyuMokyG4LMmxAlhRARkZ4iIF9wQzYESsoHQhb2t8WNYJ9GZ209Gl7WI4Eh5mGMu24OgC7rHSvI0wflCzgEOHz7USii5z6GALK-9Utdqf8D6-BPAHf2_o_IdwPK-_YCqUi028ua64fRHeDOmhWQDIet94LVpkZ7wxvYUYlSUs9hBzYT8KHwD_nMK--EGfa1NrSZIN5IHgPLQxse6t_JT_a_eSOG6YcB7qawXlgGWV9tcIe8XoHjd5gVFqM&cid=CAQSbQBygQiDVkCgtXorjLO6H7HaJStGqWgbZAdRQ6f6zKI4_sGxTbF6164e6DV6h8JHoYXR7djKA3zQIsAml_3IfOa7vvIaUzgNDGvAkRonm2zYqMFNCaQLeF_u0h-ndo4wul6i3g6W4lBAQZxJ2SgYAQ&dc_exteid=31101304836889221089593639038908275&dc_pubid=4

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame FC17 0
0 79ms
79ms Fetch
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CQkPFeWV-ZJbAFdiL7gPFhICwDZHR6OVvrbvYio8RZBABIMCygmtglbKCgpgHoAHTqd35AsgBBqkCdZUs2O34sT6oAwGqBOABT9BpImjm9mtqPjrKQTSQLR-dkV1n0fuNgOFDMywJ22EfE3WknkLYKsy_iPiVD3ueumXqu4RuLL29pUD-kgn6N54wpvqLEo6fOru2aQfarVVZgQpPZcEijlC3_Hxtgsd8xXG5ma785b3vNHOfH1YMhBOlwFxMHB_rjWYe7rAJd0MmHpklpuOr1XK-JINNNs2lbRbjLd5AxhQg0fGB7fmzR2CP0mrBNo8FfY4Sb56FHtN7AgeDLEe_bwL2XmcyTMTZ7OblR5PodaG_LwcTGwyVYMw9Ff-D6QNA05HGWAgaAE3ABIGjvtKjBOAEA4gFuveblUqSBQYIGxACGAGSBQYIHRAEGAGSBQYIHRABGAGSBQYIHhABGAGQBgGgBjeAB5XWooYBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwoQpfMCGMPW6eUB0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOvIIG2FkeC1zdWJzeW4tNzI3NTUyODQ1MzE2MjMwOYAKA8gLAbATgPW-E8gTm-2O4gPQEwDYEw2IFALYFAHQFQGAFwGyFx4KHAgAEhRwdWItNjU5MzUyMzIxMDAxMDE1NBjqwW0&sigh=LfKHImWFXTk&uach_m=[UACH]&cid=CAQSbQBygQiDVkCgtXorjLO6H7HaJStGqWgbZAdRQ6f6zKI4_sGxTbF6164e6DV6h8JHoYXR7djKA3zQIsAml_3IfOa7vvIaUzgNDGvAkRonm2zYqMFNCaQLeF_u0h-ndo4wul6i3g6W4lBAQZxJ2SgYAQ&template_id=509&vt=10
Requested by: Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 7639 106 KB
37 KB 147ms
39ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Origin: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 09:27:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47880
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 06 Jun 2023 09:27:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/elements/html/ Frame 7639 11 KB
4 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BFJ8Q3Li4bDQWdEAGo2xYdfcCekkGY1TDsRTXkR3Jj7Y8WOxEmjUm_wDuKUqhoSb1fG97fKxKzkvzFXo9QGPyAjdhKa-VquYFskxTKzmXIdfKKLAFzqjutBETvzqcOlEhwEIiXLHji_rGArpkd8kK7nTtlV9P1vLEKV1Z_IIBShou3muU&cry=1&dbm_d=AKAmf-Dbf413aQpDyiMXoAJJCYVgAE-PH7GJ6s0MfAmsK0kBZb77UM5eJMgesGc5Njr3X6_Ub1Tm6GocnvlxPGICWprxigkzoLxQusgUTExiFgo1SjF7YEr3_ik1X-Ck2PkTp63CbyK8cHT4SYgdWNEcuvXO1EzTPwpJnPDQQiKDZdR8wirXm_KrxZKRLRXsD4D9vb0QpmGlNGt0CLhoIb8aHoCEAub82sxwkcaROFrBoNqEguCJkNXJ35aq5WevdnJ8reOLVi3aac291LIT18Ju_41VA7C4MHOQMDsNlrdM2FPCZk0LRrsbf8uZhzN06goAG9LEnQVtvx0SskHRRhhF24EMZzcmUWwqYVlR56HC_dBKqCMmWvYRMlQ0GPpScwhX3yq0ogqVyqkX1dvAux0oM6l-VDsAQyim92moA8qQWfSITXpnJ0DHP457Mr9WyCy54hSf6giU_wAmaVRqKT7CLzjUCDrCSe-7ejCvgcqVXYmgLgMQX-Oes7hpvuOqmS_PpN1VUueau2zmsgNf-hIIMk-EwkFmOE6Z5ekISr18dv8-XKT1rr_YA0-1msvRLZIG-Uyr3IB98d1KDogSoXeZ6ZOHGeBSva4HhulMeB8IW4yZzoOrSM4VGESgZnPWJcpT_GPcYwHWO69Jnfe7FTTrIr-MmI_VF-gKNsHSB3N6jbd9M6RsFnqv92rcImFJLuD8OVIIvJH19JB-syIBmFuxWiCExiYgojMF3DkwMEOPSbgnlis7wDvfgrAeb_EecpYeDPLS1iPTtcwHBRURK1IAqaXlxjSmjCdbL5bVd05Sei_niK-LJGozslNJRca3fI0Ebghrz3zwYSloBrkFpZxfz6WaCApzKcuKfvB1eFSph2v4PW74STyk_D_B9mIpxIRk6eABmN66E8L6sLKBx3NtPZwzS5sS3HBT3pvy4AAImTTyV9ZbgWpQOjYodEe3ZvTG83MQLP1wXyUJJwKiDEiTF9F_IkcbVuDNxlfTV6SzeIQWJM78mYm0hmP86y0or1TBcoB6XbRNzRSUL2FNfCS-Ek78fZ7ONCm5Nly7GfBgwnauV3DnVuwDv5FPtVUZCm-xzjnfJnoptYfkpk3rHUzVKgEZ3uENyvpoIo4og3RY_kpDZaQiCECUGXVIAeIv4WsFQ_A_dxS7nHJG_KrLDc_WdJpAYw6nVVGfx213IA_DOpvdLRv5edn68i6zhOxICi14rVjHQ7It3QyMNGYTxotyrfAQeQ_kHoM-TvW_aV4atTJ2XntZTJD7EqTgCj93Qt4-s5OUyQYci-dZ0cgLMycU7oLjieWyXDbynEeruj02Dr-uhhPvTCBy28K17ajJuyC00wv8fFSd-xV4rQT-KA75GeqjcYe5CRCYlqHlvDTzUCkoYRzigNwQw-RG3E2jbP5Hnzgxrp5Bz1i7OK9JoMAATqGcRMHKNk8kp4waiHuBZ4BssDqn8Gc2X1jrm9WWHD-MPO_Vjwq5tqtdRHq3oNJhHnqYZIln_-AusBNJXiD1lSd0NwUTuZ8BZ9jfKciBt5MaKU0ouX6-X8ANIRuWFpKGfgbK5yb2GKv5AFT8s93jBpft_3ENgsHSnN4LAVWlnnzg9TRzPIjbwvtsCoj0LNNZjjxbcBdLJb5r0omiVfkYwjuSDRtV0CzO1RqrVh1mytoI00r9mtVlYCty6S7iQF77odXlyGJR9GNZKGv2nI3d3jA07HOHUnbYOWE-Znu4F4UvOLehaNgUC0_onBQR0dJBnZlXsfJ8FUMiO1fc66xDtTZ8h55eSlGMblvAK7Zv-6E3Y6XS8IQ677vYzORCdwkFquhXXrMMLYI8bzkPBeqirP3OShfgKy_yFgfa7l7MC_YFiuVGD51OOIQitMCPfViA5IL0jL35SE2l7ILNWSi4JpZD7nV6jv9Rw_JQLsFA6XRmm6wEr3G1Hozp5EK-nVTF7jqsE2PqtGgk74Q3RQF1mss5MRghxBAu_cYNT-vL2hfAqw_aRox7D7UFos38MTcfrDh71FzYCKKTu1WqwB98Mt9CkFrO5rfRalrWR6m0HFdj8AOb_fZc56DjppMyM4IJqyZnua2lKe9Iv_uAXxPaURvfl9wwWlxJWyX5_FAutbd6AkPhsN6o52zOYaZPRqeumyt01-TS6YRSqe7dsK44hByALkjvrfVODib1TVA_qWLdDm5cLBYo8NFXrw8PSr5L89WGJT9c-shaTyvxG3eB0TrtYPoORlLGNS35SlHwaHJ81M38yDDVUJy1QGeL_Pkjt3zgFcMTDUVNEcz9lHwebfQi87opx-sLVz9C6EsZ4Ja05I3wdV0ZWoJ_o5dnzvbp3PzycwO-vHP06Ort_GN4qIYiFHoAkLQtoGO4bYqX2QSbag9Zea6ABGQQzE9CPAn0AKm4qyRz8M9Rk9HPZvHjmeSuWWeBFgbudIYxjjyExuxYCuo1wsWD9XYYW2dHqlWQ8qK17l6JbUPgybPoVd1lMFciu2XNVKRJsChWwD-2cyTAnhY-I3U49DeOltMSSvbps2SYIpLP-u8HllxV6bfe_KIQbRUOi5RqVFsvT-4RY46KcZlCZ_3yf2PTaigMpgutVmxWhBHOXRw_L3ShCP3-Y7LPWV3b8o7E4qIidGlXdyeJnH6WigzSXgiE6Q_tOZkVfYrduWjWAwtHv7gd1aLfzeQ3--QYuTk8DaR8b_dcW51G1ZxPSF4lNV97Ee41IUgHhUmXanYGVn7rQcBo58-PlIxTDzJBJaWm4vv30fZjQYjUUombTRug66X7zRAYyZQGQoy9LA2sM6ae7DGKkJauEQK1KEH4l5Kz5nYFpVJD_Ysw53KtMFgAWrvX6Tt-O9GufH1S4t0gXK5-98wCQoFbzNNhHYi8AuHEealW2zvmkJ5hZu2g7BJJa4z-a1GAml5eL8IbccjH5qluuy3LY-MwogAUZNmg7XsNaUtXxCHgIYmBaBtZtcIE9sftpIJ5KmtkABvIJbzj8Pm0OeX9Lg00s3v7VVZj-wX5BpVlAfhrb1-HOoN0nZwu2lNf0w_tpNLppbbOBZ0WP5lnlIoyFo0arQI7_NpCwWGJFXJhdqyTgDQA9qX-uWN3z2UlS1PLhSsw7iSeyjOO3P92i0NyI5YhTlzQ3_rfIq4Rq6kh_kZKWFx47VJO6-b_cRp0DRrOPuwptAij7GDvKZtxaEtPJYA6nMZtjj0H3yBsJDZmKFl3zJ33Zk5qFCxuOGk-UQjXE1ajP44LWVTOBpBziZeY4uWmyOUTxnzNVP9LXaVnoWpki1pTM5guJwutKVea4ANcaTJ4lGvLzsui_2EYq5w4EOMvRBBH_EMGIAQxtbEn3Dybb_agnNuAXdr6ioBc3_6oQAgBIVhdcc54krMPFv75Zv9NMC78cvyYhpX9nZ7AOiklENA5VZL74wxE3CsNP_uZLu1fCTS1z--FrLikDEqpKUx70qqZvXl9DCrRR29XIOPwjyHJ6jBiPI8mZp_7ua45QStrEDDpCgqKzRZm7-lmu7nszYHXA49HBa8ym7ZOScb6I6zI7rFBN-ewN8Obkx96fGbYDYDzgLx8Ag&cid=CAQSLQBygQiD446lnKciLK2K-54Wo_-4dak0EY4_gjEjCcGYzXp4BqUzY9k-YjaR2BgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=15163451967167880000&adk=3468572599&idt=77&cac=0&dtd=15

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 14:15:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30602
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 14:15:11 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/ Frame 7639 29 KB
11 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 21:03:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6094
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 21:03:39 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7639 41 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 572740
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
DATA 200
OK truncated
/ Frame 7639 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 22093a63daa1c49686080a3ea428d7d884de4f641006356daa3ed646915b1a5e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3659 22 KB
8 KB 39ms
39ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 237150
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Jun 2023 04:52:43 GMT
expires: Sun, 02 Jun 2024 04:52:43 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 2F71 6 KB
3 KB 40ms
39ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:13 GMT
expires: Tue, 04 Jun 2024 22:45:13 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js Show response
pagead2.googlesyndication.com/bg/ Frame 3659 37 KB
14 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8afd59a03bcb312667b449341fdd15f86861886ef702e46479e76805353e1d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:24:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19247
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14644
x-xss-protection: 0
last-modified: Tue, 30 May 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Jun 2024 17:24:26 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/ Frame 2F71 263 KB
68 KB 169ms
60ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/amp4ads-v0.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f3e96370f4c959989bd6ab43ed9cad59a2c610fa3e7488163204c2528968f40c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Mon, 05 Jun 2023 22:45:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 69595
x-xss-protection: 0
server: sffe
etag: "0f7f110c1fb9886b"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3000, stale-while-revalidate=1206600
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/v0/ Frame 2F71 19 KB
7 KB 253ms
145ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-ad-exit-0.1.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a905d69768d862fcf8393d81de46c5c9cef384d5f0592f0edfae4b2a88c660a4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Mon, 05 Jun 2023 22:45:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6670
x-xss-protection: 0
server: sffe
etag: "26cea86d2f7d1c58"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/v0/ Frame 2F71 110 KB
31 KB 210ms
103ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-analytics-0.1.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea99c81ac4e531caad94c2b22b52acb0475086a1e120717d285b4715c87f50fd

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Mon, 05 Jun 2023 22:45:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32003
x-xss-protection: 0
server: sffe
etag: "754617fed9bc38c4"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/v0/ Frame 2F71 49 KB
16 KB 156ms
48ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-form-0.1.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d4e8a0b1e55000722a59574ce29d16cca38f9536f04117bb9937d5af06694ff

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Mon, 05 Jun 2023 22:45:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14971
x-xss-protection: 0
server: sffe
etag: "fff868f9a7435a95"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/v0/ Frame 2F71 7 KB
3 KB 251ms
144ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-fit-text-0.1.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f3fa7384634fcfb0c86ff084dfb0cd8b923721abe3113c314ba96b92769fc430

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Mon, 05 Jun 2023 22:45:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2514
x-xss-protection: 0
server: sffe
etag: "e9e6236381abaeb1"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/1011305908793822038/ Frame 2F71 13 KB
13 KB 42ms
42ms Image
image/jpeg 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1011305908793822038/14763004658117789537?w=400&h=209

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc354b8fd7b240b8d24208d5a6fd86262dd1e535e357dcb61c5b9c0c7ac61e2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 22:02:14 GMT
x-content-type-options: nosniff
age: 175379
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13707
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 16:23:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 02 Jun 2024 22:02:14 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/3620998546243588515/ Frame 2F71 1 KB
1 KB 45ms
45ms Image
image/jpeg 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3620998546243588515/14763004658117789537?w=100&h=100

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f3643ab12bcd31c3577c1abc26ae30e30cdb86d14b784018f48f797928f356c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 21:41:33 GMT
x-content-type-options: nosniff
age: 176620
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1293
x-xss-protection: 0
last-modified: Fri, 24 Jun 2022 16:28:50 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 02 Jun 2024 21:41:33 GMT

GET
DATA 200
OK truncated
/ Frame 2F71 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ba08d1ef524c7518d6613528cc07cf2ea76d9ce9c55e8e44f6ff8f98df1a580

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 2F71 15 KB
16 KB 127ms
39ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Origin: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Fri, 02 Jun 2023 23:14:12 GMT
x-content-type-options: nosniff
age: 257462
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 01 Jun 2024 23:14:12 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 2F71 15 KB
16 KB 137ms
49ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Origin: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:10:14 GMT
x-content-type-options: nosniff
age: 542100
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 16:10:14 GMT

GET
H2 200 aulus-728x90-DE.html Show response
s0.2mdn.net/sadbundle/11207411921136063200/ Frame DB8D 6 KB
2 KB 76ms
75ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11207411921136063200/aulus-728x90-DE.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf5a32878407b7e1f4fae574fdd255f300dd3002c7cc3561b4d5b03df1edb5b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 252223
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2378
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Jun 2023 00:41:31 GMT
expires: Sun, 02 Jun 2024 00:41:31 GMT
last-modified: Tue, 11 Apr 2023 12:03:09 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7639 0
0 189ms
87ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvjaVWsdFiH6ir8nJNau6VC2Iu7y6nVeUZQ6Vcs6QSYYSRf9u1nKREmJsOtNt8XWiwaVP80wsR-2J_iALEGBrZgdridVO5q5vjdPiP_Dnj_9tRp470B6RL01tpOyqkW0xC25G_yTLKjFLDXOFApkovE__TMUnRg5QP49yK5ZkeHDSduv2YtHDz5PvTIYyX2sao4oFHqgqjCaMqAe7CqpjQHbUCBces0bS7zu4R5_uST3qIFS43I4nqkwrYyh3jNrA5zw_rQqa0W10R5wjuZw_u47nr9ek5U-oOD3iFXIVGL6QeS6-obJuL2HSOO6bEi9wx8RyRuEc1GiZEzfPRwJ_NlHsub0Q_meHSRdJRxuLR-6M1RtycXRcIJcrSp0nl323HNPl1ZkiBirLJWgE1xBpqVExSI4QE-gERUsGA5ocbQwFG1HBYmk3mtrZC_S5bkq1jq3PUP6ZytdaKtgya4z1mZ3HbL4Q1ozUDpP0uU2Ohl4r0IUOEXcNNkzN9Lskt2fscIB15912LTWZNSQWQt2BZXNCBxtDXlbwefR6l6iY1WCvnabo-9X0ukM0VQToB4uwjaUv-ihtiCdLRBaZ4QuJQRDvHdmqjycLyqcDw72jAakamnUBwKjsAr76kLDKwFFp26ClmQ7VbCytzvjPJlkB4dxQxh6z3R0gAKvIrFwD28UDOB45_wXvi3w1FAUULh09VSnfi_mRMnk4qvpdicP_gbVeqeow9h7PArxtLRbJj403Bz2dWrAsr9Bi2T8EfJ_oSzcZLvRSiabbaAv1-dUFAwzsGhNg9CbApCkCLa2WGMGlX1iT4p-OZ_5jYSrAo16AbAUMtEGWGxTFvo4F6_j02gWFU5R9LmTPRQTnJ2aTM9uXluUz18eKk7y3xp-yBBzWjKpAolU6y4F3yY9hN8MX3zshPtyXb9TuOI7eUuSPSaMl5vhO97BvvbuE_putX8CYOt8aC3E_dGsaE4LR-aJTncCuBA0ddKAPFqqr34L9SbWT9dXE-Ft6vEXPmXd9KKRjuXGHnyzFaAnOqdjC-TqEunDyWhB5YX38kh5M4siJXKTFXzb2DWP6R87gBphk1yM2Cs93_iA0i2dKg1Q0-jQFMc6kuWtEoEo9gpWQM2kvbTYgfLYhOINBWiju9C2ai3BeRcwTGaqlvsyI4XUWaRJEpSFGe7D37gx-YSgNOh0VEaUWTp2B-DycveDzXC_i6tt14x5rP_UpHSVrk&sai=AMfl-YRHtxB426-88R0CrKCkQ7GacUo8cy8OVyyuaSiZ9N7H2J_qy4yBWCE3uhSzviCBOGzBbXbNRwb7U-LuZHGrBG6dD6PacJV7rjOoEfS5Qq9poCtZGaCrNr6mr96uVDyUqPJbU0aYm-l4JIzOcPzfjntKC_6zCxk5TBPT-WPzgNys-8jGFMv_nxTaHbAaW_1umCoXGR24dD4Q3ZiUe4cjiWMBzFfs0PohZW1VnTR33ig&sig=Cg0ArKJSzADVDC0GgTajEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=217&cbvp=1&cstd=214&cisv=r20230531.98649&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9DAE 143 B
166 B 40ms
39ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3201
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 21:51:53 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 6363a944e4b0125bde9e6739
ng.virgul.com/tck/imp/ Frame AE4D 0
209 B 82ms
81ms Image
text/plain 185.7.176.221
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng.virgul.com/tck/imp/6363a944e4b0125bde9e6739?g=1&t=cpc_annotation&r=153366@site_geneli@yemek_net:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1%2Cgprec%3Dyemek%26rec_ing%3D&info=&mt=1686005112834&userId=vnet03f0366d-a599-434b-a4a4-0599471fc76b
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Mon, 05 Jun 2023 22:45:14 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
DATA 200
OK truncated
/ Frame FC17 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 064cbd45053a083b14a64adcdbb8d798f1cb2c91e915783b105ec0e9302cd24c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 container.html Show response
4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 670F 6 KB
3 KB 40ms
39ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:13 GMT
expires: Tue, 04 Jun 2024 22:45:13 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 1D20 6 KB
3 KB 42ms
41ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:13 GMT
expires: Tue, 04 Jun 2024 22:45:13 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 083D 6 KB
3 KB 41ms
40ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:13 GMT
expires: Tue, 04 Jun 2024 22:45:13 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 097C 6 KB
3 KB 49ms
46ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:13 GMT
expires: Tue, 04 Jun 2024 22:45:13 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7E03 6 KB
3 KB 40ms
39ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:13 GMT
expires: Tue, 04 Jun 2024 22:45:13 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6B89 6 KB
3 KB 40ms
39ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:13 GMT
expires: Tue, 04 Jun 2024 22:45:13 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame DB8D 236 KB
63 KB 48ms
47ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11207411921136063200/aulus-728x90-DE.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11207411921136063200/aulus-728x90-DE.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 aulus-728x90-DE.js Show response
s0.2mdn.net/sadbundle/11207411921136063200/ Frame DB8D 142 KB
14 KB 40ms
40ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11207411921136063200/aulus-728x90-DE.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11207411921136063200/aulus-728x90-DE.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8126a786b178c58984fe63249ce3fabaa0236797990fe6f75082bc49c9dcb0d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11207411921136063200/aulus-728x90-DE.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:00:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 434669
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14409
x-xss-protection: 0
last-modified: Tue, 11 Apr 2023 12:03:09 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 May 2024 22:00:45 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A5C3 624 B
245 B 57ms
53ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ3cu5ARjS75DkATAB&v=APEucNXEc29KETAl699gUa1E647q6S9ORSkj5yDzdCtHUKfqRnxyy79oyW9EuSPc9aMKtyBTUWvVlXRn0Mw4gdSIkvA1JQf5_Zp_W4JWo6XIyXoAIYGxyGN1LZLhRCggwHZ2pzAy-JMX9BmhL4REYk1c89ncDkQOlHr-7XJtMWkbD_qBkcrBddY

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:14 GMT
expires: Mon, 05 Jun 2023 22:45:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 670F 78 KB
27 KB 128ms
124ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 670F 42 B
63 B 77ms
73ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CzOOKYMTk4UggMDVDulvmgue9vWzkJNfX7u8Fwpe7mjLl1DMAaq9ehd0QhTSqezgfp-0bdAZsS5r7alvcU_rQqp0EvBrJ3ECikC1XpNrKLfjZTmVk

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 670F 0
20 B 77ms
73ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=7516560276911853638&x=1&ct=76

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame 670F 3 KB
1 KB 46ms
42ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:16:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19733
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 17:16:21 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame 670F 19 KB
8 KB 46ms
42ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 12:05:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38382
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 12:05:32 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 670F 171 KB
53 KB 151ms
146ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame ECA4 640 B
265 B 63ms
60ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjW2LLlATAB&v=APEucNXni9LqLZKiMrEG_w-P2kgYZByfueczdqHlojHeQ623cpKhQscyVZv1Sg4_eQ5Y-4Noz-k1gxVIuJfWLF66V_LXr39Y-snQyAkb8pqC3LGY9R4iiPY7Q4oV6WmvS9aVCW3AgSQuqFSUMevnz8EhUVdI6pEpYrls7llsMPaegyfvwE5r8EU

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:14 GMT
expires: Mon, 05 Jun 2023 22:45:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 1D20 78 KB
27 KB 229ms
225ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1D20 42 B
63 B 76ms
73ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C_mMSDfX1Z-t47Uxacn4bUJw0Dt82jgdYlBtuMu-3w64JtGi9vtthjA2jmnDQXZTmDErpokFEyJ0pB56ls-TyXLcer6k8AyQh3Q7SLH-tjOKzgpLY

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1D20 0
20 B 77ms
74ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=16898412597196447469&x=1&ct=76

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame 1D20 3 KB
1 KB 50ms
47ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:16:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19733
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 17:16:21 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame 1D20 19 KB
8 KB 45ms
42ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 12:05:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38382
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 12:05:32 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 1D20 0
0 140ms
48ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTS1N1eoW7zHbsVW_sUi-AWB0NHQaWeeOzLgW8Xe9clWsZcl84M36zvkiroeueD78GHirvWqkwQWGAk__CWd-8DXqWP2w
Requested by: Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1D20 171 KB
53 KB 257ms
255ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 7BB2 640 B
265 B 58ms
57ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjW2LLlATAB&v=APEucNVDOVDpMeFJLi9XSMyU8ZZJLuknlmFBUBAKcAKHtRgLS-iQ04F3IU7BtTcA9oKXhJNGjILbgnh6ND6GFzXcdOvUs54PqNgFv_c9JuINV7Z8ry0WFuhUyE4cH0tp2tNvzMUEVFClrTJLATe1EmuMVbpb7mGNgbe2-bWp6EHBRzzQ6CA3W40

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:14 GMT
expires: Mon, 05 Jun 2023 22:45:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 083D 78 KB
27 KB 203ms
203ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 083D 42 B
63 B 74ms
73ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ABEL6usiQxQeQwqiEflgaXROc4c23UTMtfE7LaOg6S-wOfZK6WClAMBKuGupIjW4l1C9YBchkpy7lzWAnUau1uW8zYfPKu1hynvy9f0WzE4O8w1-g

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 083D 0
20 B 75ms
73ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=18372249592536395084&x=1&ct=76

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame 083D 3 KB
1 KB 56ms
55ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:16:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19733
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 17:16:21 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame 083D 19 KB
8 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 12:05:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38382
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 12:05:32 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 083D 171 KB
53 KB 279ms
278ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 55C3 466 B
238 B 69ms
68ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYhLim1AEwAQ&v=APEucNU90GbhFUmQ4PiwUooplHPlovhAPxptGuXpmK4C7PVCboQN5l0G5CPhHVa3lxvaFR3YjRrUHCo6OkapuyqSEl18m1T9ZTpk8kukuptxarDKR_a8DspS5GSnrnjdE3DlHwJofxjBsnnvRjPDx19h03QMZBeJwOeo-oE5VSKm0vOjtof8fjs

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:14 GMT
expires: Mon, 05 Jun 2023 22:45:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 097C 78 KB
27 KB 212ms
212ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 097C 42 B
63 B 74ms
73ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B5d7zLhDHqF2avtaGrUFyC3Ft0tvnbfbCcBQ-Mz2dBTMfbTvCTDSJPfh734VmLcs-N-4o8gs2ADtfRSMu4YApYDj2bR9SYqVlHjFMZEng3HBa0RMo

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 097C 0
20 B 74ms
73ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=17832661756419646172&x=1&ct=76

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame 097C 3 KB
1 KB 53ms
52ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:16:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19733
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 17:16:21 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame 097C 19 KB
8 KB 45ms
44ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 12:05:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38382
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 12:05:32 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 097C 171 KB
53 KB 279ms
278ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 7CA1 398 B
225 B 65ms
64ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CM_cnJQCEOXw25gCGKKohd4BMAE&v=APEucNURkpesPAkw1ldzRmzmvIWV-grbLvf_kM6JLkpEAKY23kBwQS7W8xijlX8lWGDxgbF8N-7DI3a4AWgPxZUyYAL3qjX1J8psE8lqio1E-7kuKQ49AtgtMqrJ5a2Zvg7Z1Yy23TH7V0swe6tbMOw2bbp20LA31IWjhseTX3Kk-bg8FXYIygw

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc00d2dc19a9dd32d5f89ec3d68bfed90dd775a5fa638855b7fe00d6415f379b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 202
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:14 GMT
expires: Mon, 05 Jun 2023 22:45:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 7E03 78 KB
27 KB 193ms
193ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7E03 42 B
63 B 75ms
74ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DxcGe3TJwO7DhXKgpKwEA2OXHVY5sqDsVOzTOVD0n5Hs4NltWa1pLNyR0u4LR9Qjbf406xetO_IJHaV7oQyqbWRQ2w82xR9AialflEXzJhwjyCBdA

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7E03 0
20 B 76ms
74ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=10103871710852600892&x=1&ct=119

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 7E03 43 B
1 KB 200ms
50ms Image
image/gif 85.14.248.72
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?tc=803c301327db111e6f978efbae7eed5e&rnd=1686005113820993

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

85.14.248.72 Mülheim, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Date: Mon, 05 Jun 2023 22:45:14 GMT
X-Content-Type-Options: nosniff
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Mo, 05 Jun 2023 10:45:14 GMT
X-ET-Code: 0
Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 713
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame 7E03 3 KB
1 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:16:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19733
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 17:16:21 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame 7E03 19 KB
8 KB 41ms
39ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 12:05:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38382
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 12:05:32 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 7E03 0
0 113ms
47ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSWNjYPzAA70sb-rvX-KrbmYssZ0rYndF-ew5xL5m4buYkBYa6SkN9cqFfOBfO3uFwNfKfk8pg9l5CH4u6nRy3e54n3TQ
Requested by: Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7E03 171 KB
53 KB 239ms
238ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2C35 0
16 B 54ms
52ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CM_cnJQCEOXw25gCGKKohd4BMAE&v=APEucNUYV7SPvboYXoFNbRFSLwIttZm9-gE2NqV2PN9Q8IDvYmKCy7f4v3EdYrHN-vdJv5gffAM2azPIid_Mpz3KNqGMlECHHR_nw59umtR2IP4hYCWgkUt5wHPgEhiH-d9MOU75bq2167RM2B3S8ZE5afyAjkReabscSZTsiTkr4xFK6Ra3K1E

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 6B89 78 KB
27 KB 157ms
156ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6B89 42 B
63 B 75ms
73ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C5HyP4jnNDhmIYRIK8kO_L9dUXQEC0CbcsMVaxWuRFdkN5_2QydkSrUJboF7EeDYNxiYq1iAii40kc3oexTvrt_oUkdkpcOAPSTgP8cc7RmSuJq1E

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6B89 0
20 B 75ms
74ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=4995774255353772949&x=1&ct=119

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 6B89 43 B
1 KB 181ms
49ms Image
image/gif 85.14.248.72
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?tc=803c301327db111e6f978efbae7eed5e&rnd=1686005113830321

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

85.14.248.72 Mülheim, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Date: Mon, 05 Jun 2023 22:45:14 GMT
X-Content-Type-Options: nosniff
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Mo, 05 Jun 2023 10:45:14 GMT
X-ET-Code: 0
Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 713
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame 6B89 3 KB
1 KB 41ms
39ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:16:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19733
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 17:16:21 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/ Frame 6B89 19 KB
8 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230531/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 12:05:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38382
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 12:05:32 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 6B89 0
0 81ms
49ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRtRy7k_StwIxMIAxgXsKp4IYVLwaHTq98GPF3itZz8qFlM1DVIdYISuapm2rtNNRmwH4wK7lIW3EFOTtvPPs4ABV0cqw
Requested by: Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6B89 171 KB
53 KB 246ms
245ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9DAE
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

53ms
53ms

Document
text/html

2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:14 GMT
expires: Mon, 05 Jun 2023 22:45:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:14 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A5C3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAsxLUMX2Ma5nmJgPpcDtrE&google_cver=1

43 B
632 B

41ms
41ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAsxLUMX2Ma5nmJgPpcDtrE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ3cu5ARjS75DkATAB&v=APEucNXEc29KETAl699gUa1E647q6S9ORSkj5yDzdCtHUKfqRnxyy79oyW9EuSPc9aMKtyBTUWvVlXRn0Mw4gdSIkvA1JQf5_Zp_W4JWo6XIyXoAIYGxyGN1LZLhRCggwHZ2pzAy-JMX9BmhL4REYk1c89ncDkQOlHr-7XJtMWkbD_qBkcrBddY
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jun 2023 22:45:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAsxLUMX2Ma5nmJgPpcDtrE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A5C3
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZH5leVujdSf3OuTHNqAA2AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAsxLUMX2Ma5nmJgPpcDtrE&google_cver=1

43 B
766 B

41ms
41ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAsxLUMX2Ma5nmJgPpcDtrE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ3cu5ARjS75DkATAB&v=APEucNXEc29KETAl699gUa1E647q6S9ORSkj5yDzdCtHUKfqRnxyy79oyW9EuSPc9aMKtyBTUWvVlXRn0Mw4gdSIkvA1JQf5_Zp_W4JWo6XIyXoAIYGxyGN1LZLhRCggwHZ2pzAy-JMX9BmhL4REYk1c89ncDkQOlHr-7XJtMWkbD_qBkcrBddY
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jun 2023 22:45:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAsxLUMX2Ma5nmJgPpcDtrE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame A5C3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEM_zW-k3FoJaIOHmVv1hMuM&google_cver=1

43 B
1 KB

40ms
40ms

Image
image/gif

37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEM_zW-k3FoJaIOHmVv1hMuM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ3cu5ARjS75DkATAB&v=APEucNXEc29KETAl699gUa1E647q6S9ORSkj5yDzdCtHUKfqRnxyy79oyW9EuSPc9aMKtyBTUWvVlXRn0Mw4gdSIkvA1JQf5_Zp_W4JWo6XIyXoAIYGxyGN1LZLhRCggwHZ2pzAy-JMX9BmhL4REYk1c89ncDkQOlHr-7XJtMWkbD_qBkcrBddY

Protocol

HTTP/1.1

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.2 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Jun 2023 22:45:14 GMT
AN-X-Request-Uuid: aa54ffe0-579b-43eb-95bf-ca3763e1504d
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 80.255.7.100; 80.255.7.100; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEM_zW-k3FoJaIOHmVv1hMuM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A5C3
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTk0MTA0NzQzODA0Mjc5Nzk5MQ%3D%3D

170 B
188 B

50ms
50ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTk0MTA0NzQzODA0Mjc5Nzk5MQ%3D%3D

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 05 Jun 2023 22:45:14 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 80.255.7.100; 80.255.7.100; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: d9f9e59f-7f3d-4e3a-a068-0a7b4cf9ade6
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTk0MTA0NzQzODA0Mjc5Nzk5MQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame ECA4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMPo8qxj6A0jKxLlWkGwEXY&google_cver=1

43 B
114 B

59ms
49ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMPo8qxj6A0jKxLlWkGwEXY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjW2LLlATAB&v=APEucNXni9LqLZKiMrEG_w-P2kgYZByfueczdqHlojHeQ623cpKhQscyVZv1Sg4_eQ5Y-4Noz-k1gxVIuJfWLF66V_LXr39Y-snQyAkb8pqC3LGY9R4iiPY7Q4oV6WmvS9aVCW3AgSQuqFSUMevnz8EhUVdI6pEpYrls7llsMPaegyfvwE5r8EU
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMPo8qxj6A0jKxLlWkGwEXY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame ECA4 43 B
304 B 137ms
48ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjW2LLlATAB&v=APEucNXni9LqLZKiMrEG_w-P2kgYZByfueczdqHlojHeQ623cpKhQscyVZv1Sg4_eQ5Y-4Noz-k1gxVIuJfWLF66V_LXr39Y-snQyAkb8pqC3LGY9R4iiPY7Q4oV6WmvS9aVCW3AgSQuqFSUMevnz8EhUVdI6pEpYrls7llsMPaegyfvwE5r8EU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame ECA4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESELh2D3TZBHYM44OZJpeGs3k&google_cver=1

23 B
163 B

143ms
65ms

Image
image/gif

104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESELh2D3TZBHYM44OZJpeGs3k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjW2LLlATAB&v=APEucNXni9LqLZKiMrEG_w-P2kgYZByfueczdqHlojHeQ623cpKhQscyVZv1Sg4_eQ5Y-4Noz-k1gxVIuJfWLF66V_LXr39Y-snQyAkb8pqC3LGY9R4iiPY7Q4oV6WmvS9aVCW3AgSQuqFSUMevnz8EhUVdI6pEpYrls7llsMPaegyfvwE5r8EU
Protocol: H2
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires: Mon, 05 Jun 2023 22:45:14 GMT
pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESELh2D3TZBHYM44OZJpeGs3k&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame ECA4 23 B
163 B 202ms
66ms Image
image/gif 104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjW2LLlATAB&v=APEucNXni9LqLZKiMrEG_w-P2kgYZByfueczdqHlojHeQ623cpKhQscyVZv1Sg4_eQ5Y-4Noz-k1gxVIuJfWLF66V_LXr39Y-snQyAkb8pqC3LGY9R4iiPY7Q4oV6WmvS9aVCW3AgSQuqFSUMevnz8EhUVdI6pEpYrls7llsMPaegyfvwE5r8EU
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires: Mon, 05 Jun 2023 22:45:14 GMT
pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 7BB2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMPo8qxj6A0jKxLlWkGwEXY&google_cver=1

43 B
106 B

60ms
50ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMPo8qxj6A0jKxLlWkGwEXY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjW2LLlATAB&v=APEucNVDOVDpMeFJLi9XSMyU8ZZJLuknlmFBUBAKcAKHtRgLS-iQ04F3IU7BtTcA9oKXhJNGjILbgnh6ND6GFzXcdOvUs54PqNgFv_c9JuINV7Z8ry0WFuhUyE4cH0tp2tNvzMUEVFClrTJLATe1EmuMVbpb7mGNgbe2-bWp6EHBRzzQ6CA3W40
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMPo8qxj6A0jKxLlWkGwEXY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 7BB2 43 B
120 B 137ms
50ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjW2LLlATAB&v=APEucNVDOVDpMeFJLi9XSMyU8ZZJLuknlmFBUBAKcAKHtRgLS-iQ04F3IU7BtTcA9oKXhJNGjILbgnh6ND6GFzXcdOvUs54PqNgFv_c9JuINV7Z8ry0WFuhUyE4cH0tp2tNvzMUEVFClrTJLATe1EmuMVbpb7mGNgbe2-bWp6EHBRzzQ6CA3W40
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 7BB2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESELh2D3TZBHYM44OZJpeGs3k&google_cver=1

23 B
163 B

143ms
65ms

Image
image/gif

104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESELh2D3TZBHYM44OZJpeGs3k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjW2LLlATAB&v=APEucNVDOVDpMeFJLi9XSMyU8ZZJLuknlmFBUBAKcAKHtRgLS-iQ04F3IU7BtTcA9oKXhJNGjILbgnh6ND6GFzXcdOvUs54PqNgFv_c9JuINV7Z8ry0WFuhUyE4cH0tp2tNvzMUEVFClrTJLATe1EmuMVbpb7mGNgbe2-bWp6EHBRzzQ6CA3W40
Protocol: H2
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires: Mon, 05 Jun 2023 22:45:14 GMT
pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESELh2D3TZBHYM44OZJpeGs3k&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 7BB2 23 B
163 B 201ms
65ms Image
image/gif 104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjW2LLlATAB&v=APEucNVDOVDpMeFJLi9XSMyU8ZZJLuknlmFBUBAKcAKHtRgLS-iQ04F3IU7BtTcA9oKXhJNGjILbgnh6ND6GFzXcdOvUs54PqNgFv_c9JuINV7Z8ry0WFuhUyE4cH0tp2tNvzMUEVFClrTJLATe1EmuMVbpb7mGNgbe2-bWp6EHBRzzQ6CA3W40
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires: Mon, 05 Jun 2023 22:45:14 GMT
pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 55C3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEIct1av6mKu7LhUx886GE0w&google_cver=1
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEIct1av6mKu7LhUx886GE0w&google_cver=1&__user_check__=1&sync_id=a2f0a7b7-03f2-11ee-a369-186cd56e0106

43 B
548 B

46ms
46ms

Image
image/gif

185.94.180.126
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEIct1av6mKu7LhUx886GE0w&google_cver=1&__user_check__=1&sync_id=a2f0a7b7-03f2-11ee-a369-186cd56e0106
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYhLim1AEwAQ&v=APEucNU90GbhFUmQ4PiwUooplHPlovhAPxptGuXpmK4C7PVCboQN5l0G5CPhHVa3lxvaFR3YjRrUHCo6OkapuyqSEl18m1T9ZTpk8kukuptxarDKR_a8DspS5GSnrnjdE3DlHwJofxjBsnnvRjPDx19h03QMZBeJwOeo-oE5VSKm0vOjtof8fjs
Protocol: HTTP/1.1
Server: 185.94.180.126 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Mon, 05 Jun 2023 22:45:14 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 51
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Mon, 05 Jun 2023 22:45:14 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: /partner?adv_id=7025&uid=CAESEIct1av6mKu7LhUx886GE0w&google_cver=1&__user_check__=1&sync_id=a2f0a7b7-03f2-11ee-a369-186cd56e0106
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 54
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 55C3
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=YTJlYzM3NzgtMDNmMi0xMWVlLWFjYjMtMTdkOTI1OTkwMjA2

170 B
188 B

49ms
48ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=YTJlYzM3NzgtMDNmMi0xMWVlLWFjYjMtMTdkOTI1OTkwMjA2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYhLim1AEwAQ&v=APEucNU90GbhFUmQ4PiwUooplHPlovhAPxptGuXpmK4C7PVCboQN5l0G5CPhHVa3lxvaFR3YjRrUHCo6OkapuyqSEl18m1T9ZTpk8kukuptxarDKR_a8DspS5GSnrnjdE3DlHwJofxjBsnnvRjPDx19h03QMZBeJwOeo-oE5VSKm0vOjtof8fjs

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 05 Jun 2023 22:45:14 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=YTJlYzM3NzgtMDNmMi0xMWVlLWFjYjMtMTdkOTI1OTkwMjA2
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 110
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 55C3
Redirect Chain

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true
https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true&verify=true
https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1fNHRMbUpKRTJ1R3BZb2tLaG81eG5IM0hFSjNGMjdPLn5B

170 B
188 B

50ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1fNHRMbUpKRTJ1R3BZb2tLaG81eG5IM0hFSjNGMjdPLn5B

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1fNHRMbUpKRTJ1R3BZb2tLaG81eG5IM0hFSjNGMjdPLn5B
date: Mon, 05 Jun 2023 22:45:14 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 200 tr.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 2F71 3 KB
3 KB 40ms
40ms Image
image/png 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/tr.png

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1e5a886321d0e00c13f7abff03ca39fd782f42997fd34bcbf4fc93718f3670cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 19:49:55 GMT
x-content-type-options: nosniff
server: cafe
age: 10519
etag: 9957912877679239782
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3057
x-xss-protection: 0
expires: Tue, 06 Jun 2023 19:49:55 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 2F71 344 B
368 B 39ms
39ms Image
image/png 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 19:03:49 GMT
x-content-type-options: nosniff
server: cafe
age: 13285
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 344
x-xss-protection: 0
expires: Tue, 06 Jun 2023 19:03:49 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 2F71 0
0 85ms
85ms Image
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C6VKWeWV-ZO3kIrHb-gb1hruoC8WTq9huiMb3oekR5oaWp3MQASDAsoJrYJWygoKYB6AB--TfmAPIAQmpAnWVLNjt-LE-4AIAqAMByAMKqgToAU_QvElvZadlB36YHNVkfoJaQgUm3GC7nx8742lQqaDkcnc3ISI7HZFRCaL_SAPLelYE0CmMM0guOwAUay-KdOZy-FBKS1JDMSxDANC3zVzbvtjMMWwdTbQ8XsTMf_orkjCP2SNGECkunasuK287os8rRmKWAeqFa69b3kCizDLsHI1Mml8HNf7wLlHgVTn_8YTqcTG_TrjCkrj4I_q36tvUnlCGUT4K3W-hJF4LJ1BeCSO5i-XnkmAGMnmRFFAqlLP6nGYes9P9GzpJfGZliO3SWskCQk2fGl3phmnTsLXqUm1D5vuDn5XABJqhzOWFBOAEAZIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAftmqBnqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQl-YC0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOvIIG2FkeC1zdWJzeW4tNzI3NTUyODQ1MzE2MjMwOYAKA8gLAbgT5APYEwyIFAHQFQGYFgGAFwGyFx4KHAgAEhRwdWItNjU5MzUyMzIxMDAxMDE1NBjqwW0&sigh=UNkZ9pfVYak&uach_m=[]&cid=CAQSbQBygQiDIDcz5bKDGO4iE_uNt15XmmRWVrY3p1DJN8SMVpnPG9MoRioTkA7_A-VkusW859ERh5LxIz5MuyOpL118VjnxUJQxK1irHgiB6mNOsg6s0GEdPbxEUa9C7HyvaNI_Z3n0wCRSZJcN4uYYAQ&template_id=484
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H2

200

/
rtb-csync.smartadserver.com/redir/ Frame 7CA1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEPKoGbsxYKi9PMuW1JqZlDI&google_cver=1

43 B
113 B

112ms
50ms

Image
image/gif

185.86.139.102
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEPKoGbsxYKi9PMuW1JqZlDI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM_cnJQCEOXw25gCGKKohd4BMAE&v=APEucNURkpesPAkw1ldzRmzmvIWV-grbLvf_kM6JLkpEAKY23kBwQS7W8xijlX8lWGDxgbF8N-7DI3a4AWgPxZUyYAL3qjX1J8psE8lqio1E-7kuKQ49AtgtMqrJ5a2Zvg7Z1Yy23TH7V0swe6tbMOw2bbp20LA31IWjhseTX3Kk-bg8FXYIygw
Protocol: H2
Server: 185.86.139.102 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEPKoGbsxYKi9PMuW1JqZlDI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
rtb-csync.smartadserver.com/redir/ Frame 7CA1 43 B
114 B 171ms
49ms Image
image/gif 185.86.139.102
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_hm%3DSMART_USER_ID_B64
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM_cnJQCEOXw25gCGKKohd4BMAE&v=APEucNURkpesPAkw1ldzRmzmvIWV-grbLvf_kM6JLkpEAKY23kBwQS7W8xijlX8lWGDxgbF8N-7DI3a4AWgPxZUyYAL3qjX1J8psE8lqio1E-7kuKQ49AtgtMqrJ5a2Zvg7Z1Yy23TH7V0swe6tbMOw2bbp20LA31IWjhseTX3Kk-bg8FXYIygw
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.102 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-type: image/gif

GET
H3 200 aulus_728x90_DE_atlas_1.jpg
s0.2mdn.net/sadbundle/11207411921136063200/images/ Frame DB8D 2 MB
2 MB 42ms
42ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11207411921136063200/images/aulus_728x90_DE_atlas_1.jpg

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c1c57474d88bc77066cc29ddbaaa5e853c3dc5e4892ab6cfe64ec36be3058389

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11207411921136063200/aulus-728x90-DE.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 12:13:38 GMT
x-content-type-options: nosniff
age: 210696
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2173118
x-xss-protection: 0
last-modified: Tue, 11 Apr 2023 12:03:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 12:13:38 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7639 0
0 79ms
78ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvjaVWsdFiH6ir8nJNau6VC2Iu7y6nVeUZQ6Vcs6QSYYSRf9u1nKREmJsOtNt8XWiwaVP80wsR-2J_iALEGBrZgdridVO5q5vjdPiP_Dnj_9tRp470B6RL01tpOyqkW0xC25G_yTLKjFLDXOFApkovE__TMUnRg5QP49yK5ZkeHDSduv2YtHDz5PvTIYyX2sao4oFHqgqjCaMqAe7CqpjQHbUCBces0bS7zu4R5_uST3qIFS43I4nqkwrYyh3jNrA5zw_rQqa0W10R5wjuZw_u47nr9ek5U-oOD3iFXIVGL6QeS6-obJuL2HSOO6bEi9wx8RyRuEc1GiZEzfPRwJ_NlHsub0Q_meHSRdJRxuLR-6M1RtycXRcIJcrSp0nl323HNPl1ZkiBirLJWgE1xBpqVExSI4QE-gERUsGA5ocbQwFG1HBYmk3mtrZC_S5bkq1jq3PUP6ZytdaKtgya4z1mZ3HbL4Q1ozUDpP0uU2Ohl4r0IUOEXcNNkzN9Lskt2fscIB15912LTWZNSQWQt2BZXNCBxtDXlbwefR6l6iY1WCvnabo-9X0ukM0VQToB4uwjaUv-ihtiCdLRBaZ4QuJQRDvHdmqjycLyqcDw72jAakamnUBwKjsAr76kLDKwFFp26ClmQ7VbCytzvjPJlkB4dxQxh6z3R0gAKvIrFwD28UDOB45_wXvi3w1FAUULh09VSnfi_mRMnk4qvpdicP_gbVeqeow9h7PArxtLRbJj403Bz2dWrAsr9Bi2T8EfJ_oSzcZLvRSiabbaAv1-dUFAwzsGhNg9CbApCkCLa2WGMGlX1iT4p-OZ_5jYSrAo16AbAUMtEGWGxTFvo4F6_j02gWFU5R9LmTPRQTnJ2aTM9uXluUz18eKk7y3xp-yBBzWjKpAolU6y4F3yY9hN8MX3zshPtyXb9TuOI7eUuSPSaMl5vhO97BvvbuE_putX8CYOt8aC3E_dGsaE4LR-aJTncCuBA0ddKAPFqqr34L9SbWT9dXE-Ft6vEXPmXd9KKRjuXGHnyzFaAnOqdjC-TqEunDyWhB5YX38kh5M4siJXKTFXzb2DWP6R87gBphk1yM2Cs93_iA0i2dKg1Q0-jQFMc6kuWtEoEo9gpWQM2kvbTYgfLYhOINBWiju9C2ai3BeRcwTGaqlvsyI4XUWaRJEpSFGe7D37gx-YSgNOh0VEaUWTp2B-DycveDzXC_i6tt14x5rP_UpHSVrk&sai=AMfl-YRHtxB426-88R0CrKCkQ7GacUo8cy8OVyyuaSiZ9N7H2J_qy4yBWCE3uhSzviCBOGzBbXbNRwb7U-LuZHGrBG6dD6PacJV7rjOoEfS5Qq9poCtZGaCrNr6mr96uVDyUqPJbU0aYm-l4JIzOcPzfjntKC_6zCxk5TBPT-WPzgNys-8jGFMv_nxTaHbAaW_1umCoXGR24dD4Q3ZiUe4cjiWMBzFfs0PohZW1VnTR33ig&sig=Cg0ArKJSzADVDC0GgTajEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=601&vt=11&dtpt=384&dett=3&cstd=214&cisv=r20230531.98649&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 05 Jun 2023 22:45:14 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 670F 0
20 B 102ms
102ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1481853268427&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 670F 0
20 B 102ms
102ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1481853268427&version=m202301230201&ct=76&x=1&cor=7516560276911854000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 670F 74 KB
35 KB 90ms
90ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DzYQi0NkbSnPY6PM_UtL_n8YMKA8Zb4ZLe-Se-1I7pwVeL1Qpj2CTehSQU9i6B7ve5A50uWrzGLQbvpnqekmJYzL_DgQ&cry=1&dbm_d=AKAmf-DLtJmiDrtKHTTaw-oCFopyU6morJKg9-GkvJZh5-qpaViinLG4a0bZvCrih0a7oKJl7Ieauge5kOTbUd3HWwueslbXetDj9f6iaL8hk6cc97CmxyG10xeAOf6SGWvVT_PZ-wdJJJZwj3ERr8oWq4m9pAQ4rsRp4P7Ug4vnMGqcne94R6B0Yi-rmYmSfIcydWfMgyA7gggPme9ZqnUn_zQ3QGi8a6FYhnKB70B_1Meo_z9VKKAa2o_R4zQySLR8PTksRXrrW0a3RTtQLY9uZAZvQ4OumZIJnW_ywjQkssNYud2YZbFQQuyv20yvkd1-T3iW_JqjR-DSTf5tbW8wRUpeC_u7IzwTiZihGZCYHunvA7_LYwU57eGzDX3Dpp_mdbItPgY1Z7rWLCiazU8I27uAR9wKgt9Rq28BYxghOgNJtPXz9jdfDpV1LfgwStlUeWDm0T1a-pHTdy2d1Z9T32AN_uiOlFRHAq_2KjjHo8FGlK8bHtV-kuav327QJcEqbWPEOxOcw0TsSywjDwp2ImsjHBuDWk1sHKM0ktVxQlfX3E7vGnMuJv2DQSFmRywrzjR98DxpaYSea-f6WwbJGv-q0u5wyfnkQ95Gyg42MDSDddU7Bj7q-H6ScfK6zGOzl04FTG2vIxt8H2aXIew5DVRboMPW0E6r-qY41A08xKjkkTTeJBxCke2UaNRPeZn5w5DkYcMwpfeoAhJTaq71pvXTqfnrUfy1hb3gKRCMuN0ghXzHoJzgmnFj6PtuRNCcxZSi6YADkQhBzPtZlUwSs8QD2cSquZZ1NBD3XFPTLo-NKURgyfowS8W9aVYNn3axQpEb_GjY8LQDgKC1U0rt6waXEe12Msvo1udtlU0hwkgFWJ_fYROnN_ByttTy-daSA4LN6bWNcsJYBCotBs02hmrYBSvoPPxGEh5-nDWuUa3VYiJc-TYdForjBcturBZ1aC46GiHJX72ltD20fOe4QAWMtRslHYo0PQM01g4Y4i9VCNVmO_jCzXmxmHsobSaw4Zv5fb_pzcy8URETZP4elBhf8mw9NLFNIyKsKFKGyAVQtPE-K0YhsAs05kUnWDwXrsqD_XxC0LKNs0Siko3tzuSOurEdx5vC8ZOr0tYn2kqMkH4nF_RRJKzI39ZnGI1gnlaFX9Ozp6AHqgW6xd6FiyH7TeOp4Z56Uqz9h7ybTS4bJ7tAjW_ZGd8K_xpQTZcf5nX3DvbTpekEcF2bZwyI6ThN9U6uEYGWBQOUN4EiG2nF7mgUeA_GSslEDFLfWNK03BEICUHq0hsXAN_xP4GwgcT0hpUv1W0ii-ZDVSLZWYPunOAcN5w13wcXhg886-bo0RXC-v78ad9zlTduwd305zrRblVbUQOwrElp5LkEQ6kkUd2pCv_iyhHy8qAsp80IsgkFFnpbS-jHHEmjaMDu-fs7R2RT1hMrQUqr3mgcqd-yH95i69vhUKJ9oqQx3vfjbvbSY3zIdqA1y6YAZxSDk9S7jVn-erC8asFOqRn3jcshIaVay9NivnB7X7SjKBJRis6YY8DXsxkvfwR28fYqFEAvkDSosMAunknBYhJwGwknMuhpP4V6JMOq4J1Uyvc0Q7GCnatid6fGgJ6das9B-fRywY8FErf9kF0LzpsniASrwt12BCI8_tP7K7Cq4hqUhL0WeXUBtv3_cIf2TvP8S2tSXW4hNLK42kp3gNfqpLqbKqRSeMLlw4I1-CeG_hnVHdHjKdbt1LUtpZOHk3liunS2T2HECLLvDwEP004EsIPvE3RaR7Z97uNCg7BQft2C7yCKRhqjuGFvLzhVjQQlo01mW-szW-AeDG5mFUBSyQ0iDUgFHeRKTy2pLDqYO1-sMPDwWI8nvJRByjp-DBjxog3TD6q2fMGhI02ulj8rZxyNXgNa1YL38Kl0aDnaQtuQM-9hVGGcsxyH7hgAFo8uilSBmR-dO_6xHYR7c0G5AcprcjZrSVpWbJgwbRqyJXsfR6BnXxyGfXPo0fCBLJCm6-25H7-Gf-Scgp0iTFmGz9NMg-hNr8AN1tlNhV_CycwwvjAv6ZcVD9uazcN2T-NN1TzYBh2CZCCRzndLUaGfWQ2bDL12mMpM1yzYkuVnQIbiAYSUcIBqZvUUdrBHfAXbQ9udlPlj59dcdPLWC6qKOIcDcTbZRH_n1eMafnJWWf9AZly9ZBMAhaFQ23B95qNbhDei3t3ZKo3faRBY3MQvXteC81yOE6wYVcXOElZ96ofUFiKInhbkpgCWFP_VHZOVK5J2q3EZCrYLXDvLPA9OCC1F8_FeKiMvwH9iREwzLbJeNnmw_lU_Ofb-NC10cdCJ8wReocGqHUO6vzXxvh0kp_iN_4okDcIDehktf8jcitttFQfwO2EJCu7StWgMkvyrC9By9lYbN6_7kIIKSqnILoH5oQg65L22s9GCN800YKXP2k8TeBFKIX8muYDg2_E5QLiOulSc3mvmQY--KEK62j-vS0DN4zIvN36aGnW7H3iwxpSiIkbSB5RPhls_-n8jpPzEqXnV85hBIcrzqaWsYbwS09XjUyNhBdj4fOioU4YsePFzGtRzjLDQ6nZux4yCRZcS1GAuQ1kvCQvxC5WUt68HZPSj6unMHT5BMuaImqva6hO0G2nx9QGQAHWSuU6aIrByagpwhimjP71nyk0aTdb4zOcgmn8BY4sjVSUCDAYEf9aSzZRwK16qFZTzFcLSUX-yiTOVdCpCH2-nskl6gtDMMz2Ir44qB-bt5skz62sV-6d_cnMGqGenQx8rcoTVSoJEHUBHFMHHT47Or64czzHbwrgydfQouTRctIJwb4YQtaW-mmEndUjqMFCFxYnBQwolP2UYpM46BonClrllU2ZLo7oZAxUyfqCmCiDtRUN6C7_0bp4RWSXNAx54Gh5XqrEpGhNirRI_syS91RgJm_YYj3PmiAlxXnHT5Q1soxxW5nJ2OHBHyWrPsxd-K3pJSWogbxt5TH9Yo4vNKjp132LQxOyNhXugSw5SkWlu2IDiwt3fPTdEiEnpu3-LYPFL9NhW3Qk6Btx3Dt5qKu--huTxBVVPuslaZ7IszFlsr1ibJeVXxpuXoKXAoFXHFMUURBsSQHjOHcZr-LsxCBO3J8broMGVE_XXyQHtKs5k7EXoi7ktNWPjTDp3nSL-F0jUzMYhRwWuCyf6JwCej38o7X8zaJqrM-xfMUGyx-CdoBUj2E9ix7vq9ik716ETf3B9DeU2VT3isbjzaJKmDpGueSyEdqKP5KcDtNxYdO95STl6DHMZv4Xttpukza7mLOAq1LQHdHZNPYFdRFn2LCsKir3TOTGa8OWu02IoV4cVu4PPrM6IDi8sdMKNn1lwn0a0bVQ5LCy-TW7UnZLMI0LT10tpQzaCP70-42EStNvMXwJ68mjXfd8d9KtYpvuDV90BSZR8QEMFXBGQhpLXsrTKy-YFFQYh7g26XaIq18UVGPeAYYMpwvr_vqzyuEoAVbeQHUrXC7VLK9Zr0iSZ3U-esP4L7NyeT4H0t-mzzkVJd7iPOm3CXL3CP4C3jdcBYcd5x4ooV45-WLAAWWjjsQKvXeOKgBCg6SxkXPs89_dgOqsZYIiwa_vft1BRycfcN9s5PH3kW9fCgZ-6Z5FvLemS14I6-SV79Hw&cid=CAQSbQBygQiDXosOyxUu_15iJb7m5QnirBFomuSqSWWnCokeyU3byyD0Y6oWpN-5vk-HQl0tNAZxOgyHn58zQGCUJ01HLa9IsOb_kMY6kn3-AW3wCC9XVE8yEwrHvIy_EB0OwQs5Jxg6omFcr5THFqMYAQ&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=7516560276911854000&adk=2465470143&idt=136&cac=0&dtd=27

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f49425f950d8579fcc83f51e3de124e01c14bd8a2f8f0953c51133958f43969

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35407
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3659 0
20 B 77ms
76ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BgmzNeWV-ZIKqKsbVgAeup5jABgAAAAA4AeAEAg&bg=!nJ-ln8vNAAY9J7QfHSc7ADkAdvg8WhRGnYaH0AF9-nxYGeMkyhXyHl8ukLwShPxLVCJxkH5snW_SChIgK8jaHVLY30iuDGifj2UCAAABjVIAAAACaAEHCgAPLuymcS5EujJGR_VhYLosmQM4pNtilaK_jVpCNWQ1zTRlL4Unc9wrM7V1CRU0gH7C1NPtOa1gxXHTZXWjG7VZOQhhe837NI_YAZJ6INkYbYbBv1R6S1M9bUbrbDn7JVr-p1XdvEUdLKHujmN55gZblA_GZNam1BxCBc0TXSH6Zn8ZcFM82_k8iyKAumxZdcrxAzDW2YtHnWW5f4CwLQwPa4ZRbpLI5-qGQrHau_hRnXWMbYcmhqF9jv6Oc60Zldixjfe-gR0FhAEyMb1SOj8stFj1ZU3zU2KN-9OqyhlgdX_uFprYrBX-pNA1BIlG_8Mp-_oy_8aj3BvYQXt_6FsXhNQBloIBRlGhOTVP7d4T39_Gy87SlVfhFuuE9cv0rgH-5d_g834Kvt-b5l8Ggu4lLo9VgDV33Nn-D-IA1CfF5_PBOxLCwsoRAmmMo2MQ2WOjcdrJOduotonD_VzvuxMbI5ccDLCOwrTHmoI8YK47U2QHDM35kSCAoMPd9gXiygG1-wRuF6qCXxN_glgH3PxxEx8ENeY4Qwyudu9IP912w2rPWFSJHMTXePqcIYaYC1qkxA39g0YEWbiHLrR3UQrUdJAOR6d1Hxe_nPZYq1hRDkFm3iEuVKIfXzWEifRXDVXQWpVVm0d1_R0mc8tk4BggxzCLbSuzM-6piT2Z4hFsqOzrqV1m4tBMgHIX6TVJkmpjRGxGxj1J70yXVvxAEA6fv2nesg0Nq6pnGvXI4240TmjmEvvChCg8qcP1gvznBBzUH1vxXGDf2ZQchp7_mlDsmxjDly5BJzZFfGrYnBVtbVgVTDhwN7WrFvkdAYeOxwn8FUVgVd0XWWJ91i4xcm8yrpLOqJjItFroQ1VGt2exTvYl70EZqD5nUyOjwv14QfcUE7uI3Km6pzLQB9aBPrvAko4ZP_bZ70WMk9145Z8A45ZfyWdDK34urZ7ea8NCMzeqhlDO40C_DHwToARBmMCv_UN0LVuY9-D-St3bVuKadefvpAAejDEWx6g8c0D5HO5JdKpAS0lz0KmeDVxOo42HawFqK7qOEpHcWXbGLv6CcLInMmOZEjnLD7jzLie4l0pSqLuq_oilvBHbiI_LwVawQ2ifpsrNcU1ABDY

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 083D 0
20 B 73ms
73ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7026243360477&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 083D 0
20 B 74ms
73ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7026243360477&version=m202301230201&ct=76&x=1&cor=18372249592536396000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 083D 85 KB
36 KB 81ms
81ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ajrjd_Y57IDUYT-KKvoDXA_ykDZzDW2FRDPCcSgwx2OCgYh6w-k54SmOkc4onFuTkYeH5srI5YBc_BlQiNIlSDPEsyhuSxXzQnj4Z_HJ8DHhBE0BHzNiwIOReu86KRkzN6ZWwG1AAGPLaO_0QTw5Bdtl_Rv7zLTqBMzx4md9qfx7h7n7Q&dbm_d=AKAmf-A5cJ7gNRWJTrmjnHcxyEHt-NumWyZbQ8x9whQCpVBVGi0acMuchwEQP_SalIsTs__D6PK-aawtjN9xYUGkiL_FQVjOcrkFJJcbepwblC06qQ74yl83z5DmcF8Hti7-xibvnzORLJKLWAnYfVNTBW1rbjk5cGr_ltGMhVk7d4aOhCkuU-QB_3Deh6uQho65JD14NGELsvDLe8tw2iEctwPtHWSn9taoUXU8BLdptZFWTv3qUEeDQ5rK7H8rADVJuwbN16R-mxYZwEH5Z3WJWwRZfQZcW6Yb2qfds9RQ429xgyrVFvcP1n8uHlupMUfij7eF-aaMKeg6T-n68d_0yQALCBLj6XOLPpW5u0NdTTl2S6VAtNr98QtTCHgFkaxzY7OLg19wlBQKvz9_2pfdvnqopVbBYpPfUNZWDLgL6dFLVfepI3XmwwMGj7GEAESBh-nbYQjgIyGw36fl0jPr8v3mf_Bq8wjbLByCAO7xcrq4pR4kQvKzkwYQ02U_IY98SB3LvVY3dgODb0xgZH9JzNyKpAz_VKGCK7bkj6gc5MuvbMS2LiWICMhDwRoAuRmRMEGdJ_SRUsjXjfnn1pMqrYycCio3BxvAQ_iNwJ7Fo3qn1x0fFXl1o3I-lW9HLyDaNf66mwOgZ-qdkRko6WcZ7BpoKz6K_ElJMkuKNa401bYhsmZEGxv9p065PR92uuiAnp94zgS45HeSl3lvFOeXVoOv970x6RDy5_2p7iTFxNPsjh7kX7O5KbIOHXji11pU7w7aQ7pHRtD3NkAEvGsKNh4WaBiQJ95geob_QpNVPnKEr6fJyMi_wfXRhlF6sFeNKUA7rkgk6LoGNeMC2yxHv9jH8P0HywHGi4RUQVPys1BR19i3mAD5uQutwvCWFnzrjTJSQr9mCtneHhDv3ZQekzFuu2nclC8hDMNBwMoVzAzsDWlcGboDSGfNqMOpIn7ruhFpAioC9aFA5oWcpITtOS6oZGyvlkX4_CHqZbwH5Q0qfeVzrgMf18XcowD-LpYlIvmJ9PoTv4XTCd8L0q2YblFYs3vv73taAtlKWA5scwlurIwT5aC1FIOz7p09RavbnYAzCqTHRFcl7_xcehggUgSQfz9ChRuXc80X1cedfbMJwuP602r2Wa3-ms6Mg7-0PmyTt66WmbJ49Wav3LFhgC2a0xIcwn9tMBz0ekCqc9N8gHDlENTCmwjgpUhNj7tbR8vpAAYUxX3lbOMWsVc-tCLA_pK9bxBvStiO5WKDjNbgSVNDTtQARnczxgaKxpj24KT3vlhbU6No0Z7Y98BAjPlcDA6X933zVt_pDnPFjwuYv0hSF6AzF-x3lMt71Tj0c2V1ELOgjwbTenZDj7QVMvk51QwffTU8BHG4Aofru-HXKH1xpT421RkVkkRV4s1IDUyuqqYDUT-psvcQHV9KXUJmgfWg8OHK3SA0Vh05wtHjtYLPJ2gT_1j8dfhwczKwdl8qaUUkKqqxW0WEyGlCcOS1JznwpPQTv-NY7YigpZ9OxSCMj4kvo1yqH5mGUeJO9mUi5SNXukgqxCaEPe9DzyJbMus9wPIz9SfEocBLV24zS5CzWc95PB8Xb6jAsUfSEFHTQfeYqkw-dzvbhHNORJ6fKZJdN5KkRz5R544_8I5vamhxKYQ3AfImP-S7en7A7ESHbLOkV7Aii_qM4W6hkikTuGQc4jjCmje6q_UErzzMIBXmRVXHhYH6PIG6bIxhOz1o2LuKHIBf0p0l-LVMTH-IF8Hi5dJNH2bbo8LZfDVyTFM8Ab2M7HOPicRliu8xBdAvHMOJaTDH1zRyJAJuTbGPptveHYS0izsbIieLUDWG4w0ZUHs3aQVW9S5fTIx4_eCMJvSC7SkvsQeMZmdfE6p6SROIRfBEB3gK2EOu0vVi5hYoYcs03_2S1zNdQAA6wfbcyPhKWy9l5-o3hXwpfrq5a6I07GqP1F6s4VyvUMP8rk52Vr6p0rJ_qOqlRu95s06_HBMGa15Y1RrXZc6F-6fT7bFH4Lj44wW3Dcxhqu0P_NOQ2pXHNtmzEuCgg9ccuRVR2b4daUuQPq8ShNZdzNItqEpfC0RobqndA9L5cPZkq6vP54w-EeNb691lX3RHpetMDh7zVZiovkioK6lSmnC19hfKz2d6EWY1RUWHWSDokTYZ0ZMXOLVmFJZk13bnglVdGqDa3ODS0iFJpp51GJCKmaFxuj1nW4a-uEtBoJGsiCywjiJwo_Kxa7raWANtMrsYewSsE6rhfHoues5po3ofeyqb4WBzbU2BD5AjxktCfuOkwbek3jUfIiraLFE_YWiQqFZr9Zpy_NlRGo-QNmzy5ofQ71e6EJ3EDsUBW8rAQjdoJeHk5TnKfCgH9fySTbp3emIJlznC3kPJNtstQqUJ9AtqeS3Iu_tBJna6ZrzSz0nrmUs-We9v1YLfABOrBUS-5t51GVdE03Lr1cLLzjXMVarhU2WdjoohTD893ZOnw5NenhV4EtJK8nvDmvMKTMB4mEO6IEFziU3HXX-vU1BVdzy2kwt3X6jGQSn022I23ZDMN5Gr1GeGRjoTLaqeT4Dp_eW9Y-4SbDeneLwVma4zHF_pq9oAC2RgHk31VNkLSnJGjXeYD7Ba4_MAGPrDnIj3tAfuupAFJihamdtbOfkAR60GVHIwEFqk0ulBKQSRVonbpJGJPUIojxgtiz8d5zNxa5bchGD1-m6knlosftMHERUfoV3qLoKxzxLp3T3C0hfUkgkdo145HVqotSiyc5MXSCXUII1_MQC11VJ8QASXVOGH29BMp_jrM3MV2MPY05vm9hs_hupa5biu7ILxHy6EfVRKSqRYSLzOEVQkBc_-6AGdrKs_Us1y6NxbVq-gtsVLQUxNzyx5BH70XqOGBw_Atfd6hUvbnwvmUcxL_mK8HE3a8OMBOESiqxX3IbduCrG0QExapZvwGuI4W-RDJ83nbN1j0jzf6XelODulMrWWF9R0W98aKMFpbusCT1lJJ7GADMFfeiyK1Utgj8LqfJApVcRxH2sHNfFeTMvELcv6rOnbHgbnpk_CaJxfMTPQu1yHmyt4ci0ErbISuZUWCaTtVuFfv6fL8glnxnWuDcYA12wzly1B0ANP-frbquUrp0e80OFANxA7mzYyDrj6jRWOIJXb-i1ZAxcmHjY8tYfUNzpK4IzzPl9ijcbsLczMvVBNv4AeoDl6hDnOJ3OThYXiVXhz09Hj3Oay9rwB8xaPr_DsDmuNzDzK6TCWdB2uFT9LVUWtyTMUmdwszI7uqUBHoBE3InxHsTHaYNNTFlucMQLqVMHigHSCfEJDKOddeJBF3oaqQZ1e2b5-Q39OxHLse1x3k1fD_fE4e4Qu_f0KHfb9fYsfqZbuxH06h7ObDdyFZER4x6LidyrGb9bp33izr-_hEL5XDkhfjuno9MszTeovfD7_Ltvvj1RZX5mVTKlOnojAVwasXnd4T_vFMsmp0jC8&cid=CAQSOwBygQiDg0Jb9DWp-KhguwD6poWyFGq8KU9LPRxJTmi5FMk-2cSF7Ma4h_IGoYiv7jqit8GvKVbArnizGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=18372249592536396000&adk=3587751834&idt=207&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c5df01c8a88dabcf3f760f9aee9557b4084cc3df2d7ae0ccbc9c01cecb0007a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36439
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6B89 0
20 B 73ms
73ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7007617902818&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6B89 0
20 B 74ms
73ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7007617902818&version=m202301230201&ct=119&x=1&cor=4995774255353773000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6B89 84 KB
35 KB 105ms
103ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DeIDkS2MwYjbpQc5k9jHJ_HY9ieNx_YVhRevA9nzUYB-v8wLxg1UlDtQMzJP8PO55SpH-RlYtmGODL9V18Uhk-8C8JG_iBbpv0pA-oE5_f3qpBkLCTUsQGHe2-h60gNza12dscU0ZTVD5gAtcChygckZVKOkq_Q5X7_y3HQGYcKbgW7Jg-K9RqTDniZYwwlpE4o16v&cry=1&dbm_d=AKAmf-D5_pCsrEh9rd40NXFxgQqb22jfCCZ67BjAwF6uaGPhVYEgKETu3BZw_OuCWJh0mpYkOFYUY2NNsK3oboAecya9DQSTURL288lNrv83ZoDyRtymUqYDEtby464njuG2fjx3Lt_j6p-wZc46ZIQendBHQ1DCV7rMerFy13p7XdKywocTHNsNqSxA2zUD-AS6U4NyBiPMZ9y1FtGLjljHib-kCiFiiR6f_LPd57HH-UzeWOKgaMKDa1riAg3jax8UOcyqgtYYpAulwsxjQj0VUBS9u7Odt_jqDF8UeRVIUbVNnt96pHy5t3Y8ZTEtisvn9ekQJNR-RF7lNVLBAp5Z1qdwTfFsS2O16UBx8c2TmtreQWdDNJyMRdM7RvHduVAN3hB98WqQ4VykDy3mCXdrT-iGbdkT4yQkurmtawEOhINsF9w3mHMzIe1TtyoZgs5EFs37VLxfm5zlK42ZUfpwgCQQTeMnDWpKIXkXovTSZetLGzlNHmv1QHo-I8dKMg-c3xd1_cdk4NlTfiEv1IXk56kwOToIFvNxK1ZoRCCadqSl-qyg6RO73jqBGBMQAKrHjsOCDX7zrKgRmW1jzVY-yJ3DhMAkt1b94zzC7Ihk5pQs4Psh_h4y91mKfVcF7kXEigazJ3c6GaLsDqfBt3A2hkq1EfjVoC1dQnLa0aXbMEzeRQqFe_69n6cu2GcG_6gqgm2zUrzjQHMZVRpZLs64WLntJrBL2IJvmE_t6XEAEzOjSiJu1uNsejoxKqqoZ5AOwbPeekfrA130qsmJiulUu0uuieg3C0riTU0nLELpNNS0PqiTAvGKGZL7zOiCAMO-erkqQ69Ombybypn5o3BdlZ8TfghRMh65ztZ1WNlyWYEgCQZSQMdhg36raoK9ptcG6jU1gOBGOTxdMgH606kjFo9k1Hrxb4LB189Pyz0dshK-NzOIIuTDsFa1VSjodmgIwQwYfPJzEJfdkZvUhUN1dgaiyHGazEQqClGf100s-v_crW4-m7EZ_ZKERRdyjdWe5vGF2vQhEuCy8yLdN_0-tPRpOFWdgBwCjFB8Dux3-nmmAdPZrPC9VTtGv6rZwtOqEszG7NmB0cb46tuzq-51d4aDus270l2WdYnTB-lfsdpJWMrbkWVph-mkPg_byCUi3sUk6cI3NsQ20enMxtdXIYgRbKSKq7bHVM8dVaaLDxDI9rggk_CDqGbZm4thJS7BWYMJhB5IrHKgaQLI8AdjCmurZilRlBCKyfam8vf1q0bpHHRpIKxj_yYCirLsENBfds4Ord60TrpRIGH_1hHID7pkHPewPCR0mww8K2p5xHc7VWl37a2Wnc1HpTxlIq4AuRo79-JGzBmPfOJnL7a3PUvKdMoYvQAeN-yjAvgk82TwqEBF5BxHwbicqVph3vGaSHhDgo5Bq_UICdFy0JscxkLcH88mZobH8zA1YLdPfasF3gGhLFjk1Se0e0C2M3etKSa-f_sMHPJqgjfayhMKHesD7tZ7iu1KE5GmqPgp8RDShFyS_w0sIb0b_orptBBiG9NY45jjpCrsQwVob25adI7LTzflhqTRs46i8cxuFKeGl5dMqQ2_oBflna9XePyXVrVlZgEkY5wJHsJlmTqhU8wLteXIRq8qAIHB7iIXgDSaeEntCYR6JmUeXNaG8CapHtx2h8fkQECFsLiwJolFvzJFI2ufOvi7eFxiNfkLjXNkXRH5a_f_og9skQCulrPxPb3k6BAP0G1qor7W5dVPwZoBX3NsA7lUWKewTJk_ARsOuEK968UHN8JnSazJzdXd4fAsGx0YUNRXL8PsRs3RE1iaYWCbXTiFwRbZi-tDDQoCcpRFw8icVOkMt4bzk0XjdTa3fdxAzGgaUAUvgIGN3rT_MYgml5anoj2U_uEUIY5JmXAn48UYlL0IaBoqhhwGjJlyky0JUj_h-phO0OojNuufGlWDmrSlt8fOIUL6HQjgoDP8moPhj54EImNOPXegRtc5JTvZhvSwr9JW2uCiq2tYuDBzNXQm5-jf0N0TWMeAvDI-UVkDc7SZ93H5xRDX21LpEurKxvuV7PsrymBkzCJZ9PmAOf_4-9n1WkXpGtbE9txsF9jlt42MLmScf9_mZfCf8PXKdMmYzTyUgWaCFibmjkdcGIruWb90Xr0m2QNFap-4dWZFzMoAKBYdbN7pwluFayp6L1LSbpqqOpmf8IkrOYQpZbDi3LxKaD4qru9qEcdXVJVw0NIDHY3n63SYJSyHOnK4zBSftR7qpIbohbipfS5FKmMXCTq7UdfyujkdFYaG9ze6W1cYt2GmjN-j5MV0slBj7ZWNHNML3kDNTB3cZ6o_UKF-_Kp9y2_07w1w2wXy0SsNSvg8bVn6c2BiBct1iOw9zuk354A7KWRfxj6fNJVP0PEOMfLbOVNBOfWVo_p_2XjBkoc5jtvqp0RjTNBIBv-G_krJg2_ejfH_CWzH0saWbba6Ou2HaPlACTZofhdCYktvLDKQ9uBbhOkKTf69IoUGbV5iCnNyki0aZpyw02VdvuC_52iy36t31Yn_F5YdbvvvluehNJlo8OKS45XBnAmUm5EcyXqJUS4-wHCBZjIeaCC9KMngmKFLFOFABmK5QaASsev5b_9vVxurI20VskRnIdJqDkiqzy-6vxQ9A_k1piQQMWoqWbXl2bR2mO4eIa5X6_onEvO2KeeSjXcPQwuS2r1sXoDqTSJu26OqvVVoHYoeqmhGN5Iri7OGHEp-T7AVU7MqTBBbARwTwf6tiI3r1CWVEsCkOnbsH0HbUHTWJ2ij38VFIv13MMWPZXAEAOfShr2p1e_F6DtvqkK9H-ruorWgcs8YGb1DkfTmYSw2amy7Zf38N-otnR99Oa6kBJeWub9SKpPNbkdzVMBVxQXUfJbf2LvTlVapsakTyD89RW1UQzUeLVNhEVaPvpVltIvCXEcf1sAPJ0ADY1SzDswVAvzo9X2WSNa8GQRfyL49afYqj25Tjxr5PVB95eI2fhkrKeRhtcL4BBqLEGBlnPl_fW44SIYMKqNMj_YSQQrtJDhg-St1-IakTr-RA8VBHDN_ceTiZnYpKNL9VbXaEUf-FGSQKY52hqOyMWbB0FNUPD3sfVHmTAU2YEbSFkvMLCBB1H_51Cfl7uMgjH444lheuDUY025tEPJYPI-05QZGLkFpv2s0qVQ8Ko9NjmgIcVzqdbcmskgfdZuCGzmsxkJlyAQ99AR6r2tQLLuDjMsgSFnjBjpPcPgq5yxU3ymsFJ8cQWFxuN2fV7oDCIu1shSRT1o3JySlSmjP1aoOv80eA0SSaGSmtXz8zgj49n_i7sJy-9YKKVZFKkldVrR07WisVeHvNKwZYY88tvdUaGOei4HwYDagtHHy0IboYzZ-1FU7FGq-Qx3L6_bVawRJDV5qBj8-RnloYqHPxwmWnqLUfOwN-nVGKa5uqyZ79DZE-ucR2M9akOB1RRQP7zdfhhFJ2SNn9AZyNAhDZn0cV41GQ4GVJJHxUJmSwyj1NW7_2VDHIzIa6HklNSbeg35zLIgsFD0_DRmmHwB6o5GmHBzfOhSSQgzB1JxXufooLuDvjggfFn-84nmc8y-A2ovBX6YI3w6UMDdMvExx9Nlce8FlV9YduV4TIHXOOFpYauPkfrJNw4td2yzOykVYD3z7l-GNygZsT3nyO4wYy4atvOCihcXjCrIeW0PW8purtM35W36y062T9pjzBEPj2gOTGSPwKtkLwMwlm6kGU800yYijVg&cid=CAQSOwBygQiDCJYEzYKDL_cRGpVX9Oe0xV06Bhs5NfbMmuSQByl74KDRoQoG0HaaL36zeaFmZOW6xyFwe6YpGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=4995774255353773000&adk=3563752640&idt=174&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34e507728c6cfe139a9963d7db343087fe09bf2cdebca19794c3356a6c2fb8e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36226
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7E03 0
20 B 74ms
74ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7592124804927&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7E03 0
20 B 73ms
73ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7592124804927&version=m202301230201&ct=119&x=1&cor=10103871710852602000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7E03 84 KB
35 KB 113ms
113ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DBnJ5O-uggfCXznFa2rFqW_aF1bmbJ2o93Rwhc_q-dsgiroGxTnMsDVhqOb8HDGMMie2EZKP7Hj6Mdvq2COPninjMr9-ASvZKkG0OXl5QIYfUbWtUduSQc6FyEizdHcCD_injThwe_82lET7ZhNrG5V4MLskVCfSL8OKEqUpzIbgEHBbA&cry=1&dbm_d=AKAmf-DxC_mKMhjTPxcnqwkpFd9AJbl4HWZ5B4pGMY64rmPloxg0WWfBNayjusjDe4Sj9JhhmTGuu18EMRQ5mp9h-IOi4klWJCvjcQ1waHuC2VcIvJci_UT5cSxmrMUt_GMOV5E5tk4QT_zmIY9PP_7JBHWZVy0zlfC7wSvn6FSc-Zi1ndxkMMJ9Pl0xnFLlahu4smwGJRc-i75bSrcn4efKWXAYyxN5Y_16Cb2K0jx46_Nw2ny_DnXxAJ67ryk-9o39LvUJZMfRbEQI9KLPe8hpmcN8C4YJPNRoeOHZ8KINWCiOs0213_JE53hJ_JQBjEdlCWYEnkCifmQPoMdxVMKpxvEdKJGQhTw10MHvhWTzVAhpJDKoLGt86ZJ-3kv4zSQzEbLSDlRmjKEFR0MG0OiTLZkGqsw5fLtW9_n_XwxQZZzSMtOqGCznBRLHKKpSFLWg5mIqW4fXUKywc0m1Qw6jxTbmOZr9Wn_vdB49QaP99L0lTpWhA3AsOcgysLBenf7J-3c7mkWlW8l1ORvvicaahQw2b9DOS3plRqZMWJwUZY6ki128I7nPY1olt2L0w1YMmmK_mP6Ifn4trIqoGftt00clXxSR_LP0T1GmebCzuJn4yi6wX5OaRZEjpjHjwcRIHnjBoJ4oDjUoZoS0CNoG7aBvMedeH1FNOciv-TwbXsBPrepPETdX4J54QqSk8CHgWgzVYcqBqozUjUZG9QfoNMYrIwE-hRvcAEf4By6zHnm_1EMD-6D1I_G2UE03j0Uq8LulgNFZQF8EHlPju8RSlquL0tAdqhwtmLy_2xWvc5H5wDvw1kiJZHGNMZWqS33yYBlK_OROQoWQvrRejPsVpqsoo1xNnnexKDOe-NxxTAO5BaRlpQgVwtQqyUgqLH9qBY36asWEkYijbE7oa_VYzHwM34OIxD8Yp_P5C3LDOepv3K7retfthA0VJjaBn8Sn8K6T46_Dxtz0igQJz579EqJttUaB20bG0QesYAB-XnXvGy8AWy-J6-Wq6jPHifWpwN7G4q0Y3Lse94CB_VfcsAPp27zLahXr5vQEkiIRqX9W9fBNk5_TutakHCXnND8F7a6BI_t_2DmFeHEEqYvR6bZ1wxGgIbfAboIxCBlszgbLLEXvzenBIFjSgL5bz-sqqiVgCpHceQoINgIaTOnkvgXdAXsuyPphGQYFIjVW1R-UMzpAde8GoS9p_8_02t3gwFRpZI9D-Us_3Tr55vy3Yn3TymU8IP6K8AilS_nuA6mBtY0VoERvD80aGvdMO5CBBX24clL122Ui95mo_iBUyUZqlk1J5J0mUKPK1C0E2WOuGlrzBRpSXKSocN4QmX7UzS2CvBBEKHIqcLzP7RhFOu0NTd2dqyDUcAAO57qkFXJhI8GuL_36VslEfPMRJGlWDVfKFXMORqBR3Gf4Z7Ki5SiwR0vHoB5IiPgfEFkE3g6dQ0vqxCDElnqasaSIZFurcEd8X4wcIL3MTLeiRN1oYY_8VcaRg8ziPcdoMI7QL102yLtt56wM8WCqdjFM3wlLf-9KgppPfuGWyc_DgX_lj5GCUsaILnU3XUM7eoeyfvWBW4L-kPvWPjWdzOrQnFz0ML_jZd0yzz5ZkFdmAhJDZMhOI7Zi1QMwbrOwOrfCTvjY92f4S7TJXFMSNGYSAq4aiWTWrGrUZBW2msAJwgucJodUzkPhnFysi4IUmzKj5jw12gN7MMTWSmWcQGgZm0g479mKCwHU7yfu3KrJk7Bu5AUPu9dZLvZ3aKI87MMiv3NRXuP17J5BzN2IXEYDwTb1c3byPM06HzRpFV-1BziipI6LpbsZvhC5ADgAEPMSo8KageEDh-yIesAUDYEX6stWL0bEJ0-da92MPkna9f3h0IM1gjr2AAsJ5AGWpcthWns59BNS7SNg2012SNqgSrYTi0BkerTatH_l4UNHPmWZjwGMDoesPqL2Gj2qMHbIA2jCEFYICFG1kKExziM2SZ8X64QvWoJmpvai7mc4fPsdEbGWkm4x0jtJmF07td4qy8yglqixiyesMc9OD-uz11ajC-bha1LlC2IopFxzRJ19cg-H2C4qAqRIslmRg2YpweKCMdiREGfrb6vJYtElzVzD5pZ1-GI562PNk9KLQCT8kHYCqNxtyTDeeLc6yf9-wqrbErusP3CtlItEN9uERIa83xeG6TLoQqQZhZezWsru6A0qB5H9wraK3j8Frf9Jc7gn4HFbX2ZgMve6KQKCao3INYAwu1boOEtZgkuKG1s32wNcMhZgDRvsOjqDYnA6l0jfjbDuz1Y3_bYhBL2otS4p1rgFK519ll8BM7OJdEooRQMMqOd1cwLsdEMX6IpSTcWTPajTTnsYJSXbRHPh73E8KUJMh4cbD3QmfE-IRycUN5vqvtoIYUwOe4-y-zyCDjTRWjzW0MyAgIY57dq8IMD70DoC5PYRwDJ44ITbaDYs2g79BOCYsl-lbrvWIdaNTo7xGoDfqLqqYuyCKYdj5Lfe8VwOu1f_u2Qm79ymwVyCj_W4xdP9j9mdQgbXvYs0JEqdMRnCGjlBc0k2SmX3HxzkUGToayksmAwXolvKX-sbNI6RhjbO5ogAfdEichWrb_EPpz7VSEYUqWVgtJBEzd7lnstfLBkuwFERkDlBmoigxojBM3XfoF-bt3bxJrfUdlB4CMnipctCN6dOEYNsWrtLoa2-Hx-kgaeJkXnk5AMxF3kch-jFCNhtcO60SYXXxoEBaG2xY1lCQQxkcxUSU5iOXgCakG2wKnF_cdbwBVB_vIE5TmmT-Ecn5bx5PJKlEzKhkmGHrZ-cSGJOLyO6u5LCILQbKmC8JCkdRmfRr9BhBSiW7LjQXUckk2nQJmwLi34PNO4QsZr--PSpVywXtfm_pWwzdjflqN815BnDO6yBk6gjStpRpKYmf8Fc2IYN57fIFmDD4Q_QSjHTU3iRHIyBJPelx0icYXL-Z_Tzy_sJYgU9c5TOgCfReJK1oTzx7pRSGc4v0u0QRhMLREZahtqrqt5SoDzbOcZlZQ-tJS7ckC4rkq8JfoMjPf7c8qVFAD3PFRr3cdsSeTMU6N2PlEMUUwvTrlVkMa0VUj8yGEuF2XD_S8Z455keX_Z4Qf3zSPsFlbO4Xukn_ceoN_WaR4ccF87oPZI7IqTzSri3xcDUOwkCvF2ZP6GaP_KywvFhzc0FM4Tm3WAlH-WYR1FsIj3hCfTGaX1YtT6GgLbXpYctL3jkR-DQnkKsVmrJV_B9fRyLKpz1ZQpMBtF223OfudzjKntTwvb5j0Bw8Y0I8DH1ywmYqfTtDLNPuuPiw51I4fy0s_kx_2zMtdAJk4_tDaPyXDDORslDDsbWnLF-3mZEvbf_V1nUcQGyJZg_k9k9ov5uTAccy9RdoySUukn8yDMSZ9c5SjQrQBhxU0_WJqFVaE1teSAQEfUfDmeMoGs9uUhju9uX0eoPFAWwpCMqkEcXuhlyv_7FTElmnw6Sg2Way5gDxh24ikhklG7mMw2kSo1wfJd1mSSKxifvy0jaGqJiqQ9ED5SEOerS0PxeyPl-MvyCWuLmaNGJ3sHXIWe8gc2vjsIK2_CltDYNqkmW64Q7Eh_t61MqhWNC896WZ-JkjDGnFt0EbJRGj0deslkeyEtTuKu-XnIwNEXssc13HcqHuqM5xZ701Cf7S-JPMDbdP3NUsJbWwDZfsmK1ywB_S86dEUvmP0-p9rO6yNnp7zacLPr_45Cw&cid=CAQSOwBygQiD_slBkSCd0D0cF9wTKSk0FD8ezTBKhdZ4tD7iukteP2rececEQpgtNZ2j6nme5E3l7-VQgItNGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=10103871710852602000&adk=3860319555&idt=211&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

443a68297087124197547e2784badf11caee778b245a3aa0f06a8a88eea9ecc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36061
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 097C 0
20 B 75ms
75ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=84435401753&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 097C 0
20 B 75ms
75ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=84435401753&version=m202301230201&ct=76&x=1&cor=17832661756419645000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 097C 85 KB
35 KB 115ms
114ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BTxPozLTFxK6cl3ZiO88z2M0wPU7lmn_OmuVIPf1S5Pbwv-2zUEIq_GWVhiDx5r3G22nbI-G97WvhFstdtqMiYEXSypcT9hDs9EAYB8Pr_uqALz3CFm92O9w9hCNxG0SO1_j4q3YnEose5ApFWkMuvvxCVFDV0bBTV8k-mA_DUjrspbSY&dbm_d=AKAmf-CMeYY3upckx_YAvPfaoPTvSP5WOl3xYpcgxWqGlzcw5UOnAPKKEVZ0AWuRGsGmdLJnZwN2fi2XUc5fJR4C0LzL-D20rEVs3q-DoT83Xwmb5OtUyqhf98WmgowevMab56_CQ6z0ZbhjYUTubV8BnRetXj__h6ayEQfmH4RFgo-AcC4brZ1NHVUzWB_vuVfpgnpau82iiI6iRqQN2Pvt3xbntPjiNJguMBEk42OyDiqG6PGYJ6i_wF3ybBBqs90-FYQCHKFU91lrse88gNgSVPRJlT_LuYzKa3_siWl9YYU2vcQhGL9_XgC6lU-Oar0vyxsdQsJQyMG0gDtbuwn-VJo7uHaoH3WKLZChvdTKPkHfU20nN1dsfNNJ8t_w7zlc0UcYy-XwoaCC3m_AAp4CaOA-sUgVzi493NzzZieVa7jb0LVP6v377BitZymtz150yBqLCEivcwtKLbwEf24X-hlvRZ3VK6U2I29a540n3bb5Nk9SqIZYlEnWrJp3xbZ5kNWoXxhsAIqYp02saNf8n6o5wfpXSuUeN2eBG56fN3ue0AUbEkJZNAt68vZeadpr14-wgD_ysR7DiEHL3udFbCaAmdWSDkjnAxPCselKVaxd2o8bMaaosDNd1AKU33dWacwAUjS4e8cZYUKpVGxljsK90DgRLjghceDZk4ONsEKWEwYygAIm6kHL02B76w_N-ZRGRvl6xbxcxjIVIjOCHg4sIxiDHqxGk9RHo8bCHY9pwNPTYjwgAkIjtrZImWXjqkIKJ9IEnZw0-nklLvJytRdSIzht9iJ6xp1bTynJqAupn2IRs4oTqDIgsSkmmn4sbi6O065Mggcu9E-0cbLLvXSSnd_n4q_gv61N05nUpni3JpGHWg5MUytN2sAjB8HEBbU8dZAU_MjCtXGH9Vciw85FL-UY394GoFBhfwfF0IxTOkb42RjjgDVGcOe3y8zoDiljSHRrhNOTATbU7qALUUtD1F6iNpzFQydK6dSpIKCsLbEEidzdkl0aBOibdaHjteobOhOhQnv-xTkiG6LCFqTFhsDY6iqEZaO5T7Mu2QCF4HDGC01Q0qYfwzVIDA7Eevibpp5Q9bKpg0X-UYrIooB1A5ujdznXJ_UQKLChHzp4EfOdYxAN76hEcFvumKW2lq6sa_I1gF4BzYrtmnUU5fS5xb1NCt-qDsx8BmY58KzBWqRlq_mR28PG8pI4tUQFE2GvoJ0kazYGhmnGCQn0tMVPhDxSuurU0DiHNiC9rL47GPUTRRZXqtbi9z3a-Qrc612PX6nWy0ZQAFd1__ENcQkASBVBF3C1GoIpjPA95-gaZFnDV8xpo_6Fhc2OvKDQIlxBBeL1fgq-q-F2uHnM_ItC3lqpHoqB1Vkb7i511bjeGO1NegK3jtwc3VQS362k1aBy3EUafMcBqsFtxTmt8U9z0SEeoi7PkJ1FD5VJzQM9REEIdbYgrDkF4_OzmGlq9tXQJq2OmNBBgAeUa1kc-ei7QZlcjwCopv2qiPZkPU9qshLV3CV9EJJai2BHSwo5gBD8STnPbHUaq7WXkravtUp61otygP28WL7QN_fUN0kCQWNgmnpJnH_MaEsoZedAUnqiYX4K7trQjBrAMeYPCAAWo4UvWu3Y2imMOBr4Oy9LguwARJwfAomlwr6aZ4ruqFbmNbU7Np4l5gQEm3JvJr7H09iRaV3fsG4XINgKwFIBa5oMOGb1zMR1V9_8vFJ1ir4vPnoo9OOK9S8PFuDB8uAVX4CKcmet-5ixWljiGA4iEwI-3KWzCtcGBoHkSv_8Gev2qIOLVLt661BzGe6B1xRK4Z1r3FYVJxC7oDyLU4wL0ENyn4yNS9bfYb4pBPzw0LmpeEKlXopPWT329czg8LT6VSFJu7tWesjW5o7hBlwvbS91d58A-3HV2SC7EqX8aOjvkqHrcPuhZF9gLy0Lhkm8Xh-TzHeJ_17rGQvnJTxtwvFDrZe0yduElmC09rgf2xx1AnWUFi0IGo1svsca_b6zwEEBKlhe3AZRs0qZ01A1OGq_9ApnAdL2K259IxRht1VSRIBAor_koGuNe04gmL6ZAGeIxxMi3_ErwPu1YYtdi23UE48BeH6htk1ZnAKhVRExj9fLDMpDVSouAsL-uwa1MPXh97uNPICarUl5HSqzwL1fMFP1lzUB4k5qDilzn9CWJ0jxkHB3xBRWTCnBTGnQ5d5ViNeOd2MbDSnBw9FkkloVdf5RiJjd1KLdEKzGQvJkJjXYck0fG3TmQ-ZlAOkVM5hZ_LFy2fEqjKyYv3LuMfG1lItVU-fNjzEJ1THtTboa3NGSVuN1P1ywzHg1xeBi8qZbjch2rmR0U9mTDBUOXHMAK5ZHORsX3VUBNpsDnQlw5eTngogOYLyt-xLlr4kLxk0JJu_O2J5zEma4gsfm_ippkYh23Rjd6pOLsOr-F_IGY2ExuqmZF1BEz0kufdrJWIBxeUa4ddP3PmQJWFSXkVX60YX4qoQCYL2vKZAeX122RyAU3x_Z8XPu-Mp9on5AGZoIxkwDLyf9hZNDBdRDutc3GTJ-mWbJSRtS9zlMQjlKsvNF9yd1KLXbUxfTGkNTUIqoUUlw0IPQN7nm2UCQpsyosPWDPQUZa4bi6ZaJegMVP35pCZnZ52-ieZ3DRCpyLWb3qaXQ7kofMfhoFNtG35S5POHhSJH7-h46VNFA22rsENixdxcDsUsq7e81b4jbOSQsiHjuhhW5qGNmKCccLm0yDE2eInFhmOHjUigQmtBunWZ3Nq0jPlt3TogdWgCy3t6ps1JkJunJx6e2i4SPyz0Q9JxNevyUuDEZnko15FxX6_AsgrzfUPzpeVSRG98Nb3guYnPxyFp265GeklnaOdOiOtg7xYe1G2BzI-GEuV3sMqSi1MTK-iZbi6enVVzt-AHrziQTFH_QP5WqDumGKE42KU3ULoURjifyQZJTt26av2Xy5O6Rk5MT2rsY_OBKvvm70OMMUqhvWXvH-bkow6CAUpOav_f7Oe_vNL4ptdqCd4EQ6SlRJm-MXitmJl-DfRYThsmOwoxkDqVjG-S4Fv9T05CPMVd5vVD5xiFCbw4kkAwBCeMW8CXJ0OcWImEANS39DYqaBMnPhSF2tHwgwqIf9Xz6TOMyz-35rxEB1k4skOqp7qGNgMosgyLpd6EaMmMWF1gNPaObrL7eFCKZsWVlaJSfweHveI51qd6V6WlxofMWZb6CPTLGdc00_RHDmm-XtB9Ai0bUU5UQOVkJXUUVEBWYr4bMP1L_7c7bpSdjQMPIXmIXCtmUWj4jaymItei3tEEmuuqc7X-TJjrsG298USDIV_gdGAx9Wtyni83RrcYQ47IFXBQgkCWdeIV7g23aCuk5qvuKj1IQ8V4j7oK8Ksx02YD-K8Dx3O1zCcV-cgkCBuvk7QQICRyNhRkV9QHP7B4Gz-sf_lzKmteG7VUf7FIo_TdGMQ8irl5NsOlCdfgmhqLdHZO2tBInA7daAId7a_vl8sdtzK4q_7twz7DvguwgzRRf_3ALE26FQhx4VECpqLr4qBvCI0S-sIne7lbx6DPiPEEEbEHyBlCYl-pPlL0QZxRWYvq7ModBoFrPzLqChsCIhn-qvrXSio9qBa9R5bCWqrjhj27eWBDW7_4lD1Y&cid=CAQSOwBygQiDQLFXF4jb__tY04QkpA1AcTf_kx2eS7F-FpgDShwTIxXc9scRbx8Jnw89_zrgaBOFYWCnIZxsGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=17832661756419645000&adk=578009112&idt=241&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b9447c10fa7795be637e9f5a86bf2da27655d5b21e23f9042e68f5bcd70d295c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1D20 0
20 B 75ms
75ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8639348902591&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1D20 0
20 B 76ms
75ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8639348902591&version=m202301230201&ct=76&x=1&cor=16898412597196448000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 1D20 85 KB
36 KB 125ms
125ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CirZx9yuIMx_XHv1G-SdLGd647wVsjobzaJAndThprmlEKC5IlGIBywkAeMRmk5wWW1p2rL74c1AY83wbKIyvKVXX5BumqZuPQTE5s9X_UJP8noxETvJApY95mSVoE0dUpGVXg3mGh4YBnR5MtNwTx6xWvePh-G80pBBh-RJZuq8_ZfLo&dbm_d=AKAmf-A66DQzf2GkkLcecDqLOJvRzUN1YVgfjO72Y3nw3g9sfuDJD13ddpFPS8HdLNsvprWVFwJ2V2hqQjS8_QfL_IGqrVpat9AEZQbOz-_786sqK6lOiI6d3MFXFL9jeILMtx-S-wjpqNQ0xkwVFQRZdd_9xmyqixPXT9W8QqOyUFeeFAFkB-83iWuw0wIj0v-mynjxkcbngGWGY4XV9nvjIWpDhFOGapV6v6Ng-Itb1eq0NVGNguSfiUKpwSmQo526x13QnG6ewVHRTiXtTv9rg0OILPtAcswuctbV1JOZ2Jljp7OZIaE39t6VwWQKGB0JPTc55cqbQR4paa9hMC_l4RpPQM5a1U7eMThdt7sYi2ZxaH6Y3sWuuQr2qn3sfsCvMRxe03gWQdTrNY-qfTLIPEL-VBRmxRZwwl33JO2sazk7GvT7BLuC_XahcZqKS0KmDb7Rf2NPAq4FJ6MlJFKmrttfjjNelZnYXBM0AIYiaqFvyOhijoO5Va1_BafPHnEI5oJegeOmAf2IQ4-lF12OOPO2i1_9F5UQLgrVUd5Z8R6rXVkJLY08F6ZwdaqbL838i88wOOPUva62hQfN_FxAeSPQmRDtv7fZUYiULHS8qyNmLf0xrjc9hftJ_tBz4AynTnQOIlz1n437nd58Aivhlmohsss2hy1kKeLrVTfyZ28majbBpyVhZHuf2NkEJf15rjfIIb8DLb6EKLXlBOOXTqSbffoA5iMcV_V4EmTN8UNBlrguEaprtGzG3F9doFtldNqnf_S8rwAYOHlACySIp6bsJCIQr_BRctUR-Rngzy7QtzHKBCRy8UdwtiABJX2kR0d-jPUQah6JdMkDeRfpy7MCWGCIEV0PiA89PrXJWgsjb9hux0umxH0Nj_WdHaEpnR2YQCTCyKRhD_uyjIH2pX3jWBdLNfpOdZLXcDIbME056YMINRRVjhsWhKCnGcxljzi9ETdwSiKv9RapvkFZqzOnRzR7IgOoKv0kleGjPe1uqh4MQ4iDEyIh7G8YSFrlBYXPX1ojBRAufZnrqeBqWpAitQVYFKrQ4HlMFYnlBkO8AZAAfLLW_mjVF_GhwKWythUk0Zg4LRtPEMyBaGJnKP6qALWfB1nAgohPbXVjsi6AWm3TShrbBaimf-riM_5Y3T8Wcv6XmPHu5eJFmkJB8hN9a_mnDrt_iL8v3TIrXQdEW2LeIa7xyMVklZ4Fzm6RNtgUvSo44IFbjqkgVNASC-_yu4ue06eel8Ng7rnZpF7KrH4FovX-Qkk4sQOCiXv7dl6yoVqca5xufDIWCdWg-_UCgCvs6on4L6lwVeQpNbHyWrm8DbpX57-1r99v60b17y7vUrFk_JZLBTAthvydIOYA3KvO-mvO_9OvPRS9dR5GvBuAe5Ea4W--7K7SE0WLypxrTj3Agbpxk6C33yqupsOO405oNcdom4vSjRxE26Xwor76cWm5krYqlMVzeKhqN-i399cCPWHIYCaEJ_06A7v76niYqGTnbLwwKfP3zuSfGCtsOLSUURR_etCHeecZNPJQrXgMi1B3bI26-RovDXO8hGT4fQ3Hh4cnJvrADYXecVvJ_veQe1VVou_5VdzyUhjlISv4EqV7Y8owwSDgzAxp-csVPV97lJIyQekSEVqhkfMvTtpmI9adLUSzs5euD5Gk63UB18CYW0fj3VGnEstS7TpK4R_urQE61qyiFnjxyTgwwsmUraaAYR8XLbzHhFMu3ZH9fzhzn4LF8uEa7VHwxZbyLhUoTZx_nTrzT2SVonv5Ybgh3vxW5vPzGsERaGa3v5vOyvBxy9A53z5ZLJVXjHEipL2ecW1hQoYsaJ_EFZLS5Q7d8mK5chve-4I-YS6yF4RA0-E48gr3bkTOPDD2Si0eUEAWrPSpjU9DEHyI9eP2qm770Jh7b9yZsLbjb2bOf78Hi_BLlf_0le_PWGW0iURHwagjHyf529VZJI0hthvVPhFct00WE2URosjeL_-m4NiUmUXDm299FvRF89PgUZFRVXYDQenzr35uadwxZ47saESUnDGPEnhouonVjCvyOdSkGpTTd7SMQ5xNrEFtrXoTKbBjC6ZmefqtHC9et5zHEo-grD-gTJk_Sjr9-zPDOSfcEF_ut7_YfdZiy7Za5XoPL5yJt-RozLVNQXEQR-BCjKhRQG1KY_-_2ZEI63fOFddkI6OD2RanDtRv6DJec8ARrdrsDEOfyb6oyvxHX9MLOia1ZTKnEPzbBPrrfMNKhTuu2zlbYWRfBbyn5fxWIv_J1nQOFmrdGMHc_Rfg37t-HYfrHkqXooiy_nHX8podvVwb1ZWAbWUq6lzHghE2pms_qKi9TLeLBZstxlzA0FS_DZIj-pNbE1H4ZaJea-OoGekxI3uG9c7n3OMQlDwd003M7_Li24L8IR0sGqCj9nN1PLAKCVabzpcUzKpSAHc6m39EVF-FaJEQKq0LKvwqe7UUp9-GYqZJcP7FvKe5_8_PIBPYSw3ILuxikPq2jHmI74S-hTm2V9w_dTD7JY_RDbGMdV58OazzdXYfrY4A5BIQUfOtZqaX_n_QG9ZmpYx13BhtGEUgU6pa1VAVZjhQV-rjinj8vEoPGDzdGAr5_R_9Q6wNK5a6kOh0LvK2A8h9_Z1cuOaAotnbqfamTSPndNlUAIWmx6-FMEE40YaFCpbIvINleQANLck__VAGxo-O8hBerekCQwQp2FuaTAtuYvAe6YaWE5W6cHBXbJ3p23wKuOcO3SwjsT6tbkuuQPpqXGC-j2ZOavui5ZzWTBkaolGfGfvEVvZLo5JCWOFD9A7TY6Ewq9sz9C3W62r4ZH27TNHISDxpve_1BjGZ2v2UFrZvCDu1qufJxdTSORkTZPKh55js6Ia3mVEJkuxQxoiNfucTji3GM9F4-PrhuFiqK4JFDLQey3uN58rqOCj81lnBYUb1BU35B5laSfn1TTliwjTpFYgfQzV47co5bfAD3S8Ag3reEim3yKmL9uk4FH-VOh17yAGCpssXhXm2PVIcGUxixjjs1AT7QrNBFBQhibJbubF1GGIbIrJs6TTNvAEWq3ikqixDNYqRfDWIr-cUZeLN8V50LUgutF9mEdPDtbM2VBszffB6n6MlTI4TTnQFkw7ZtLocOfsCiZaccX994YJtbHM0gEMTXs6OQCkc9KfhOH7w3rjN92lbmShHJWRNRWhfGdajnqB-lQg8xSShajyRfPJ0M1NYpVmwU-FiYbxpVmvptxscOQnypRxekfd4cUC15d1omd6Mg0rMLghBTHJ7GDxAkSFsVFl0gjVPlET0D7mnLObgDLBFlz23CuCoDSlCa_LgYd1c_6HPFIbqUWh1d3x0rjuhfRT8WtsXw6j6xcoDCWn2v5GYr9bw_fK-JRtu0t4B4LZX_5SdMz3QyDRSpL5zYREmOnKoOYEWwFNdQ047D5njMXsPRMrxyatS221ABBmkqo4XF-WnT9RvFN1u&cid=CAQSOwBygQiDDO_v8Zm3E6NwD_ic-xxUVykY_ApD7IYBd3hy4JeNwi_vrtjowFcJSJHO4jB5MvcgEL_g6O-wGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=16898412597196448000&adk=212707235&idt=254&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f1ec94cb428ee627a319cc1bebef6a2b3777a2c82fa31e7b10883cd39ed3432d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36435
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/ Frame 670F 29 KB
11 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DzYQi0NkbSnPY6PM_UtL_n8YMKA8Zb4ZLe-Se-1I7pwVeL1Qpj2CTehSQU9i6B7ve5A50uWrzGLQbvpnqekmJYzL_DgQ&cry=1&dbm_d=AKAmf-DLtJmiDrtKHTTaw-oCFopyU6morJKg9-GkvJZh5-qpaViinLG4a0bZvCrih0a7oKJl7Ieauge5kOTbUd3HWwueslbXetDj9f6iaL8hk6cc97CmxyG10xeAOf6SGWvVT_PZ-wdJJJZwj3ERr8oWq4m9pAQ4rsRp4P7Ug4vnMGqcne94R6B0Yi-rmYmSfIcydWfMgyA7gggPme9ZqnUn_zQ3QGi8a6FYhnKB70B_1Meo_z9VKKAa2o_R4zQySLR8PTksRXrrW0a3RTtQLY9uZAZvQ4OumZIJnW_ywjQkssNYud2YZbFQQuyv20yvkd1-T3iW_JqjR-DSTf5tbW8wRUpeC_u7IzwTiZihGZCYHunvA7_LYwU57eGzDX3Dpp_mdbItPgY1Z7rWLCiazU8I27uAR9wKgt9Rq28BYxghOgNJtPXz9jdfDpV1LfgwStlUeWDm0T1a-pHTdy2d1Z9T32AN_uiOlFRHAq_2KjjHo8FGlK8bHtV-kuav327QJcEqbWPEOxOcw0TsSywjDwp2ImsjHBuDWk1sHKM0ktVxQlfX3E7vGnMuJv2DQSFmRywrzjR98DxpaYSea-f6WwbJGv-q0u5wyfnkQ95Gyg42MDSDddU7Bj7q-H6ScfK6zGOzl04FTG2vIxt8H2aXIew5DVRboMPW0E6r-qY41A08xKjkkTTeJBxCke2UaNRPeZn5w5DkYcMwpfeoAhJTaq71pvXTqfnrUfy1hb3gKRCMuN0ghXzHoJzgmnFj6PtuRNCcxZSi6YADkQhBzPtZlUwSs8QD2cSquZZ1NBD3XFPTLo-NKURgyfowS8W9aVYNn3axQpEb_GjY8LQDgKC1U0rt6waXEe12Msvo1udtlU0hwkgFWJ_fYROnN_ByttTy-daSA4LN6bWNcsJYBCotBs02hmrYBSvoPPxGEh5-nDWuUa3VYiJc-TYdForjBcturBZ1aC46GiHJX72ltD20fOe4QAWMtRslHYo0PQM01g4Y4i9VCNVmO_jCzXmxmHsobSaw4Zv5fb_pzcy8URETZP4elBhf8mw9NLFNIyKsKFKGyAVQtPE-K0YhsAs05kUnWDwXrsqD_XxC0LKNs0Siko3tzuSOurEdx5vC8ZOr0tYn2kqMkH4nF_RRJKzI39ZnGI1gnlaFX9Ozp6AHqgW6xd6FiyH7TeOp4Z56Uqz9h7ybTS4bJ7tAjW_ZGd8K_xpQTZcf5nX3DvbTpekEcF2bZwyI6ThN9U6uEYGWBQOUN4EiG2nF7mgUeA_GSslEDFLfWNK03BEICUHq0hsXAN_xP4GwgcT0hpUv1W0ii-ZDVSLZWYPunOAcN5w13wcXhg886-bo0RXC-v78ad9zlTduwd305zrRblVbUQOwrElp5LkEQ6kkUd2pCv_iyhHy8qAsp80IsgkFFnpbS-jHHEmjaMDu-fs7R2RT1hMrQUqr3mgcqd-yH95i69vhUKJ9oqQx3vfjbvbSY3zIdqA1y6YAZxSDk9S7jVn-erC8asFOqRn3jcshIaVay9NivnB7X7SjKBJRis6YY8DXsxkvfwR28fYqFEAvkDSosMAunknBYhJwGwknMuhpP4V6JMOq4J1Uyvc0Q7GCnatid6fGgJ6das9B-fRywY8FErf9kF0LzpsniASrwt12BCI8_tP7K7Cq4hqUhL0WeXUBtv3_cIf2TvP8S2tSXW4hNLK42kp3gNfqpLqbKqRSeMLlw4I1-CeG_hnVHdHjKdbt1LUtpZOHk3liunS2T2HECLLvDwEP004EsIPvE3RaR7Z97uNCg7BQft2C7yCKRhqjuGFvLzhVjQQlo01mW-szW-AeDG5mFUBSyQ0iDUgFHeRKTy2pLDqYO1-sMPDwWI8nvJRByjp-DBjxog3TD6q2fMGhI02ulj8rZxyNXgNa1YL38Kl0aDnaQtuQM-9hVGGcsxyH7hgAFo8uilSBmR-dO_6xHYR7c0G5AcprcjZrSVpWbJgwbRqyJXsfR6BnXxyGfXPo0fCBLJCm6-25H7-Gf-Scgp0iTFmGz9NMg-hNr8AN1tlNhV_CycwwvjAv6ZcVD9uazcN2T-NN1TzYBh2CZCCRzndLUaGfWQ2bDL12mMpM1yzYkuVnQIbiAYSUcIBqZvUUdrBHfAXbQ9udlPlj59dcdPLWC6qKOIcDcTbZRH_n1eMafnJWWf9AZly9ZBMAhaFQ23B95qNbhDei3t3ZKo3faRBY3MQvXteC81yOE6wYVcXOElZ96ofUFiKInhbkpgCWFP_VHZOVK5J2q3EZCrYLXDvLPA9OCC1F8_FeKiMvwH9iREwzLbJeNnmw_lU_Ofb-NC10cdCJ8wReocGqHUO6vzXxvh0kp_iN_4okDcIDehktf8jcitttFQfwO2EJCu7StWgMkvyrC9By9lYbN6_7kIIKSqnILoH5oQg65L22s9GCN800YKXP2k8TeBFKIX8muYDg2_E5QLiOulSc3mvmQY--KEK62j-vS0DN4zIvN36aGnW7H3iwxpSiIkbSB5RPhls_-n8jpPzEqXnV85hBIcrzqaWsYbwS09XjUyNhBdj4fOioU4YsePFzGtRzjLDQ6nZux4yCRZcS1GAuQ1kvCQvxC5WUt68HZPSj6unMHT5BMuaImqva6hO0G2nx9QGQAHWSuU6aIrByagpwhimjP71nyk0aTdb4zOcgmn8BY4sjVSUCDAYEf9aSzZRwK16qFZTzFcLSUX-yiTOVdCpCH2-nskl6gtDMMz2Ir44qB-bt5skz62sV-6d_cnMGqGenQx8rcoTVSoJEHUBHFMHHT47Or64czzHbwrgydfQouTRctIJwb4YQtaW-mmEndUjqMFCFxYnBQwolP2UYpM46BonClrllU2ZLo7oZAxUyfqCmCiDtRUN6C7_0bp4RWSXNAx54Gh5XqrEpGhNirRI_syS91RgJm_YYj3PmiAlxXnHT5Q1soxxW5nJ2OHBHyWrPsxd-K3pJSWogbxt5TH9Yo4vNKjp132LQxOyNhXugSw5SkWlu2IDiwt3fPTdEiEnpu3-LYPFL9NhW3Qk6Btx3Dt5qKu--huTxBVVPuslaZ7IszFlsr1ibJeVXxpuXoKXAoFXHFMUURBsSQHjOHcZr-LsxCBO3J8broMGVE_XXyQHtKs5k7EXoi7ktNWPjTDp3nSL-F0jUzMYhRwWuCyf6JwCej38o7X8zaJqrM-xfMUGyx-CdoBUj2E9ix7vq9ik716ETf3B9DeU2VT3isbjzaJKmDpGueSyEdqKP5KcDtNxYdO95STl6DHMZv4Xttpukza7mLOAq1LQHdHZNPYFdRFn2LCsKir3TOTGa8OWu02IoV4cVu4PPrM6IDi8sdMKNn1lwn0a0bVQ5LCy-TW7UnZLMI0LT10tpQzaCP70-42EStNvMXwJ68mjXfd8d9KtYpvuDV90BSZR8QEMFXBGQhpLXsrTKy-YFFQYh7g26XaIq18UVGPeAYYMpwvr_vqzyuEoAVbeQHUrXC7VLK9Zr0iSZ3U-esP4L7NyeT4H0t-mzzkVJd7iPOm3CXL3CP4C3jdcBYcd5x4ooV45-WLAAWWjjsQKvXeOKgBCg6SxkXPs89_dgOqsZYIiwa_vft1BRycfcN9s5PH3kW9fCgZ-6Z5FvLemS14I6-SV79Hw&cid=CAQSbQBygQiDXosOyxUu_15iJb7m5QnirBFomuSqSWWnCokeyU3byyD0Y6oWpN-5vk-HQl0tNAZxOgyHn58zQGCUJ01HLa9IsOb_kMY6kn3-AW3wCC9XVE8yEwrHvIy_EB0OwQs5Jxg6omFcr5THFqMYAQ&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=7516560276911854000&adk=2465470143&idt=136&cac=0&dtd=27

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 21:03:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6095
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 21:03:39 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/elements/html/ Frame 670F 11 KB
4 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 14:15:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30603
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 14:15:11 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 670F 0
0 86ms
86ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstwz1ZE7w78J4sZGj3dlXyD5BqTJKogL8P7t3cHOlU2WohXT4fqJBJlbbbKk8RDwbZhYPZgcOKXujmyvUIEh0sqbsxVsBEOqstIX417g7z82sqRO1N3yIEu4nfeOn8lLCewXuSOd79huIcv2sqI5Zkk7QSxiWlEba16Kw9M7WY8bP9cUh9yLfLLHEyFxOVnQbOwFH3Me_9eLlScC91duLrn4JoCFsw9UNGlrHm65SCZ1mz3hJrji4nfqBpiuTgQGiFkyRU8L39os6DjilH8Q0UlVyC1G3uTLuJlWbQ1m7OAJrzWHkesdnMdufEejkXmUaiN-09FIFBLKThHRiPk6_dz8hKG29X5EnfWxGfEFQSsQL-WKrHidwteaI9N5MMDoJMRpfF3E3je8XIGoN3IT0xVdVG4BovZPK5tMsuLa2Py24BDitoaDMslYAYBdXukAD7iIk-y2zF9JOaqiTZm3hhehZes6CVDTobc8MjtUMrydjGnoYO10wmEW5FR_PDTxTrognkFJ6cAT2-i6-CoTwU4ZbEaUp3rrfZwJfAVYX9JjLNaDhf2RhyCycv4YzpjWn7pq7ywmm3jpVEedzMKLecaMsjK8lEgE6HOrqnfl7xDsojw6Aes083VeI-qoqDOaaRUBGSZKIYODFeUVXE0BrGm8hA8LswHWhyBLp3uu0vfdTNl5g5VS67maitEVuOdQcKwpiMM4fhJBS6BbHLstzDuQxwmeThInIN7G6ViCENId_fXuoyueWNpLXn_Mxtbvh7zMQs7W78rTTT3WxVmd0UTIHAO1TVu0-84716SHrg_6GAcJO3WWi3_HuP_NO-IbDmC-6VD-7X4TEGNYYyEUlhzVB6IK-skj2ETGI3AmivrTB7zNjq0s4n1wOG3ZZUAA_S7ssRhXX82Un9z_YQgK7DKri_HwsucN-eBDvEKt3U_c2F068R3-A7_XzDB8WwigkKvSWNWuECDBtvlMduFPKU8K-ilZZOJ28Hcv5Dklu2hPdGLYYj9PgRKDeZwoRMAWve2o-maRZjLLaICMrxKoIBiOnS_C1XTJqg2ehEAuWI_NeGhW4OxVprkellYqOWoq5VAMZO67zeEGxNYchUJl1xUIs6Swxe4XGcWDt8QYjEkJIA1uZQAxJVMSwqXJlOiuhyZgl1fxNnLkdgS3WeDGN5q73LlBR3-RQihxRuBt1JNCMAEEp2dnPYSstbjzfnsNOCkTyT8n5iqHADackgMXp1yX7DpbkZ1G5WGwZU88roi0dtfX89hNKrJXZM&sai=AMfl-YTYx74dvR3Gsx4J8HL4ELqhx2wi_8ySn7EaD5NP_CGd6Zyvlsv2srqiGtS9sNNtr9pI_HDc1JXfMsrnM-2rQN_Fc6IBGIpxSGdRyg3BemiV3nj9WFq8u2UtJX6QdHch9YOF2mPbobenqhfMXgLxSZlwjoVmvVljnOcFBrg7A5eP2hzq-J2319Wg72r7e5vFFNZID1jq6nteJIAPqHtbpegjF3ZAMf_DjMHsV2X9GM1U7S9SDrGG2ekncgq3c8Y3uJ1mvTxmrfNamRTcJrHln2nMtH_6cs6wKzoMV5xI525f4pbyG7KBOZxP1tPZsizbqXtb7feFf7w306slAtT-5-Nm3UxCsypVhIM&sig=Cg0ArKJSzNXLe3q9SiV6EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20230531.24772&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 670F 41 KB
15 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 572741
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
H3 200 10984130257656708060
s0.2mdn.net/simgad/ Frame 670F 75 KB
75 KB 48ms
48ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10984130257656708060

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91b2486b9732235b02c739cc094913550d2f94e000756c3eaa4b445c82d8eb67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 03:09:31 GMT
x-content-type-options: nosniff
age: 243343
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76907
x-xss-protection: 0
last-modified: Fri, 19 May 2023 10:52:10 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 03:09:31 GMT

GET
DATA 200
OK truncated
/ Frame 670F 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c4dcfc09edcc2963042fe81603a26f726adf876dce6b0763493da92757d96fae

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 083D 170 KB
59 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Origin: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 07:18:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 55588
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60311
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 06 Jun 2023 07:18:46 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/elements/html/ Frame 083D 11 KB
4 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ajrjd_Y57IDUYT-KKvoDXA_ykDZzDW2FRDPCcSgwx2OCgYh6w-k54SmOkc4onFuTkYeH5srI5YBc_BlQiNIlSDPEsyhuSxXzQnj4Z_HJ8DHhBE0BHzNiwIOReu86KRkzN6ZWwG1AAGPLaO_0QTw5Bdtl_Rv7zLTqBMzx4md9qfx7h7n7Q&dbm_d=AKAmf-A5cJ7gNRWJTrmjnHcxyEHt-NumWyZbQ8x9whQCpVBVGi0acMuchwEQP_SalIsTs__D6PK-aawtjN9xYUGkiL_FQVjOcrkFJJcbepwblC06qQ74yl83z5DmcF8Hti7-xibvnzORLJKLWAnYfVNTBW1rbjk5cGr_ltGMhVk7d4aOhCkuU-QB_3Deh6uQho65JD14NGELsvDLe8tw2iEctwPtHWSn9taoUXU8BLdptZFWTv3qUEeDQ5rK7H8rADVJuwbN16R-mxYZwEH5Z3WJWwRZfQZcW6Yb2qfds9RQ429xgyrVFvcP1n8uHlupMUfij7eF-aaMKeg6T-n68d_0yQALCBLj6XOLPpW5u0NdTTl2S6VAtNr98QtTCHgFkaxzY7OLg19wlBQKvz9_2pfdvnqopVbBYpPfUNZWDLgL6dFLVfepI3XmwwMGj7GEAESBh-nbYQjgIyGw36fl0jPr8v3mf_Bq8wjbLByCAO7xcrq4pR4kQvKzkwYQ02U_IY98SB3LvVY3dgODb0xgZH9JzNyKpAz_VKGCK7bkj6gc5MuvbMS2LiWICMhDwRoAuRmRMEGdJ_SRUsjXjfnn1pMqrYycCio3BxvAQ_iNwJ7Fo3qn1x0fFXl1o3I-lW9HLyDaNf66mwOgZ-qdkRko6WcZ7BpoKz6K_ElJMkuKNa401bYhsmZEGxv9p065PR92uuiAnp94zgS45HeSl3lvFOeXVoOv970x6RDy5_2p7iTFxNPsjh7kX7O5KbIOHXji11pU7w7aQ7pHRtD3NkAEvGsKNh4WaBiQJ95geob_QpNVPnKEr6fJyMi_wfXRhlF6sFeNKUA7rkgk6LoGNeMC2yxHv9jH8P0HywHGi4RUQVPys1BR19i3mAD5uQutwvCWFnzrjTJSQr9mCtneHhDv3ZQekzFuu2nclC8hDMNBwMoVzAzsDWlcGboDSGfNqMOpIn7ruhFpAioC9aFA5oWcpITtOS6oZGyvlkX4_CHqZbwH5Q0qfeVzrgMf18XcowD-LpYlIvmJ9PoTv4XTCd8L0q2YblFYs3vv73taAtlKWA5scwlurIwT5aC1FIOz7p09RavbnYAzCqTHRFcl7_xcehggUgSQfz9ChRuXc80X1cedfbMJwuP602r2Wa3-ms6Mg7-0PmyTt66WmbJ49Wav3LFhgC2a0xIcwn9tMBz0ekCqc9N8gHDlENTCmwjgpUhNj7tbR8vpAAYUxX3lbOMWsVc-tCLA_pK9bxBvStiO5WKDjNbgSVNDTtQARnczxgaKxpj24KT3vlhbU6No0Z7Y98BAjPlcDA6X933zVt_pDnPFjwuYv0hSF6AzF-x3lMt71Tj0c2V1ELOgjwbTenZDj7QVMvk51QwffTU8BHG4Aofru-HXKH1xpT421RkVkkRV4s1IDUyuqqYDUT-psvcQHV9KXUJmgfWg8OHK3SA0Vh05wtHjtYLPJ2gT_1j8dfhwczKwdl8qaUUkKqqxW0WEyGlCcOS1JznwpPQTv-NY7YigpZ9OxSCMj4kvo1yqH5mGUeJO9mUi5SNXukgqxCaEPe9DzyJbMus9wPIz9SfEocBLV24zS5CzWc95PB8Xb6jAsUfSEFHTQfeYqkw-dzvbhHNORJ6fKZJdN5KkRz5R544_8I5vamhxKYQ3AfImP-S7en7A7ESHbLOkV7Aii_qM4W6hkikTuGQc4jjCmje6q_UErzzMIBXmRVXHhYH6PIG6bIxhOz1o2LuKHIBf0p0l-LVMTH-IF8Hi5dJNH2bbo8LZfDVyTFM8Ab2M7HOPicRliu8xBdAvHMOJaTDH1zRyJAJuTbGPptveHYS0izsbIieLUDWG4w0ZUHs3aQVW9S5fTIx4_eCMJvSC7SkvsQeMZmdfE6p6SROIRfBEB3gK2EOu0vVi5hYoYcs03_2S1zNdQAA6wfbcyPhKWy9l5-o3hXwpfrq5a6I07GqP1F6s4VyvUMP8rk52Vr6p0rJ_qOqlRu95s06_HBMGa15Y1RrXZc6F-6fT7bFH4Lj44wW3Dcxhqu0P_NOQ2pXHNtmzEuCgg9ccuRVR2b4daUuQPq8ShNZdzNItqEpfC0RobqndA9L5cPZkq6vP54w-EeNb691lX3RHpetMDh7zVZiovkioK6lSmnC19hfKz2d6EWY1RUWHWSDokTYZ0ZMXOLVmFJZk13bnglVdGqDa3ODS0iFJpp51GJCKmaFxuj1nW4a-uEtBoJGsiCywjiJwo_Kxa7raWANtMrsYewSsE6rhfHoues5po3ofeyqb4WBzbU2BD5AjxktCfuOkwbek3jUfIiraLFE_YWiQqFZr9Zpy_NlRGo-QNmzy5ofQ71e6EJ3EDsUBW8rAQjdoJeHk5TnKfCgH9fySTbp3emIJlznC3kPJNtstQqUJ9AtqeS3Iu_tBJna6ZrzSz0nrmUs-We9v1YLfABOrBUS-5t51GVdE03Lr1cLLzjXMVarhU2WdjoohTD893ZOnw5NenhV4EtJK8nvDmvMKTMB4mEO6IEFziU3HXX-vU1BVdzy2kwt3X6jGQSn022I23ZDMN5Gr1GeGRjoTLaqeT4Dp_eW9Y-4SbDeneLwVma4zHF_pq9oAC2RgHk31VNkLSnJGjXeYD7Ba4_MAGPrDnIj3tAfuupAFJihamdtbOfkAR60GVHIwEFqk0ulBKQSRVonbpJGJPUIojxgtiz8d5zNxa5bchGD1-m6knlosftMHERUfoV3qLoKxzxLp3T3C0hfUkgkdo145HVqotSiyc5MXSCXUII1_MQC11VJ8QASXVOGH29BMp_jrM3MV2MPY05vm9hs_hupa5biu7ILxHy6EfVRKSqRYSLzOEVQkBc_-6AGdrKs_Us1y6NxbVq-gtsVLQUxNzyx5BH70XqOGBw_Atfd6hUvbnwvmUcxL_mK8HE3a8OMBOESiqxX3IbduCrG0QExapZvwGuI4W-RDJ83nbN1j0jzf6XelODulMrWWF9R0W98aKMFpbusCT1lJJ7GADMFfeiyK1Utgj8LqfJApVcRxH2sHNfFeTMvELcv6rOnbHgbnpk_CaJxfMTPQu1yHmyt4ci0ErbISuZUWCaTtVuFfv6fL8glnxnWuDcYA12wzly1B0ANP-frbquUrp0e80OFANxA7mzYyDrj6jRWOIJXb-i1ZAxcmHjY8tYfUNzpK4IzzPl9ijcbsLczMvVBNv4AeoDl6hDnOJ3OThYXiVXhz09Hj3Oay9rwB8xaPr_DsDmuNzDzK6TCWdB2uFT9LVUWtyTMUmdwszI7uqUBHoBE3InxHsTHaYNNTFlucMQLqVMHigHSCfEJDKOddeJBF3oaqQZ1e2b5-Q39OxHLse1x3k1fD_fE4e4Qu_f0KHfb9fYsfqZbuxH06h7ObDdyFZER4x6LidyrGb9bp33izr-_hEL5XDkhfjuno9MszTeovfD7_Ltvvj1RZX5mVTKlOnojAVwasXnd4T_vFMsmp0jC8&cid=CAQSOwBygQiDg0Jb9DWp-KhguwD6poWyFGq8KU9LPRxJTmi5FMk-2cSF7Ma4h_IGoYiv7jqit8GvKVbArnizGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=18372249592536396000&adk=3587751834&idt=207&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 14:15:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30603
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 14:15:11 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/ Frame 083D 29 KB
11 KB 43ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 21:03:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6095
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 21:03:39 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 083D 41 KB
15 KB 43ms
40ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 572741
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8909 1 KB
643 B 40ms
40ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 16203
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 18:15:11 GMT
etag: 48472445140208031
expires: Tue, 06 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 083D 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f984a5922f614fdfe7d8f540b8397f70c8734ecb11e6aa6d0db6c38f70c893fc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 670F 0
0 78ms
78ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstwz1ZE7w78J4sZGj3dlXyD5BqTJKogL8P7t3cHOlU2WohXT4fqJBJlbbbKk8RDwbZhYPZgcOKXujmyvUIEh0sqbsxVsBEOqstIX417g7z82sqRO1N3yIEu4nfeOn8lLCewXuSOd79huIcv2sqI5Zkk7QSxiWlEba16Kw9M7WY8bP9cUh9yLfLLHEyFxOVnQbOwFH3Me_9eLlScC91duLrn4JoCFsw9UNGlrHm65SCZ1mz3hJrji4nfqBpiuTgQGiFkyRU8L39os6DjilH8Q0UlVyC1G3uTLuJlWbQ1m7OAJrzWHkesdnMdufEejkXmUaiN-09FIFBLKThHRiPk6_dz8hKG29X5EnfWxGfEFQSsQL-WKrHidwteaI9N5MMDoJMRpfF3E3je8XIGoN3IT0xVdVG4BovZPK5tMsuLa2Py24BDitoaDMslYAYBdXukAD7iIk-y2zF9JOaqiTZm3hhehZes6CVDTobc8MjtUMrydjGnoYO10wmEW5FR_PDTxTrognkFJ6cAT2-i6-CoTwU4ZbEaUp3rrfZwJfAVYX9JjLNaDhf2RhyCycv4YzpjWn7pq7ywmm3jpVEedzMKLecaMsjK8lEgE6HOrqnfl7xDsojw6Aes083VeI-qoqDOaaRUBGSZKIYODFeUVXE0BrGm8hA8LswHWhyBLp3uu0vfdTNl5g5VS67maitEVuOdQcKwpiMM4fhJBS6BbHLstzDuQxwmeThInIN7G6ViCENId_fXuoyueWNpLXn_Mxtbvh7zMQs7W78rTTT3WxVmd0UTIHAO1TVu0-84716SHrg_6GAcJO3WWi3_HuP_NO-IbDmC-6VD-7X4TEGNYYyEUlhzVB6IK-skj2ETGI3AmivrTB7zNjq0s4n1wOG3ZZUAA_S7ssRhXX82Un9z_YQgK7DKri_HwsucN-eBDvEKt3U_c2F068R3-A7_XzDB8WwigkKvSWNWuECDBtvlMduFPKU8K-ilZZOJ28Hcv5Dklu2hPdGLYYj9PgRKDeZwoRMAWve2o-maRZjLLaICMrxKoIBiOnS_C1XTJqg2ehEAuWI_NeGhW4OxVprkellYqOWoq5VAMZO67zeEGxNYchUJl1xUIs6Swxe4XGcWDt8QYjEkJIA1uZQAxJVMSwqXJlOiuhyZgl1fxNnLkdgS3WeDGN5q73LlBR3-RQihxRuBt1JNCMAEEp2dnPYSstbjzfnsNOCkTyT8n5iqHADackgMXp1yX7DpbkZ1G5WGwZU88roi0dtfX89hNKrJXZM&sai=AMfl-YTYx74dvR3Gsx4J8HL4ELqhx2wi_8ySn7EaD5NP_CGd6Zyvlsv2srqiGtS9sNNtr9pI_HDc1JXfMsrnM-2rQN_Fc6IBGIpxSGdRyg3BemiV3nj9WFq8u2UtJX6QdHch9YOF2mPbobenqhfMXgLxSZlwjoVmvVljnOcFBrg7A5eP2hzq-J2319Wg72r7e5vFFNZID1jq6nteJIAPqHtbpegjF3ZAMf_DjMHsV2X9GM1U7S9SDrGG2ekncgq3c8Y3uJ1mvTxmrfNamRTcJrHln2nMtH_6cs6wKzoMV5xI525f4pbyG7KBOZxP1tPZsizbqXtb7feFf7w306slAtT-5-Nm3UxCsypVhIM&sig=Cg0ArKJSzNXLe3q9SiV6EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=80&vt=11&dtpt=79&dett=2&cstd=0&cisv=r20230531.24772&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9AB6 22 KB
8 KB 40ms
39ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 237151
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Jun 2023 04:52:43 GMT
expires: Sun, 02 Jun 2024 04:52:43 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 6B89 106 KB
37 KB 42ms
40ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Origin: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 09:27:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47881
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 06 Jun 2023 09:27:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/elements/html/ Frame 6B89 11 KB
4 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DeIDkS2MwYjbpQc5k9jHJ_HY9ieNx_YVhRevA9nzUYB-v8wLxg1UlDtQMzJP8PO55SpH-RlYtmGODL9V18Uhk-8C8JG_iBbpv0pA-oE5_f3qpBkLCTUsQGHe2-h60gNza12dscU0ZTVD5gAtcChygckZVKOkq_Q5X7_y3HQGYcKbgW7Jg-K9RqTDniZYwwlpE4o16v&cry=1&dbm_d=AKAmf-D5_pCsrEh9rd40NXFxgQqb22jfCCZ67BjAwF6uaGPhVYEgKETu3BZw_OuCWJh0mpYkOFYUY2NNsK3oboAecya9DQSTURL288lNrv83ZoDyRtymUqYDEtby464njuG2fjx3Lt_j6p-wZc46ZIQendBHQ1DCV7rMerFy13p7XdKywocTHNsNqSxA2zUD-AS6U4NyBiPMZ9y1FtGLjljHib-kCiFiiR6f_LPd57HH-UzeWOKgaMKDa1riAg3jax8UOcyqgtYYpAulwsxjQj0VUBS9u7Odt_jqDF8UeRVIUbVNnt96pHy5t3Y8ZTEtisvn9ekQJNR-RF7lNVLBAp5Z1qdwTfFsS2O16UBx8c2TmtreQWdDNJyMRdM7RvHduVAN3hB98WqQ4VykDy3mCXdrT-iGbdkT4yQkurmtawEOhINsF9w3mHMzIe1TtyoZgs5EFs37VLxfm5zlK42ZUfpwgCQQTeMnDWpKIXkXovTSZetLGzlNHmv1QHo-I8dKMg-c3xd1_cdk4NlTfiEv1IXk56kwOToIFvNxK1ZoRCCadqSl-qyg6RO73jqBGBMQAKrHjsOCDX7zrKgRmW1jzVY-yJ3DhMAkt1b94zzC7Ihk5pQs4Psh_h4y91mKfVcF7kXEigazJ3c6GaLsDqfBt3A2hkq1EfjVoC1dQnLa0aXbMEzeRQqFe_69n6cu2GcG_6gqgm2zUrzjQHMZVRpZLs64WLntJrBL2IJvmE_t6XEAEzOjSiJu1uNsejoxKqqoZ5AOwbPeekfrA130qsmJiulUu0uuieg3C0riTU0nLELpNNS0PqiTAvGKGZL7zOiCAMO-erkqQ69Ombybypn5o3BdlZ8TfghRMh65ztZ1WNlyWYEgCQZSQMdhg36raoK9ptcG6jU1gOBGOTxdMgH606kjFo9k1Hrxb4LB189Pyz0dshK-NzOIIuTDsFa1VSjodmgIwQwYfPJzEJfdkZvUhUN1dgaiyHGazEQqClGf100s-v_crW4-m7EZ_ZKERRdyjdWe5vGF2vQhEuCy8yLdN_0-tPRpOFWdgBwCjFB8Dux3-nmmAdPZrPC9VTtGv6rZwtOqEszG7NmB0cb46tuzq-51d4aDus270l2WdYnTB-lfsdpJWMrbkWVph-mkPg_byCUi3sUk6cI3NsQ20enMxtdXIYgRbKSKq7bHVM8dVaaLDxDI9rggk_CDqGbZm4thJS7BWYMJhB5IrHKgaQLI8AdjCmurZilRlBCKyfam8vf1q0bpHHRpIKxj_yYCirLsENBfds4Ord60TrpRIGH_1hHID7pkHPewPCR0mww8K2p5xHc7VWl37a2Wnc1HpTxlIq4AuRo79-JGzBmPfOJnL7a3PUvKdMoYvQAeN-yjAvgk82TwqEBF5BxHwbicqVph3vGaSHhDgo5Bq_UICdFy0JscxkLcH88mZobH8zA1YLdPfasF3gGhLFjk1Se0e0C2M3etKSa-f_sMHPJqgjfayhMKHesD7tZ7iu1KE5GmqPgp8RDShFyS_w0sIb0b_orptBBiG9NY45jjpCrsQwVob25adI7LTzflhqTRs46i8cxuFKeGl5dMqQ2_oBflna9XePyXVrVlZgEkY5wJHsJlmTqhU8wLteXIRq8qAIHB7iIXgDSaeEntCYR6JmUeXNaG8CapHtx2h8fkQECFsLiwJolFvzJFI2ufOvi7eFxiNfkLjXNkXRH5a_f_og9skQCulrPxPb3k6BAP0G1qor7W5dVPwZoBX3NsA7lUWKewTJk_ARsOuEK968UHN8JnSazJzdXd4fAsGx0YUNRXL8PsRs3RE1iaYWCbXTiFwRbZi-tDDQoCcpRFw8icVOkMt4bzk0XjdTa3fdxAzGgaUAUvgIGN3rT_MYgml5anoj2U_uEUIY5JmXAn48UYlL0IaBoqhhwGjJlyky0JUj_h-phO0OojNuufGlWDmrSlt8fOIUL6HQjgoDP8moPhj54EImNOPXegRtc5JTvZhvSwr9JW2uCiq2tYuDBzNXQm5-jf0N0TWMeAvDI-UVkDc7SZ93H5xRDX21LpEurKxvuV7PsrymBkzCJZ9PmAOf_4-9n1WkXpGtbE9txsF9jlt42MLmScf9_mZfCf8PXKdMmYzTyUgWaCFibmjkdcGIruWb90Xr0m2QNFap-4dWZFzMoAKBYdbN7pwluFayp6L1LSbpqqOpmf8IkrOYQpZbDi3LxKaD4qru9qEcdXVJVw0NIDHY3n63SYJSyHOnK4zBSftR7qpIbohbipfS5FKmMXCTq7UdfyujkdFYaG9ze6W1cYt2GmjN-j5MV0slBj7ZWNHNML3kDNTB3cZ6o_UKF-_Kp9y2_07w1w2wXy0SsNSvg8bVn6c2BiBct1iOw9zuk354A7KWRfxj6fNJVP0PEOMfLbOVNBOfWVo_p_2XjBkoc5jtvqp0RjTNBIBv-G_krJg2_ejfH_CWzH0saWbba6Ou2HaPlACTZofhdCYktvLDKQ9uBbhOkKTf69IoUGbV5iCnNyki0aZpyw02VdvuC_52iy36t31Yn_F5YdbvvvluehNJlo8OKS45XBnAmUm5EcyXqJUS4-wHCBZjIeaCC9KMngmKFLFOFABmK5QaASsev5b_9vVxurI20VskRnIdJqDkiqzy-6vxQ9A_k1piQQMWoqWbXl2bR2mO4eIa5X6_onEvO2KeeSjXcPQwuS2r1sXoDqTSJu26OqvVVoHYoeqmhGN5Iri7OGHEp-T7AVU7MqTBBbARwTwf6tiI3r1CWVEsCkOnbsH0HbUHTWJ2ij38VFIv13MMWPZXAEAOfShr2p1e_F6DtvqkK9H-ruorWgcs8YGb1DkfTmYSw2amy7Zf38N-otnR99Oa6kBJeWub9SKpPNbkdzVMBVxQXUfJbf2LvTlVapsakTyD89RW1UQzUeLVNhEVaPvpVltIvCXEcf1sAPJ0ADY1SzDswVAvzo9X2WSNa8GQRfyL49afYqj25Tjxr5PVB95eI2fhkrKeRhtcL4BBqLEGBlnPl_fW44SIYMKqNMj_YSQQrtJDhg-St1-IakTr-RA8VBHDN_ceTiZnYpKNL9VbXaEUf-FGSQKY52hqOyMWbB0FNUPD3sfVHmTAU2YEbSFkvMLCBB1H_51Cfl7uMgjH444lheuDUY025tEPJYPI-05QZGLkFpv2s0qVQ8Ko9NjmgIcVzqdbcmskgfdZuCGzmsxkJlyAQ99AR6r2tQLLuDjMsgSFnjBjpPcPgq5yxU3ymsFJ8cQWFxuN2fV7oDCIu1shSRT1o3JySlSmjP1aoOv80eA0SSaGSmtXz8zgj49n_i7sJy-9YKKVZFKkldVrR07WisVeHvNKwZYY88tvdUaGOei4HwYDagtHHy0IboYzZ-1FU7FGq-Qx3L6_bVawRJDV5qBj8-RnloYqHPxwmWnqLUfOwN-nVGKa5uqyZ79DZE-ucR2M9akOB1RRQP7zdfhhFJ2SNn9AZyNAhDZn0cV41GQ4GVJJHxUJmSwyj1NW7_2VDHIzIa6HklNSbeg35zLIgsFD0_DRmmHwB6o5GmHBzfOhSSQgzB1JxXufooLuDvjggfFn-84nmc8y-A2ovBX6YI3w6UMDdMvExx9Nlce8FlV9YduV4TIHXOOFpYauPkfrJNw4td2yzOykVYD3z7l-GNygZsT3nyO4wYy4atvOCihcXjCrIeW0PW8purtM35W36y062T9pjzBEPj2gOTGSPwKtkLwMwlm6kGU800yYijVg&cid=CAQSOwBygQiDCJYEzYKDL_cRGpVX9Oe0xV06Bhs5NfbMmuSQByl74KDRoQoG0HaaL36zeaFmZOW6xyFwe6YpGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=4995774255353773000&adk=3563752640&idt=174&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 14:15:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30603
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 14:15:11 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/ Frame 6B89 29 KB
11 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 21:03:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6095
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 21:03:39 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6B89 41 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 572741
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 7E03 106 KB
37 KB 49ms
49ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Origin: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 09:27:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47881
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 06 Jun 2023 09:27:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/elements/html/ Frame 7E03 11 KB
4 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DBnJ5O-uggfCXznFa2rFqW_aF1bmbJ2o93Rwhc_q-dsgiroGxTnMsDVhqOb8HDGMMie2EZKP7Hj6Mdvq2COPninjMr9-ASvZKkG0OXl5QIYfUbWtUduSQc6FyEizdHcCD_injThwe_82lET7ZhNrG5V4MLskVCfSL8OKEqUpzIbgEHBbA&cry=1&dbm_d=AKAmf-DxC_mKMhjTPxcnqwkpFd9AJbl4HWZ5B4pGMY64rmPloxg0WWfBNayjusjDe4Sj9JhhmTGuu18EMRQ5mp9h-IOi4klWJCvjcQ1waHuC2VcIvJci_UT5cSxmrMUt_GMOV5E5tk4QT_zmIY9PP_7JBHWZVy0zlfC7wSvn6FSc-Zi1ndxkMMJ9Pl0xnFLlahu4smwGJRc-i75bSrcn4efKWXAYyxN5Y_16Cb2K0jx46_Nw2ny_DnXxAJ67ryk-9o39LvUJZMfRbEQI9KLPe8hpmcN8C4YJPNRoeOHZ8KINWCiOs0213_JE53hJ_JQBjEdlCWYEnkCifmQPoMdxVMKpxvEdKJGQhTw10MHvhWTzVAhpJDKoLGt86ZJ-3kv4zSQzEbLSDlRmjKEFR0MG0OiTLZkGqsw5fLtW9_n_XwxQZZzSMtOqGCznBRLHKKpSFLWg5mIqW4fXUKywc0m1Qw6jxTbmOZr9Wn_vdB49QaP99L0lTpWhA3AsOcgysLBenf7J-3c7mkWlW8l1ORvvicaahQw2b9DOS3plRqZMWJwUZY6ki128I7nPY1olt2L0w1YMmmK_mP6Ifn4trIqoGftt00clXxSR_LP0T1GmebCzuJn4yi6wX5OaRZEjpjHjwcRIHnjBoJ4oDjUoZoS0CNoG7aBvMedeH1FNOciv-TwbXsBPrepPETdX4J54QqSk8CHgWgzVYcqBqozUjUZG9QfoNMYrIwE-hRvcAEf4By6zHnm_1EMD-6D1I_G2UE03j0Uq8LulgNFZQF8EHlPju8RSlquL0tAdqhwtmLy_2xWvc5H5wDvw1kiJZHGNMZWqS33yYBlK_OROQoWQvrRejPsVpqsoo1xNnnexKDOe-NxxTAO5BaRlpQgVwtQqyUgqLH9qBY36asWEkYijbE7oa_VYzHwM34OIxD8Yp_P5C3LDOepv3K7retfthA0VJjaBn8Sn8K6T46_Dxtz0igQJz579EqJttUaB20bG0QesYAB-XnXvGy8AWy-J6-Wq6jPHifWpwN7G4q0Y3Lse94CB_VfcsAPp27zLahXr5vQEkiIRqX9W9fBNk5_TutakHCXnND8F7a6BI_t_2DmFeHEEqYvR6bZ1wxGgIbfAboIxCBlszgbLLEXvzenBIFjSgL5bz-sqqiVgCpHceQoINgIaTOnkvgXdAXsuyPphGQYFIjVW1R-UMzpAde8GoS9p_8_02t3gwFRpZI9D-Us_3Tr55vy3Yn3TymU8IP6K8AilS_nuA6mBtY0VoERvD80aGvdMO5CBBX24clL122Ui95mo_iBUyUZqlk1J5J0mUKPK1C0E2WOuGlrzBRpSXKSocN4QmX7UzS2CvBBEKHIqcLzP7RhFOu0NTd2dqyDUcAAO57qkFXJhI8GuL_36VslEfPMRJGlWDVfKFXMORqBR3Gf4Z7Ki5SiwR0vHoB5IiPgfEFkE3g6dQ0vqxCDElnqasaSIZFurcEd8X4wcIL3MTLeiRN1oYY_8VcaRg8ziPcdoMI7QL102yLtt56wM8WCqdjFM3wlLf-9KgppPfuGWyc_DgX_lj5GCUsaILnU3XUM7eoeyfvWBW4L-kPvWPjWdzOrQnFz0ML_jZd0yzz5ZkFdmAhJDZMhOI7Zi1QMwbrOwOrfCTvjY92f4S7TJXFMSNGYSAq4aiWTWrGrUZBW2msAJwgucJodUzkPhnFysi4IUmzKj5jw12gN7MMTWSmWcQGgZm0g479mKCwHU7yfu3KrJk7Bu5AUPu9dZLvZ3aKI87MMiv3NRXuP17J5BzN2IXEYDwTb1c3byPM06HzRpFV-1BziipI6LpbsZvhC5ADgAEPMSo8KageEDh-yIesAUDYEX6stWL0bEJ0-da92MPkna9f3h0IM1gjr2AAsJ5AGWpcthWns59BNS7SNg2012SNqgSrYTi0BkerTatH_l4UNHPmWZjwGMDoesPqL2Gj2qMHbIA2jCEFYICFG1kKExziM2SZ8X64QvWoJmpvai7mc4fPsdEbGWkm4x0jtJmF07td4qy8yglqixiyesMc9OD-uz11ajC-bha1LlC2IopFxzRJ19cg-H2C4qAqRIslmRg2YpweKCMdiREGfrb6vJYtElzVzD5pZ1-GI562PNk9KLQCT8kHYCqNxtyTDeeLc6yf9-wqrbErusP3CtlItEN9uERIa83xeG6TLoQqQZhZezWsru6A0qB5H9wraK3j8Frf9Jc7gn4HFbX2ZgMve6KQKCao3INYAwu1boOEtZgkuKG1s32wNcMhZgDRvsOjqDYnA6l0jfjbDuz1Y3_bYhBL2otS4p1rgFK519ll8BM7OJdEooRQMMqOd1cwLsdEMX6IpSTcWTPajTTnsYJSXbRHPh73E8KUJMh4cbD3QmfE-IRycUN5vqvtoIYUwOe4-y-zyCDjTRWjzW0MyAgIY57dq8IMD70DoC5PYRwDJ44ITbaDYs2g79BOCYsl-lbrvWIdaNTo7xGoDfqLqqYuyCKYdj5Lfe8VwOu1f_u2Qm79ymwVyCj_W4xdP9j9mdQgbXvYs0JEqdMRnCGjlBc0k2SmX3HxzkUGToayksmAwXolvKX-sbNI6RhjbO5ogAfdEichWrb_EPpz7VSEYUqWVgtJBEzd7lnstfLBkuwFERkDlBmoigxojBM3XfoF-bt3bxJrfUdlB4CMnipctCN6dOEYNsWrtLoa2-Hx-kgaeJkXnk5AMxF3kch-jFCNhtcO60SYXXxoEBaG2xY1lCQQxkcxUSU5iOXgCakG2wKnF_cdbwBVB_vIE5TmmT-Ecn5bx5PJKlEzKhkmGHrZ-cSGJOLyO6u5LCILQbKmC8JCkdRmfRr9BhBSiW7LjQXUckk2nQJmwLi34PNO4QsZr--PSpVywXtfm_pWwzdjflqN815BnDO6yBk6gjStpRpKYmf8Fc2IYN57fIFmDD4Q_QSjHTU3iRHIyBJPelx0icYXL-Z_Tzy_sJYgU9c5TOgCfReJK1oTzx7pRSGc4v0u0QRhMLREZahtqrqt5SoDzbOcZlZQ-tJS7ckC4rkq8JfoMjPf7c8qVFAD3PFRr3cdsSeTMU6N2PlEMUUwvTrlVkMa0VUj8yGEuF2XD_S8Z455keX_Z4Qf3zSPsFlbO4Xukn_ceoN_WaR4ccF87oPZI7IqTzSri3xcDUOwkCvF2ZP6GaP_KywvFhzc0FM4Tm3WAlH-WYR1FsIj3hCfTGaX1YtT6GgLbXpYctL3jkR-DQnkKsVmrJV_B9fRyLKpz1ZQpMBtF223OfudzjKntTwvb5j0Bw8Y0I8DH1ywmYqfTtDLNPuuPiw51I4fy0s_kx_2zMtdAJk4_tDaPyXDDORslDDsbWnLF-3mZEvbf_V1nUcQGyJZg_k9k9ov5uTAccy9RdoySUukn8yDMSZ9c5SjQrQBhxU0_WJqFVaE1teSAQEfUfDmeMoGs9uUhju9uX0eoPFAWwpCMqkEcXuhlyv_7FTElmnw6Sg2Way5gDxh24ikhklG7mMw2kSo1wfJd1mSSKxifvy0jaGqJiqQ9ED5SEOerS0PxeyPl-MvyCWuLmaNGJ3sHXIWe8gc2vjsIK2_CltDYNqkmW64Q7Eh_t61MqhWNC896WZ-JkjDGnFt0EbJRGj0deslkeyEtTuKu-XnIwNEXssc13HcqHuqM5xZ701Cf7S-JPMDbdP3NUsJbWwDZfsmK1ywB_S86dEUvmP0-p9rO6yNnp7zacLPr_45Cw&cid=CAQSOwBygQiD_slBkSCd0D0cF9wTKSk0FD8ezTBKhdZ4tD7iukteP2rececEQpgtNZ2j6nme5E3l7-VQgItNGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=10103871710852602000&adk=3860319555&idt=211&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 14:15:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30603
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 14:15:11 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/ Frame 7E03 29 KB
11 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 21:03:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6095
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 21:03:39 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7E03 41 KB
15 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 572741
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 7A32 1 KB
643 B 40ms
40ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 16203
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 18:15:11 GMT
etag: 48472445140208031
expires: Tue, 06 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 6B89 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c576f85ee1cffbdf432fbf3cc62aa7981d5ed092c2f1b8aef9e8a89e32ecfec8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 7424 1 KB
643 B 39ms
39ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 16203
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 18:15:11 GMT
etag: 48472445140208031
expires: Tue, 06 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7E03 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7a8400175518f65b91f50ab892db80214631f8a7242ec2f5d6f270a199fd8184

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 097C 106 KB
37 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Origin: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 09:27:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47881
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 06 Jun 2023 09:27:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/elements/html/ Frame 097C 11 KB
4 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BTxPozLTFxK6cl3ZiO88z2M0wPU7lmn_OmuVIPf1S5Pbwv-2zUEIq_GWVhiDx5r3G22nbI-G97WvhFstdtqMiYEXSypcT9hDs9EAYB8Pr_uqALz3CFm92O9w9hCNxG0SO1_j4q3YnEose5ApFWkMuvvxCVFDV0bBTV8k-mA_DUjrspbSY&dbm_d=AKAmf-CMeYY3upckx_YAvPfaoPTvSP5WOl3xYpcgxWqGlzcw5UOnAPKKEVZ0AWuRGsGmdLJnZwN2fi2XUc5fJR4C0LzL-D20rEVs3q-DoT83Xwmb5OtUyqhf98WmgowevMab56_CQ6z0ZbhjYUTubV8BnRetXj__h6ayEQfmH4RFgo-AcC4brZ1NHVUzWB_vuVfpgnpau82iiI6iRqQN2Pvt3xbntPjiNJguMBEk42OyDiqG6PGYJ6i_wF3ybBBqs90-FYQCHKFU91lrse88gNgSVPRJlT_LuYzKa3_siWl9YYU2vcQhGL9_XgC6lU-Oar0vyxsdQsJQyMG0gDtbuwn-VJo7uHaoH3WKLZChvdTKPkHfU20nN1dsfNNJ8t_w7zlc0UcYy-XwoaCC3m_AAp4CaOA-sUgVzi493NzzZieVa7jb0LVP6v377BitZymtz150yBqLCEivcwtKLbwEf24X-hlvRZ3VK6U2I29a540n3bb5Nk9SqIZYlEnWrJp3xbZ5kNWoXxhsAIqYp02saNf8n6o5wfpXSuUeN2eBG56fN3ue0AUbEkJZNAt68vZeadpr14-wgD_ysR7DiEHL3udFbCaAmdWSDkjnAxPCselKVaxd2o8bMaaosDNd1AKU33dWacwAUjS4e8cZYUKpVGxljsK90DgRLjghceDZk4ONsEKWEwYygAIm6kHL02B76w_N-ZRGRvl6xbxcxjIVIjOCHg4sIxiDHqxGk9RHo8bCHY9pwNPTYjwgAkIjtrZImWXjqkIKJ9IEnZw0-nklLvJytRdSIzht9iJ6xp1bTynJqAupn2IRs4oTqDIgsSkmmn4sbi6O065Mggcu9E-0cbLLvXSSnd_n4q_gv61N05nUpni3JpGHWg5MUytN2sAjB8HEBbU8dZAU_MjCtXGH9Vciw85FL-UY394GoFBhfwfF0IxTOkb42RjjgDVGcOe3y8zoDiljSHRrhNOTATbU7qALUUtD1F6iNpzFQydK6dSpIKCsLbEEidzdkl0aBOibdaHjteobOhOhQnv-xTkiG6LCFqTFhsDY6iqEZaO5T7Mu2QCF4HDGC01Q0qYfwzVIDA7Eevibpp5Q9bKpg0X-UYrIooB1A5ujdznXJ_UQKLChHzp4EfOdYxAN76hEcFvumKW2lq6sa_I1gF4BzYrtmnUU5fS5xb1NCt-qDsx8BmY58KzBWqRlq_mR28PG8pI4tUQFE2GvoJ0kazYGhmnGCQn0tMVPhDxSuurU0DiHNiC9rL47GPUTRRZXqtbi9z3a-Qrc612PX6nWy0ZQAFd1__ENcQkASBVBF3C1GoIpjPA95-gaZFnDV8xpo_6Fhc2OvKDQIlxBBeL1fgq-q-F2uHnM_ItC3lqpHoqB1Vkb7i511bjeGO1NegK3jtwc3VQS362k1aBy3EUafMcBqsFtxTmt8U9z0SEeoi7PkJ1FD5VJzQM9REEIdbYgrDkF4_OzmGlq9tXQJq2OmNBBgAeUa1kc-ei7QZlcjwCopv2qiPZkPU9qshLV3CV9EJJai2BHSwo5gBD8STnPbHUaq7WXkravtUp61otygP28WL7QN_fUN0kCQWNgmnpJnH_MaEsoZedAUnqiYX4K7trQjBrAMeYPCAAWo4UvWu3Y2imMOBr4Oy9LguwARJwfAomlwr6aZ4ruqFbmNbU7Np4l5gQEm3JvJr7H09iRaV3fsG4XINgKwFIBa5oMOGb1zMR1V9_8vFJ1ir4vPnoo9OOK9S8PFuDB8uAVX4CKcmet-5ixWljiGA4iEwI-3KWzCtcGBoHkSv_8Gev2qIOLVLt661BzGe6B1xRK4Z1r3FYVJxC7oDyLU4wL0ENyn4yNS9bfYb4pBPzw0LmpeEKlXopPWT329czg8LT6VSFJu7tWesjW5o7hBlwvbS91d58A-3HV2SC7EqX8aOjvkqHrcPuhZF9gLy0Lhkm8Xh-TzHeJ_17rGQvnJTxtwvFDrZe0yduElmC09rgf2xx1AnWUFi0IGo1svsca_b6zwEEBKlhe3AZRs0qZ01A1OGq_9ApnAdL2K259IxRht1VSRIBAor_koGuNe04gmL6ZAGeIxxMi3_ErwPu1YYtdi23UE48BeH6htk1ZnAKhVRExj9fLDMpDVSouAsL-uwa1MPXh97uNPICarUl5HSqzwL1fMFP1lzUB4k5qDilzn9CWJ0jxkHB3xBRWTCnBTGnQ5d5ViNeOd2MbDSnBw9FkkloVdf5RiJjd1KLdEKzGQvJkJjXYck0fG3TmQ-ZlAOkVM5hZ_LFy2fEqjKyYv3LuMfG1lItVU-fNjzEJ1THtTboa3NGSVuN1P1ywzHg1xeBi8qZbjch2rmR0U9mTDBUOXHMAK5ZHORsX3VUBNpsDnQlw5eTngogOYLyt-xLlr4kLxk0JJu_O2J5zEma4gsfm_ippkYh23Rjd6pOLsOr-F_IGY2ExuqmZF1BEz0kufdrJWIBxeUa4ddP3PmQJWFSXkVX60YX4qoQCYL2vKZAeX122RyAU3x_Z8XPu-Mp9on5AGZoIxkwDLyf9hZNDBdRDutc3GTJ-mWbJSRtS9zlMQjlKsvNF9yd1KLXbUxfTGkNTUIqoUUlw0IPQN7nm2UCQpsyosPWDPQUZa4bi6ZaJegMVP35pCZnZ52-ieZ3DRCpyLWb3qaXQ7kofMfhoFNtG35S5POHhSJH7-h46VNFA22rsENixdxcDsUsq7e81b4jbOSQsiHjuhhW5qGNmKCccLm0yDE2eInFhmOHjUigQmtBunWZ3Nq0jPlt3TogdWgCy3t6ps1JkJunJx6e2i4SPyz0Q9JxNevyUuDEZnko15FxX6_AsgrzfUPzpeVSRG98Nb3guYnPxyFp265GeklnaOdOiOtg7xYe1G2BzI-GEuV3sMqSi1MTK-iZbi6enVVzt-AHrziQTFH_QP5WqDumGKE42KU3ULoURjifyQZJTt26av2Xy5O6Rk5MT2rsY_OBKvvm70OMMUqhvWXvH-bkow6CAUpOav_f7Oe_vNL4ptdqCd4EQ6SlRJm-MXitmJl-DfRYThsmOwoxkDqVjG-S4Fv9T05CPMVd5vVD5xiFCbw4kkAwBCeMW8CXJ0OcWImEANS39DYqaBMnPhSF2tHwgwqIf9Xz6TOMyz-35rxEB1k4skOqp7qGNgMosgyLpd6EaMmMWF1gNPaObrL7eFCKZsWVlaJSfweHveI51qd6V6WlxofMWZb6CPTLGdc00_RHDmm-XtB9Ai0bUU5UQOVkJXUUVEBWYr4bMP1L_7c7bpSdjQMPIXmIXCtmUWj4jaymItei3tEEmuuqc7X-TJjrsG298USDIV_gdGAx9Wtyni83RrcYQ47IFXBQgkCWdeIV7g23aCuk5qvuKj1IQ8V4j7oK8Ksx02YD-K8Dx3O1zCcV-cgkCBuvk7QQICRyNhRkV9QHP7B4Gz-sf_lzKmteG7VUf7FIo_TdGMQ8irl5NsOlCdfgmhqLdHZO2tBInA7daAId7a_vl8sdtzK4q_7twz7DvguwgzRRf_3ALE26FQhx4VECpqLr4qBvCI0S-sIne7lbx6DPiPEEEbEHyBlCYl-pPlL0QZxRWYvq7ModBoFrPzLqChsCIhn-qvrXSio9qBa9R5bCWqrjhj27eWBDW7_4lD1Y&cid=CAQSOwBygQiDQLFXF4jb__tY04QkpA1AcTf_kx2eS7F-FpgDShwTIxXc9scRbx8Jnw89_zrgaBOFYWCnIZxsGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=17832661756419645000&adk=578009112&idt=241&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 14:15:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30603
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 14:15:11 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/ Frame 097C 29 KB
11 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 21:03:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6095
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 21:03:39 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 097C 41 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 572741
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
H3 200 html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 1D20 170 KB
59 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Origin: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 07:18:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 55588
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60311
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 06 Jun 2023 07:18:46 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/elements/html/ Frame 1D20 11 KB
4 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CirZx9yuIMx_XHv1G-SdLGd647wVsjobzaJAndThprmlEKC5IlGIBywkAeMRmk5wWW1p2rL74c1AY83wbKIyvKVXX5BumqZuPQTE5s9X_UJP8noxETvJApY95mSVoE0dUpGVXg3mGh4YBnR5MtNwTx6xWvePh-G80pBBh-RJZuq8_ZfLo&dbm_d=AKAmf-A66DQzf2GkkLcecDqLOJvRzUN1YVgfjO72Y3nw3g9sfuDJD13ddpFPS8HdLNsvprWVFwJ2V2hqQjS8_QfL_IGqrVpat9AEZQbOz-_786sqK6lOiI6d3MFXFL9jeILMtx-S-wjpqNQ0xkwVFQRZdd_9xmyqixPXT9W8QqOyUFeeFAFkB-83iWuw0wIj0v-mynjxkcbngGWGY4XV9nvjIWpDhFOGapV6v6Ng-Itb1eq0NVGNguSfiUKpwSmQo526x13QnG6ewVHRTiXtTv9rg0OILPtAcswuctbV1JOZ2Jljp7OZIaE39t6VwWQKGB0JPTc55cqbQR4paa9hMC_l4RpPQM5a1U7eMThdt7sYi2ZxaH6Y3sWuuQr2qn3sfsCvMRxe03gWQdTrNY-qfTLIPEL-VBRmxRZwwl33JO2sazk7GvT7BLuC_XahcZqKS0KmDb7Rf2NPAq4FJ6MlJFKmrttfjjNelZnYXBM0AIYiaqFvyOhijoO5Va1_BafPHnEI5oJegeOmAf2IQ4-lF12OOPO2i1_9F5UQLgrVUd5Z8R6rXVkJLY08F6ZwdaqbL838i88wOOPUva62hQfN_FxAeSPQmRDtv7fZUYiULHS8qyNmLf0xrjc9hftJ_tBz4AynTnQOIlz1n437nd58Aivhlmohsss2hy1kKeLrVTfyZ28majbBpyVhZHuf2NkEJf15rjfIIb8DLb6EKLXlBOOXTqSbffoA5iMcV_V4EmTN8UNBlrguEaprtGzG3F9doFtldNqnf_S8rwAYOHlACySIp6bsJCIQr_BRctUR-Rngzy7QtzHKBCRy8UdwtiABJX2kR0d-jPUQah6JdMkDeRfpy7MCWGCIEV0PiA89PrXJWgsjb9hux0umxH0Nj_WdHaEpnR2YQCTCyKRhD_uyjIH2pX3jWBdLNfpOdZLXcDIbME056YMINRRVjhsWhKCnGcxljzi9ETdwSiKv9RapvkFZqzOnRzR7IgOoKv0kleGjPe1uqh4MQ4iDEyIh7G8YSFrlBYXPX1ojBRAufZnrqeBqWpAitQVYFKrQ4HlMFYnlBkO8AZAAfLLW_mjVF_GhwKWythUk0Zg4LRtPEMyBaGJnKP6qALWfB1nAgohPbXVjsi6AWm3TShrbBaimf-riM_5Y3T8Wcv6XmPHu5eJFmkJB8hN9a_mnDrt_iL8v3TIrXQdEW2LeIa7xyMVklZ4Fzm6RNtgUvSo44IFbjqkgVNASC-_yu4ue06eel8Ng7rnZpF7KrH4FovX-Qkk4sQOCiXv7dl6yoVqca5xufDIWCdWg-_UCgCvs6on4L6lwVeQpNbHyWrm8DbpX57-1r99v60b17y7vUrFk_JZLBTAthvydIOYA3KvO-mvO_9OvPRS9dR5GvBuAe5Ea4W--7K7SE0WLypxrTj3Agbpxk6C33yqupsOO405oNcdom4vSjRxE26Xwor76cWm5krYqlMVzeKhqN-i399cCPWHIYCaEJ_06A7v76niYqGTnbLwwKfP3zuSfGCtsOLSUURR_etCHeecZNPJQrXgMi1B3bI26-RovDXO8hGT4fQ3Hh4cnJvrADYXecVvJ_veQe1VVou_5VdzyUhjlISv4EqV7Y8owwSDgzAxp-csVPV97lJIyQekSEVqhkfMvTtpmI9adLUSzs5euD5Gk63UB18CYW0fj3VGnEstS7TpK4R_urQE61qyiFnjxyTgwwsmUraaAYR8XLbzHhFMu3ZH9fzhzn4LF8uEa7VHwxZbyLhUoTZx_nTrzT2SVonv5Ybgh3vxW5vPzGsERaGa3v5vOyvBxy9A53z5ZLJVXjHEipL2ecW1hQoYsaJ_EFZLS5Q7d8mK5chve-4I-YS6yF4RA0-E48gr3bkTOPDD2Si0eUEAWrPSpjU9DEHyI9eP2qm770Jh7b9yZsLbjb2bOf78Hi_BLlf_0le_PWGW0iURHwagjHyf529VZJI0hthvVPhFct00WE2URosjeL_-m4NiUmUXDm299FvRF89PgUZFRVXYDQenzr35uadwxZ47saESUnDGPEnhouonVjCvyOdSkGpTTd7SMQ5xNrEFtrXoTKbBjC6ZmefqtHC9et5zHEo-grD-gTJk_Sjr9-zPDOSfcEF_ut7_YfdZiy7Za5XoPL5yJt-RozLVNQXEQR-BCjKhRQG1KY_-_2ZEI63fOFddkI6OD2RanDtRv6DJec8ARrdrsDEOfyb6oyvxHX9MLOia1ZTKnEPzbBPrrfMNKhTuu2zlbYWRfBbyn5fxWIv_J1nQOFmrdGMHc_Rfg37t-HYfrHkqXooiy_nHX8podvVwb1ZWAbWUq6lzHghE2pms_qKi9TLeLBZstxlzA0FS_DZIj-pNbE1H4ZaJea-OoGekxI3uG9c7n3OMQlDwd003M7_Li24L8IR0sGqCj9nN1PLAKCVabzpcUzKpSAHc6m39EVF-FaJEQKq0LKvwqe7UUp9-GYqZJcP7FvKe5_8_PIBPYSw3ILuxikPq2jHmI74S-hTm2V9w_dTD7JY_RDbGMdV58OazzdXYfrY4A5BIQUfOtZqaX_n_QG9ZmpYx13BhtGEUgU6pa1VAVZjhQV-rjinj8vEoPGDzdGAr5_R_9Q6wNK5a6kOh0LvK2A8h9_Z1cuOaAotnbqfamTSPndNlUAIWmx6-FMEE40YaFCpbIvINleQANLck__VAGxo-O8hBerekCQwQp2FuaTAtuYvAe6YaWE5W6cHBXbJ3p23wKuOcO3SwjsT6tbkuuQPpqXGC-j2ZOavui5ZzWTBkaolGfGfvEVvZLo5JCWOFD9A7TY6Ewq9sz9C3W62r4ZH27TNHISDxpve_1BjGZ2v2UFrZvCDu1qufJxdTSORkTZPKh55js6Ia3mVEJkuxQxoiNfucTji3GM9F4-PrhuFiqK4JFDLQey3uN58rqOCj81lnBYUb1BU35B5laSfn1TTliwjTpFYgfQzV47co5bfAD3S8Ag3reEim3yKmL9uk4FH-VOh17yAGCpssXhXm2PVIcGUxixjjs1AT7QrNBFBQhibJbubF1GGIbIrJs6TTNvAEWq3ikqixDNYqRfDWIr-cUZeLN8V50LUgutF9mEdPDtbM2VBszffB6n6MlTI4TTnQFkw7ZtLocOfsCiZaccX994YJtbHM0gEMTXs6OQCkc9KfhOH7w3rjN92lbmShHJWRNRWhfGdajnqB-lQg8xSShajyRfPJ0M1NYpVmwU-FiYbxpVmvptxscOQnypRxekfd4cUC15d1omd6Mg0rMLghBTHJ7GDxAkSFsVFl0gjVPlET0D7mnLObgDLBFlz23CuCoDSlCa_LgYd1c_6HPFIbqUWh1d3x0rjuhfRT8WtsXw6j6xcoDCWn2v5GYr9bw_fK-JRtu0t4B4LZX_5SdMz3QyDRSpL5zYREmOnKoOYEWwFNdQ047D5njMXsPRMrxyatS221ABBmkqo4XF-WnT9RvFN1u&cid=CAQSOwBygQiDDO_v8Zm3E6NwD_ic-xxUVykY_ApD7IYBd3hy4JeNwi_vrtjowFcJSJHO4jB5MvcgEL_g6O-wGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=16898412597196448000&adk=212707235&idt=254&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 14:15:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30603
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 14:15:11 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/ Frame 1D20 29 KB
11 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230531/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 21:03:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6095
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Jun 2023 21:03:39 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 1D20 41 KB
15 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 572741
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 74CB 1 KB
643 B 39ms
39ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 16203
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 18:15:11 GMT
etag: 48472445140208031
expires: Tue, 06 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 097C 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5cf7677d287f165382a3d2f6181f7d21a742fbffedad6146e26e86a530b8c195

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/9170381621892120779/ Frame 3B77 13 KB
3 KB 48ms
48ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=8eJlrjiDq1&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

691257cf7d510da3434f5eedca2b2e0137949c698e3750c7705526a1ee75684c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2744
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:14 GMT
expires: Tue, 04 Jun 2024 22:45:14 GMT
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 083D 0
0 84ms
84ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstCHww8PwaY3VSBDPHktbP5ZUkvsclzWGPmuLk43XwHTy3F4IoH3hmyaOMQK97UAK92fJhtBnsor41qrcCGjKrkaz-DY8QCOJJaTo6Ghcic1x_rEYAtL8ZVfdd-AAW0h0hXVG7tuJoCOOf0hfWMBnJndVwk59qErn_tHOY3zGbbBTDthPwj4ig7ZtAEWBRZO8JJRMKpTCjixbJpYaIQT_wybPMJ7Z_K2dVnYS8Kr3UNJH7hlWRn5tYeDlUOhVt3sIlRvjq2eIMOz7HJq3xWpAwgueIau454TMMiDp-m_cFkxTPdaknWWvuPSmkUHSUJDdzOlgpaegBVh9pvRQjW6Yk5SDRvrVdnGR03LOhJd4uzOz-kXcx1DWCKTlk4ujJdxrlfcuJWBP-qhRvQCjy-ExrN82qANCn7hBKZLIN9o4gUj04LyXOgn5oqWC2Kfy6rD3V4MjTIxVCKeeul-PNgPFxhi0GxNGZUlxM-9GaaGvf6Qf-LEclWqRTMb7RO6K1IMeuzY7jm8dJxK1bTlioWkpSix5sgUso37niV7lpR70IYjYOG6kf01Wmc05S5AI7Bu1bzXd53k2ej0QHxgoHG8g_aAkqe0e31qNO3CWJGkLhb5P-Mk6DiyCB-UjbTDXU3bMJH5SI11k9MBVUHLAwPBkf3FNGaX1yvKQNffiTb9uWO7eXIm4NHWschmgSBYGZ6p3kWCLF-28Je5GyiHJvsczmD1sGgcxXoXoUUTIGw51DklMvCs848vTGrM8hwOOwIL45oR_ZO15AZR-cFUZMyPdOTF9vTNBsyjUYQ75tnSFb_KY2FmJ_gCrb0ITQe72-tg0ysLwSqyMGHb-8v2csGwE99t-r-ek4HbQjsRQ5HoWUCkGFmjF9Dz40gyyhaMZK--7ooQ2Tys19lY5O5p8lY-hYDvKV8EbjzYUT0Kxf5v-3P33OFSvDJjWIR_M5qRPfI1vjh9ABlizz4HW8856wjdQkG5XqeCuIs2qvnjTaEN8MHQ8P8GyGdQ8epFjzZaJy3FeHHJr6s4i8OIOnalGT3jGAClLqcM2QUUVG96N7Pxau5oEmBOs7Wvnc1UOo910qEaLGggphTHXnYSn-qjwc66bTjiC4wqE_ELhb2HW61L7DqYL243UWkHHHx3-XL09BaNXa9ikppCdRYIEadylsTyq8FAAUvWeYaf26voUyt9wEZgNO3l1fO6zCeIJYnUYbcccjFLeHl0LYxKn2FgMzdi8EvLI9uJPfpOHG-zaNI-Q3rXwcSrwZzi0jZDzjXieQij8an1nfallWXY8zC0nb0XkY&sai=AMfl-YSsSJG6-1eZoutMK6lJZ4R3b1VK1Xo_XMOtj0ANW4OfCAtgmAlr6Daqo0_0aHFjFrPJStNLL_wlS1kKgtOs9MmQ65eGFyPu61chvNEjvYPDkIZjQ5PShDha66wl3Qlp192A-Rm0-T4qZxksNjKpTpuXDv-493Plc2dUWawuD6Cd1NLbVvfKy-TtbD4YOQueTRZfz19pRIjn8jeO_qU0f6bFGjAxaQlp1SNiF1KIF2fcqxmBr4uVTeHJa9jE1wdLil6s17GttlhiKoy_2dRn5ZYmppsMbA&sig=Cg0ArKJSzD8gmTq5NOeXEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=224&cbvp=1&cstd=215&cisv=r20230531.97593&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 2AE9 22 KB
8 KB 40ms
39ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 237151
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Jun 2023 04:52:43 GMT
expires: Sun, 02 Jun 2024 04:52:43 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 8909 0
104 B 215ms
88ms Image
text/plain 2a02:fa8:8806:20::2010
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEMoNQcRvwQqc47m4Ykds4no&google_cver=1&google_push=ATf1kGMrIg8FM0-o9P6ds3-ERFYVO25eA2DeB2RMxGixT6jeLALytbLUWh1hjVxUN20E3jo2rNUAzItr7WVgq1zT-lUhsKTO_g
Requested by: Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:20::2010 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8909
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEJkyNdrZhEwgr2gRBmTx5Eo&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEJkyNdrZhEwgr2gRBmTx5Eo&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=VUZjd2V0bnIxUTZpV1M1&google_gid=CAESEJkyNdrZhEwgr2gRBmTx5Eo&google_cver=1&google_push=ATf1kGO3B3tBaWwyH9HYYRp8wTXu_x9ChAV9_H0MvNgkMuf...

170 B
188 B

50ms
50ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=VUZjd2V0bnIxUTZpV1M1&google_gid=CAESEJkyNdrZhEwgr2gRBmTx5Eo&google_cver=1&google_push=ATf1kGO3B3tBaWwyH9HYYRp8wTXu_x9ChAV9_H0MvNgkMufsjITSN5Njbxkpvn8FoZBPxM_3kWD1vGYhf5-SBMteOBQHADkf5so

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Jun 2023 22:45:14 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-777-g304ac51#rel-ec2-master i-0943143fd00beb9c6@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=VUZjd2V0bnIxUTZpV1M1&google_gid=CAESEJkyNdrZhEwgr2gRBmTx5Eo&google_cver=1&google_push=ATf1kGO3B3tBaWwyH9HYYRp8wTXu_x9ChAV9_H0MvNgkMufsjITSN5Njbxkpvn8FoZBPxM_3kWD1vGYhf5-SBMteOBQHADkf5so
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8909
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESELaSeJDNfPfTZrrTy-rosQ4&google_cver=1&google_push=ATf1kGNWr8B1RN_aa8_edXEP_dUCdQukwb0MxqzUOMEfpcjiMcnbpeR0PygGKrgqZr-kOQmXM_ayHCNQ-F0rWPfg...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGNWr8B1RN_aa8_edXEP_dUCdQukwb0MxqzUOMEfpcjiMcnbpeR0PygGKrgqZr-kOQmXM_ayHCNQ-F0rWPfg-6xWS_Lv8-s

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGNWr8B1RN_aa8_edXEP_dUCdQukwb0MxqzUOMEfpcjiMcnbpeR0PygGKrgqZr-kOQmXM_ayHCNQ-F0rWPfg-6xWS_Lv8-s

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 05 Jun 2023 22:45:14 GMT
via: 1.1 a7322dae74179db004d6fbdc1e7dc03e.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: MUC50-C1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGNWr8B1RN_aa8_edXEP_dUCdQukwb0MxqzUOMEfpcjiMcnbpeR0PygGKrgqZr-kOQmXM_ayHCNQ-F0rWPfg-6xWS_Lv8-s
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: M7SAXLSq90fBJrWTPI0Xll8K8ZdGZrhxp59EA2y0rDULer7bSuf4Sw==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8909
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEJICSZmExLuzMatMmeEu1ug&google_cver=1&google_push=ATf1kGNuu4J6QzOp1Ma2XCmqfy06DiTkokMW5Ww88kbVvMKABtTv7p3G7eWTxeYI1no5jjdr3_kNtk3MkGRp...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGNuu4J6QzOp1Ma2XCmqfy06DiTkokMW5Ww88kbVvMKABtTv7p3G7eWTxeYI1no5jjdr3_kNtk3MkGRpbbfvVuoM_cC0og

170 B
188 B

50ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGNuu4J6QzOp1Ma2XCmqfy06DiTkokMW5Ww88kbVvMKABtTv7p3G7eWTxeYI1no5jjdr3_kNtk3MkGRpbbfvVuoM_cC0og

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGNuu4J6QzOp1Ma2XCmqfy06DiTkokMW5Ww88kbVvMKABtTv7p3G7eWTxeYI1no5jjdr3_kNtk3MkGRpbbfvVuoM_cC0og
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 sync
ssbsync.smartadserver.com/api/ Frame 8909 0
44 B 122ms
49ms Image
text/plain 185.86.139.102
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEKFjmSFShGQlVhGndOFA5bI&google_cver=1&google_push=ATf1kGPRuvGNqM-QNkttYgpmYOT1tx3ZVhaKSTy_sU6tPJF0FL7jk51mybiRNVJQtJqx55MQtaczx9zAWMnzWQk8klqJrGaOfvY
Requested by: Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.102 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-length: 0

GET
H/1.1

200

0.gif
id5-sync.com/i/495/ Frame 8909
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESEE-2yT4EHOMiMPmDfKpGUqc&google_cver=1&google_push=ATf1kGMjinQP6z-oEXY5Oi9YZOpo7klOXofOHk_d9dxnzWL89zV3XJaGAR_W6_JhKwd5_8E0hVsfkWGjPN7rhQdegP-bHtNBQwA_
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGMjinQP6z-oEXY5Oi9YZOpo7klOXofOHk_d9dxnzWL8...

43 B
1 KB

133ms
42ms

Image
image/gif

162.19.138.82

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGMjinQP6z-oEXY5Oi9YZOpo7klOXofOHk_d9dxnzWL89zV3XJaGAR_W6_JhKwd5_8E0hVsfkWGjPN7rhQdegP-bHtNBQwA_

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

HTTP/1.1

Server

162.19.138.82 -, , ASN (),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Mon, 05 Jun 2023 22:45:15 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding: chunked
p3p: CP="CAO PSA OUR"

Redirect headers

date: Mon, 05 Jun 2023 22:45:15 GMT
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
expect-ct: max-age=0
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
location: https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGMjinQP6z-oEXY5Oi9YZOpo7klOXofOHk_d9dxnzWL89zV3XJaGAR_W6_JhKwd5_8E0hVsfkWGjPN7rhQdegP-bHtNBQwA_
x-download-options: noopen
vary: Accept
content-length: 271
x-xss-protection: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 8909
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEJICSZmExLuzMatMmeEu1ug&google_cver=1&google_push=ATf1kGMwMFbwtjsevlw61-rsCOSV1aaQovN2YsaBElzsMKq8ku6Y2AEa_iuej7qoQJjvR2rZmnoFQBAZpCP...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGMwMFbwtjsevlw61-rsCOSV1aaQovN2YsaBElzsMKq8ku6Y2AEa_iuej7qoQJjvR2rZmnoFQBAZpCPLH1hB5VXaxDBfo65T
https://onetag-sys.com/match/?int_id=19&google_error=5

0
151 B

40ms
40ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip253.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 8909 0
12 B 47ms
47ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IZ5eCLEH43bXUJmc4lyFcfeRrSwh8e5Cxqpo1g2nBfUAYXiCjYT79xPGCENvYXtdIq1KQA8oc

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2A6B 1 KB
643 B 40ms
39ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 16203
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 18:15:11 GMT
etag: 48472445140208031
expires: Tue, 06 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 1D20 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f98843b649b83f024ffcc9743b12da4890498377a85a8a6248e2a9c5c3a80b7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 publishertag.prebid.135.js Show response
static.criteo.net/js/ld/ Frame AE4D 89 KB
29 KB 201ms
97ms Script
text/javascript 2a02:2638:d::2

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.135.js

Requested by

Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::2 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 24 Feb 2023 07:57:32 GMT
server: nginx
etag: W/"63f86dec-16386"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 06 Jun 2023 22:45:14 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7AD0 22 KB
8 KB 40ms
39ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 237151
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Jun 2023 04:52:43 GMT
expires: Sun, 02 Jun 2024 04:52:43 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/ Frame A236 6 KB
2 KB 40ms
40ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ca2839150a191933715a2171c06315672cc3475a13a0e1096bcb941f287b74d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 222147
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2410
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Jun 2023 09:02:47 GMT
expires: Sun, 02 Jun 2024 09:02:47 GMT
last-modified: Mon, 09 Jan 2023 08:05:13 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6B89 0
0 85ms
85ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss4IY9uiK2069m8Eb1EQ8ctPr950EeCIE8FyH_3aukHMOSgFtzex-pDax16hDJeuO55tUNicg839LNgNZzYnv84XzCx8LafdHgli-JsQiQUfiDjb46MXqGxAMO2qZ0LUc8wfxvzuSVIggj9x2FZjO5alY2WyxKioBdrE5p8D0h9uMTxRyGXykYkoX1M6TW0YaIepjUO5pgSRBXlPwEmhDk7x5ipg7QBdUuXBTVh0SRrZkY8xNIFxCJv3z-IY52bLtbb4ON0OvFi9s3QEghB8LIK8qyIudE6DK9fI9IdKcxmmVT1vrPXJs2xBc6Hk9PPc1r5cubLNAgY2tmph8npuwUXcFWaE2r--EFVqcN82PsukY5wHkrMt_o7ebFJKzypRFHkiDP5px9UUAkcGLE91mf7DB5KhCMDuybT884E_JP-Q2sV75t_cQN8EeRMSra6XZF1HKriHQQgjb1ewI7NsNM-4iKmwUq3BBO4NyhY0yasXkkRgcUuJ81pHhRiICN-921h6ahALP6IjKEtW78gXQ08IbtfanamX7USX-pPWofbC0rhi9Wy3w5SClkTiqVdTGIwtsg3JlKffMtONh2nSk3cfbA6SMQ2Sqlgi2_OA2BPQK2iECIkW3PfhW0tr4pFYa48rIiEonRNL8gGDYZXHdUTQki_cIVX_fOFb39OsIRlc-1eEktVtWY6C3DEerPOdmcP47e86vQO0TvlGngWNXaxiq9DNs3KTv8R5a7mUs68QnyMvH3P3XGRTXEen05ducr-kM2KAyBBOB_VTQV2qVTnAMM9N6MMsyK_VGfm4BlXM05AzAv8vPqv-nxhcgKJeuZrc3b8MWvy4K5Hx_Xhe7wVgMVdQI7T_zit3TnU0MFwAM3E_6Zc5Fs_kVSUA0ktdAkPTvSJdH-hfsdIP6qAuJjP7hBexT7Wh_o4ypiBdI1d_UAEzTRAbQjL3s0wBwY1YFrtxP2atYu6qfAm4mh2B9-Xd8X-bnMxlhyxzIU8WSKk5Cp0mWRxhg3j0mKQsr7_iDX6NaLRs6JyK1DiO_MZfMcoJ3R9NrRJOFV2ZvBUUHBON_rPhh3k2J4XpL4g2ocTjvy7GNsuCvBh2-TwUPWmAwHz89xmzGphcQVpjrGLkprLbMCqNpnIlw4GY5FAFR1TXF-dnsHvlE3bJ6OpmLlC2v08lgMth3QFU3pznfNL6nTI7ZK3p4QXEHcir3QUVC02eNuagnibPZxOwpq6EVoIT5Dr68gJfHAlJMpSk0FqETjVuyg&sai=AMfl-YRyG_jurTnk2llNWfKMG_1EohjpKhPl4ZP_-_kinxF1FcbMFoEuyXyY4Nk2RROhZ5WgrG0iIWkY37PxUBJpovaGyACRQ6KVvDH4Zp0MZRhPX-XmrA1Xqxf4A_aqbyWVB5HYzjXZMsyMqJxMdQNNmBDytrdbNC9lOnPfKfTN3-23Mt4Ogz0xILO5kQhug-3oRUgOUy1ULA0AZwSS03QictrzvG6DKGtA1avP5zT6Y6Kzv6tGy2rSf1mQBQGEdFc6yNYM&sig=Cg0ArKJSzAadjR55XvFoEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=320&cbvp=1&cstd=319&cisv=r20230531.93783&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3 200 styles.css
s0.2mdn.net/sadbundle/9170381621892120779/css/ Frame 3B77 6 KB
1 KB 42ms
41ms Stylesheet
text/css 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=8eJlrjiDq1&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

101470fcde40e5ad29c691a0cc4276b7e311972a8e02a684f19db29fd4698645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=8eJlrjiDq1&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 10:58:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215182
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1483
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 10:58:52 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 3B77 118 KB
40 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=8eJlrjiDq1&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=8eJlrjiDq1&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 07:18:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 55588
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 06 Jun 2023 07:18:46 GMT

GET
H3 200 overlay.png
s0.2mdn.net/sadbundle/9170381621892120779/img/ Frame 3B77 95 B
125 B 40ms
40ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/img/overlay.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=8eJlrjiDq1&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=8eJlrjiDq1&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 08:27:51 GMT
x-content-type-options: nosniff
age: 397044
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 31 May 2024 08:27:51 GMT

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/9170381621892120779/img/ Frame 3B77 6 KB
3 KB 40ms
39ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/img/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=8eJlrjiDq1&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b1bfbac0178604f4dce665117d962743d2916a2a37968438f3d49d7e9c04445

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=8eJlrjiDq1&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 08:27:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 397044
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2563
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 31 May 2024 08:27:51 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 3B77 60 KB
24 KB 49ms
49ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=8eJlrjiDq1&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=8eJlrjiDq1&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 05 Jun 2023 22:45:15 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 77BF 22 KB
8 KB 40ms
39ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 237151
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Jun 2023 04:52:43 GMT
expires: Sun, 02 Jun 2024 04:52:43 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 7A32 0
103 B 74ms
73ms Image
text/plain 2a02:fa8:8806:20::2010
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEMoNQcRvwQqc47m4Ykds4no&google_cver=1&google_push=ATf1kGMnveKeiso_RBkYNaNnHKLalYORNPELbgcraWa-pMs7VhB5g64-ttcQdyrUiMhnpIQjWD9J00ac0WQU7eMA3nIiTseu-rE
Requested by: Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:20::2010 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7A32
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEJkyNdrZhEwgr2gRBmTx5Eo&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEJkyNdrZhEwgr2gRBmTx5Eo&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ZUN3ZHFQTXoxUTZpV1M1&google_gid=CAESEJkyNdrZhEwgr2gRBmTx5Eo&google_cver=1&google_push=ATf1kGODF3RMcK6RFygVebQL000h8VK62h6qclwBN0WXbTP...

170 B
188 B

51ms
51ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ZUN3ZHFQTXoxUTZpV1M1&google_gid=CAESEJkyNdrZhEwgr2gRBmTx5Eo&google_cver=1&google_push=ATf1kGODF3RMcK6RFygVebQL000h8VK62h6qclwBN0WXbTP_SCw3UuaRFAOFSgGq0uDFIYGNRB3y_GxqJys8AYztFx9UDLwvnQ

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Jun 2023 22:45:14 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-777-g304ac51#rel-ec2-master i-0943143fd00beb9c6@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ZUN3ZHFQTXoxUTZpV1M1&google_gid=CAESEJkyNdrZhEwgr2gRBmTx5Eo&google_cver=1&google_push=ATf1kGODF3RMcK6RFygVebQL000h8VK62h6qclwBN0WXbTP_SCw3UuaRFAOFSgGq0uDFIYGNRB3y_GxqJys8AYztFx9UDLwvnQ
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7A32
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESECCHOmd4XGJr5DXYw8fjpDI&google_cver=1&google_push=ATf1kGPrYUVm-zPF_m-ZgdYvnJceRyyOa2Rg86VEDKjGE0SRdC8BXnR9aF6H-nHx4A2ant2971KkFYLTUXWagaU9...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGPrYUVm-zPF_m-ZgdYvnJceRyyOa2Rg86VEDKjGE0SRdC8BXnR9aF6H-nHx4A2ant2971KkFYLTUXWagaU9xzpxLh1Xjg

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGPrYUVm-zPF_m-ZgdYvnJceRyyOa2Rg86VEDKjGE0SRdC8BXnR9aF6H-nHx4A2ant2971KkFYLTUXWagaU9xzpxLh1Xjg

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 05 Jun 2023 22:45:15 GMT
Server: MT3 851 9bd98ae master cdg-pixel-x25 config_version:"558"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGPrYUVm-zPF_m-ZgdYvnJceRyyOa2Rg86VEDKjGE0SRdC8BXnR9aF6H-nHx4A2ant2971KkFYLTUXWagaU9xzpxLh1Xjg
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7A32
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEC84P6oaCWTKO3GwhA7G3Gg&google_cver=1&google_push=ATf1kGMrVZNYe_FFsr5irgG9oEbvN4qqdiUpZf0u6rbEg5vaZUh3jhhv4xosUtl7XtBC0z_LlQvjQvfxMaZ6Xu9BO4af...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEC84P6oaCWTKO3GwhA7G3Gg&google_cver=1&google_push=ATf1kGMrVZNYe_FFsr5irgG9oEbvN4qqdiUpZf0u6rbEg5vaZUh3jhhv4xosUtl7XtBC0z_LlQvjQvfxMaZ6Xu...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGMrVZNYe_FFsr5irgG9oEbvN4qqdiUpZf0u6rbEg5vaZUh3jhhv4xosUtl7XtBC0z_LlQvjQvfxMaZ6Xu9BO4affidrMtY&google_hm=jo6tjZfCR1GePJ95i2i0DQ==

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGMrVZNYe_FFsr5irgG9oEbvN4qqdiUpZf0u6rbEg5vaZUh3jhhv4xosUtl7XtBC0z_LlQvjQvfxMaZ6Xu9BO4affidrMtY&google_hm=jo6tjZfCR1GePJ95i2i0DQ==

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGMrVZNYe_FFsr5irgG9oEbvN4qqdiUpZf0u6rbEg5vaZUh3jhhv4xosUtl7XtBC0z_LlQvjQvfxMaZ6Xu9BO4affidrMtY&google_hm=jo6tjZfCR1GePJ95i2i0DQ==
date: Mon, 05 Jun 2023 22:45:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7A32
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEFhm_HRkv0u2nK_GP_qaQ1c&google_cver=1&google_push=ATf1kGOEemKVhLZCN9roY5n-3z8UKAWsrvSsuCC1APVcLMshetQTsGIjdyWn-cKLrLvq9Ordn5wF39Scx3QBJek_pnPjbYuY-3Y
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=ATf1kGOEemKVhLZCN9roY5n-3z8UKAWsrvSsuCC1APVcLMshetQTsGIjdyWn-cKLrLvq9Ordn5wF39Scx3QBJek_pnPjbYuY-3Y...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDY0NTk5OTM4NTA0MDY5NzgzODgwOQ%3D%3D&google_push=ATf1kGOEemKVhLZCN9roY5n-3z8UKAWsrvSsuCC1APVcLMshetQTsGIj...

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDY0NTk5OTM4NTA0MDY5NzgzODgwOQ%3D%3D&google_push=ATf1kGOEemKVhLZCN9roY5n-3z8UKAWsrvSsuCC1APVcLMshetQTsGIjdyWn-cKLrLvq9Ordn5wF39Scx3QBJek_pnPjbYuY-3Y

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDY0NTk5OTM4NTA0MDY5NzgzODgwOQ%3D%3D&google_push=ATf1kGOEemKVhLZCN9roY5n-3z8UKAWsrvSsuCC1APVcLMshetQTsGIjdyWn-cKLrLvq9Ordn5wF39Scx3QBJek_pnPjbYuY-3Y
date: Mon, 05 Jun 2023 22:45:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7A32
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEMPxhWV2au7li-5DBO-UXLI&google_cver=1&google_push=ATf1kGMse0jQZx__4mxCP1DUJi-q8GvFTIsmd7Zf4hyxCsHfhkt_CoO8I_BqlmZlmyQBErJrkT...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS05MFc1UGdWRTJ1RmZrU2F4M1J4X2FQUmczcHhQSlQ2SX5B&google_push=ATf1kGMse0jQZx__4mxCP1DUJi-q8GvFTIsmd7Zf4hyxCsHfhkt_CoO8I...

170 B
188 B

50ms
50ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS05MFc1UGdWRTJ1RmZrU2F4M1J4X2FQUmczcHhQSlQ2SX5B&google_push=ATf1kGMse0jQZx__4mxCP1DUJi-q8GvFTIsmd7Zf4hyxCsHfhkt_CoO8I_BqlmZlmyQBErJrkT_GTp2IfoSPf3XmKIIFfttFNEY

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS05MFc1UGdWRTJ1RmZrU2F4M1J4X2FQUmczcHhQSlQ2SX5B&google_push=ATf1kGMse0jQZx__4mxCP1DUJi-q8GvFTIsmd7Zf4hyxCsHfhkt_CoO8I_BqlmZlmyQBErJrkT_GTp2IfoSPf3XmKIIFfttFNEY
date: Mon, 05 Jun 2023 22:45:14 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7A32
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEN8C1oZ8V7pCnpoi3aqUkNw&google_cver=1&google_push=ATf1kGMUgZSkYHXGy...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MTk0MTA0NzQzODA0Mjc5Nzk5MQ%3D%3D&google_gid=CAESEN8C1oZ8V7pCnpoi3aqUkNw&google_cver=1&google_push=ATf1kGMUgZSkYHXGy_l2S11Yf0DbLeQyjy...

170 B
188 B

50ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MTk0MTA0NzQzODA0Mjc5Nzk5MQ%3D%3D&google_gid=CAESEN8C1oZ8V7pCnpoi3aqUkNw&google_cver=1&google_push=ATf1kGMUgZSkYHXGy_l2S11Yf0DbLeQyjyZ93_xGIqsPPMa0y99xr5-OUP2jEgIEh537hlwVponR-1Qc7x70JP8--FQIQkfFgc7G

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 05 Jun 2023 22:45:15 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 80.255.7.100; 80.255.7.100; 1001.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 0727ba74-db3b-4b22-9073-a2ef7a5e9a2c
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MTk0MTA0NzQzODA0Mjc5Nzk5MQ%3D%3D&google_gid=CAESEN8C1oZ8V7pCnpoi3aqUkNw&google_cver=1&google_push=ATf1kGMUgZSkYHXGy_l2S11Yf0DbLeQyjyZ93_xGIqsPPMa0y99xr5-OUP2jEgIEh537hlwVponR-1Qc7x70JP8--FQIQkfFgc7G
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 7A32 0
12 B 49ms
48ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LiNBiZ2iFVrFsiJoN6plcTmCbyVMwEpEj87Q2OvKiGMyeGwZImRwYfCGYFqCsprgYRbYuus8Q

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/ Frame 29C5 6 KB
2 KB 40ms
40ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ca2839150a191933715a2171c06315672cc3475a13a0e1096bcb941f287b74d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 222147
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2410
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Jun 2023 09:02:47 GMT
expires: Sun, 02 Jun 2024 09:02:47 GMT
last-modified: Mon, 09 Jan 2023 08:05:13 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7E03 0
0 87ms
86ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstZD1_a2IF4KQGUiT0qVUak7iNG3rHrLoMeu4GaEdqwKxx-amzDHuAPuIKUo_g6iUoeuz_U5AjXz3wL9oUi4TtEi7xS269LB6hnVvrjRR4G0xBLfeiSD2njRSfCh1uYKekZvmIL9CInKaM8VIWGrxaoYZo34Oq1v85p6LNubYhm-vFkXY8B5z06Z74o9gnomAI-n4HQJyLxoeiPkhxw1pdZERODU5BRBgkv6LOJ6S8f0y6Z3gAcIh3VQ94LgO3pGRnQswHO8P1moGoE8lqxexes-tOWHIKG9RclQzGYcfVOd8bRmrmcXpF4BwwaTY5pTFZvoG3M4yLVRlhDvmYHOpQeUOXsbF1FPCS2Y2xOWdKoJBcxYsTggUeovTLgUGVdIVvwHmxSFFwspjVUs6Uwoit4HjQtBo0MfrK97dsOiQy8ZMAN-xQgbaXg2136UABcaEsFNQOPuIy2GSQmgVGqQwGT1nxGVZoh-rcCl85aJsSAjfP01gPgH_o2WqRewvQH2OFeJjWXIl0aA7h9Q3zWsA1_QpRRQRN3cRpViai7GmEZ8DIPloXVKKvUwE4YVfL56aKUQcOEjO_sN77X4PC_tAkLqM6VwV9mtnZSoMweibALtFrVHWNC-_xtbviSGhqkxWTG3Vw8HlorzAYKlKhQ0-XGymZsgzphgqOeWoAatlOEjYdHipwEqrgD8BM1-FqDuu7ZFKWqI6BJSKQiagA_Fa5JnokxaUZ8Rna1kBkFaFm0xjYey6ltiWpx0D_f7jpqX_BQhdcwPfjFicLWnAKHSCNKg-xR-pd781BomuWESYhxsm-UP-lxuIw5pc9UeiN57OBV712247-SnXq-XC5h5gfo4kq3IFkO168cRgznqPOK6U3Vj2egK6j6K3OE04AmA1BDAweb9_KiRRbaXaftJxuUEH4-w7qF5ev6cYgQLNxEt_E_LZba5xqYvdUdN7WrrpDxLWPr0qYT7qrYpVC1XurLPAROTv09zFlAkg6MMPWx9Wd_9WERSzh-GE3ewXox3MxPNYCWseCJp61EagRq4mHox7kVYiixbECq3alYICgI7iRzS_n0hlDqgBjk146HMlxzO2sfPtiwl_gbiyxsgZd-85oBLSGgSt8cJoT7GVrHgJg9zS6tW3bH2RjVbeak1b4yV4TwebGG0KjkhBPhIgZ9uSr16eruHD30J9bL-d4g4yen0lsBIAgm7Hryajldw3uSCkEIH45cNMV8mRhf_McUNYAlRXEjOw6zHMESglaYhmE&sai=AMfl-YR7qlCTJWi91fyGs-X_pTjLStPnrcTjhZ_6h4WcKAzPXKh82VM_izEr7JFsT7Rp6k3anwkh7w_ddukaRoeNZYoJQS1j5enDrLZbn99Gg5fm18rkEpqayqHXwEV_9kqYMGUB0yl_eODM0CFKO-O-iQMEaPZRD1yn73y3CorJb7gcKRG9pakgkEtnwX4VM-XNwfdxVel1EaPG2nT8_Peh8IkbJJAD43ndsfMQpxueOmHjYMFy3y9GDm3g4QXAwIPXoaDY&sig=Cg0ArKJSzNZkwkzYvQhHEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=325&cbvp=1&cstd=323&cisv=r20230531.03625&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 05 Jun 2023 22:45:14 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:14 GMT

GET
H2 200 5ed76f76e4b07a92411bc03a
ng2.virgul.com/tck/imp/ Frame AE4D 0
209 B 88ms
81ms Image
text/plain 185.7.176.221
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng2.virgul.com/tck/imp/5ed76f76e4b07a92411bc03a?g=1&t=gb&r=153377@site_geneli@yemek_net:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1%2Cgprec%3Dyemek%26rec_ing%3D&info=&mt=1686005112834&userId=vnet03f0366d-a599-434b-a4a4-0599471fc76b
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Mon, 05 Jun 2023 22:45:15 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H3 200 uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js Show response
pagead2.googlesyndication.com/bg/ Frame 9AB6 37 KB
14 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8afd59a03bcb312667b449341fdd15f86861886ef702e46479e76805353e1d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:24:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19248
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14644
x-xss-protection: 0
last-modified: Tue, 30 May 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Jun 2024 17:24:26 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 7424 0
103 B 51ms
49ms Image
text/plain 2a02:fa8:8806:20::2010
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEMoNQcRvwQqc47m4Ykds4no&google_cver=1&google_push=ATf1kGP5vJxp1PQK1w7hTFvTQ_V9ajVUwIzCyJSTn6uO0izVzYZXkK7HiZV3xPPA6bc08YLjkDVueQVZ5sN8mAobhWfhBX5bwAwF
Requested by: Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:20::2010 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 7424 43 B
363 B 146ms
42ms Image
image/gif 178.250.1.9

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DPUSH_DATA&google_gid=CAESEBJV1h3hwVV9XGu7aihzokw&google_cver=1&google_push=ATf1kGMIqEYUQt-Juq2nlJsagyj10ITR4Fi1Tdc8B016shgMMo3frhZ7Pt1EKc6rgY2_Ia0pItPVhp3RZ9UULKcQAQaaD2G1UXUW

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 218899
expires: Mon, 05 Jun 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7424
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=IM4zUhdOSACUwFPWMEIGig%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

54ms
54ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=IM4zUhdOSACUwFPWMEIGig%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGNeUnk2y1xoetGXppeH-novK9av1CzNOUW-RM3Ig_uuAY1XneEAJdiLcVju6VOBKoLnrm4AUm6L8NZdjRGtLhB7-qa0VG4P

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=IM4zUhdOSACUwFPWMEIGig%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGNeUnk2y1xoetGXppeH-novK9av1CzNOUW-RM3Ig_uuAY1XneEAJdiLcVju6VOBKoLnrm4AUm6L8NZdjRGtLhB7-qa0VG4P
date: Mon, 05 Jun 2023 22:45:14 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7424
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEF5JMqvfdoYZkNd9Liy4weM&google_cver=1&google_push=ATf1kGOddMx2TM2Yo1kqFAPAWSuO_q6IiM1yOx26V-9eYi8v5TV3EoG-WnWcKUrrZhQyJkH4B7QACJEXQVrr_IO9PJi1Oc...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEF5JMqvfdoYZkNd9Liy4weM&google_cver=1&google_push=ATf1kGOddMx2TM2Yo1kqFAPAWSuO_q6IiM1yOx26V-9eYi8v5TV3EoG-WnWcKUrrZhQyJkH4B7QACJEXQVrr_IO9...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=Gh_KP_NETw6aI9SC-Ffl_A&google_push=ATf1kGOddMx2TM2Yo1kqFAPAWSuO_q6IiM1yOx26V-9eYi8v5TV3EoG-WnWcKUrrZhQyJkH4B7QACJEXQVrr_IO...

170 B
188 B

49ms
48ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=Gh_KP_NETw6aI9SC-Ffl_A&google_push=ATf1kGOddMx2TM2Yo1kqFAPAWSuO_q6IiM1yOx26V-9eYi8v5TV3EoG-WnWcKUrrZhQyJkH4B7QACJEXQVrr_IO9PJi1Oc6hDFgK

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=Gh_KP_NETw6aI9SC-Ffl_A&google_push=ATf1kGOddMx2TM2Yo1kqFAPAWSuO_q6IiM1yOx26V-9eYi8v5TV3EoG-WnWcKUrrZhQyJkH4B7QACJEXQVrr_IO9PJi1Oc6hDFgK
access-control-allow-origin: *
date: Mon, 05 Jun 2023 22:45:15 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2 200 sync
ssbsync.smartadserver.com/api/ Frame 7424 0
44 B 51ms
50ms Image
text/plain 185.86.139.102
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEKFjmSFShGQlVhGndOFA5bI&google_cver=1&google_push=ATf1kGOnIbfAqxuomEowXD7CZ8dc-dtqqnFF5CExawQKH0bUNZBqx3GXeEUYsGbrChvqyxdaNxAt1F4UL9pprnLyJubDauJbu6TK
Requested by: Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.102 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7424
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEN8C1oZ8V7pCnpoi3aqUkNw&google_cver=1&google_push=ATf1kGPiYutsTFQO1...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MTk0MTA0NzQzODA0Mjc5Nzk5MQ%3D%3D&google_gid=CAESEN8C1oZ8V7pCnpoi3aqUkNw&google_cver=1&google_push=ATf1kGPiYutsTFQO1Xi_DFGC96n0l4rs8a...

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MTk0MTA0NzQzODA0Mjc5Nzk5MQ%3D%3D&google_gid=CAESEN8C1oZ8V7pCnpoi3aqUkNw&google_cver=1&google_push=ATf1kGPiYutsTFQO1Xi_DFGC96n0l4rs8a520pl9Wtt7w66iIv-Flt1NBulnEMCSDnqHWl5XjsluQ5a6CKj1zX41-c_vFmcASvLuPg

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 05 Jun 2023 22:45:15 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 80.255.7.100; 80.255.7.100; 1001.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 00974fda-e9e3-4fb1-ae10-09945c4bef80
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MTk0MTA0NzQzODA0Mjc5Nzk5MQ%3D%3D&google_gid=CAESEN8C1oZ8V7pCnpoi3aqUkNw&google_cver=1&google_push=ATf1kGPiYutsTFQO1Xi_DFGC96n0l4rs8a520pl9Wtt7w66iIv-Flt1NBulnEMCSDnqHWl5XjsluQ5a6CKj1zX41-c_vFmcASvLuPg
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7424
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEKTJM3h-s...
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEKT...
https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=8e8ead8d-97c2-4751-9e3c-9f798b68b40d&%%GOOGLE_PUSH_PAIR%%

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=8e8ead8d-97c2-4751-9e3c-9f798b68b40d&%%GOOGLE_PUSH_PAIR%%

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=8e8ead8d-97c2-4751-9e3c-9f798b68b40d&%%GOOGLE_PUSH_PAIR%%
date: Mon, 05 Jun 2023 22:45:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 7424 0
12 B 48ms
48ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LSbEXYfVxJGn_VFpn2AxLzw0M3hTsd_tt_BbJQgrDysAkk2ddfQT0o4Y1mA2BSaSFvJ0sYmRw

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:14 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/18023719642905169595/ Frame 5B86 4 KB
1 KB 41ms
40ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18023719642905169595/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9c7a67c3d44c39ec0b46ca27dbd51e84b709212fc6cc5a901c34c1944fdcab8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 186093
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1505
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Jun 2023 19:03:41 GMT
expires: Sun, 02 Jun 2024 19:03:41 GMT
last-modified: Wed, 26 Oct 2022 05:45:57 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 097C 0
0 88ms
86ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsudUnGr5Rin27yN9PGmz13-29shI-OnmgTaOP-p1SQDynTgKpCLWouo9phz0bCOZAEeSHaeCQECM9pbNfSNH9BXkbiOHJPeWlRhEEKkCyO7Td18M4kC-uk696cwBKeUzxf9DHd6RwNVoLvcAYYl_1NORuZ8RALapq28zt_9HnHOUsyj7J9CRObFmw2a8jqbMY5YgUt7aHwQcKrqx5z7BQeGdqa9SYwCHfWOwhIS_ITyShP6llyRhWvltNrKPXVq_0Msf_cyx9gfOnXhzbzzmFK5Owm02B5uIE1vCtLlOGfLH11L6i0gJ1Aiy3CHqIb96mLmB6o1nZ2F9t7eEGGgyaSwKfPTUTA3yMD_3RxOWXCmAq6k9gmAGbmGa4VEVSUhXSqqfaO30P7qSpQR4qOOJK-uZ4_hBB3SuoZbfqXfjVP_s9MxPu5MgNab2n-P31ySX2sOoS86LmSDYHLY_izdPN9QjAbZKlP27ORB_oE2qxz1x9--gdPalHt-GyYD5u_r0_3mWewMScgNu9McxlKVfC4ChbcUAK5AjcmhAUl9kOiBiQ_Imo6R3L9JMJ9G8nio6cQK1ZlccOqeoLduK6-HXsCUOaGnqvtETgxX3eKd1Q96OES0PMI5ukUHPt7FNfxd8vKoT0VBJDTid_RrymHVWkVfSDQDQQ48KpCH1UzRn4LnUcamX02ZIABkzDYyem8u2rl22jHf0rdIpgGbZVOHaTWRYlkvWuqvDgl7UMDmF7ID0qLOS8oiP7LLcqVSVbL-JzgU681BenJU9NNNqcQTun8wIpiaX3wA1_osvxbkmb2D8hpIZ8JaxRZryEIIsGpXvxSQRsGnjIyxee3Dw7EIThScHCw63OMIJj8TKAXzWmCHHqSGjIf6-ZmOiuMIOUM22FN73oRJcl-2SJyLjoCk4AG7ZWm7nlvj26JCwMTs73OKYC1VBqPbWgPdlwvofLfvlI2WJAmTn9pw-HMtRREkO2lznA2oSNcsco1tE8c0u2_Kp4UGQJ-C_uV7IwZEaIPNjcH4sXSHAKKm_qBKs3uU7ru3lD9aNa3SeDx9O_sLnoqi6kW8FCbNnYoLTMiqD3OINtR2grx6V_0eEALIumu0b-rXE2UR9T69ObZO2Nw09F3x_PvYhrQ2Y9Uzr08i7_CucEGfyrgRenK2KvKbyR-WlHzXqfbM2k4eWg8xj8_paWrqxi-4-QliPW_ecmT1qY7rGmaLqaECIi6J92Hl7xA8cBNaSiP9DhoiPcweQoT9ymslvYdbHecwkzsGY8sja_wxHINPghz70ZcUMHEVY0Gq5A&sai=AMfl-YQXcyKCvUvjhnY9VZt6z8tPkkzrELxFhthDwIiaFyQIb3SPOA0eRjIjwWtHHeDCGOzWllztpEomZPWjsYfM8rgYEcoVNKL67KkIsMha2hv1uMKpVRIcXAVyT6is6JksCD-0dMYaMDgNd0kRjwkxZul40fz4A4immNFXgg_XZop97zhYTyecTRtibD8LsFTdy-ug6-8w08KFQix6JCo5yyLssDBzWQDv6wTOdw1FIxu44VOzfM82oaK3Ntm4leeTVvFj&sig=Cg0ArKJSzEGHvjZ2mdQXEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=292&cbvp=1&cstd=290&cisv=r20230531.71848&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:15 GMT

GET
H/1.1

200
OK

px.gif
d.adtriba.com/ Frame 097C
Redirect Chain

https://d.adtriba.com/collect?atb_ptid=f65079e0&atb_dcaid=202210_es_hunger_dv_pros_347628237&atb_dpuid=di_dv&gdpr=&gdpr_consent=
https://d.adtriba.com/px.gif

42 B
227 B

41ms
41ms

Image
image/gif

52.29.216.32

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adtriba.com/px.gif
Requested by: Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: HTTP/1.1
Server: 52.29.216.32 -, , ASN (),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Mon, 05 Jun 2023 22:45:15 GMT
Cache-Control: public, max-age=86400
Server: nginx/1.16.1
Connection: keep-alive
Content-Length: 42
Content-Type: image/gif

Redirect headers

Date: Mon, 05 Jun 2023 22:45:15 GMT
Last-Modified: Mon, 05 Jun 2023 22:45:15 GMT
Server: nginx/1.16.1
P3P: CP="This is not a P3P policy! See https://www.adtriba.com/privacy-policy.html for more info."
Location: /px.gif
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 01:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/9170381621892120779/ Frame F816 13 KB
3 KB 49ms
49ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=IHYajvLzwn&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

691257cf7d510da3434f5eedca2b2e0137949c698e3750c7705526a1ee75684c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2744
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:15 GMT
expires: Tue, 04 Jun 2024 22:45:15 GMT
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1D20 0
0 86ms
85ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstx7pf0Qo4DqM1FKHZxyu9inDgCDJOY96k5DI4rdMycQcZIZUFbob_r4xOEQuh8_8gY6HnTON_2gXlp0q2toVjLg5KrekbVfB-xkT559-_yHQ4IU7X2G9kTGeLb8qPRH64jE_7SZw-wGso_QBaMQ5yUo7KBzOtWQ0L4OZaugR1n7yeesGDRR8UaHBNeIhrVZIL7eS_gel_ojtqQGDStValD7H4-wKzqplot0yTvcbHvBJ1xlW0vQoVBi5WBks_nRAW_VoKwe3hpbXAmwewZYKVp5CqpkciKhOOy4Gk2qXPkttCp0Qo7S_VmyhLyqSzWtVHEBm55Ae3c1NHwudFTKIk_k969LLGPfcxDD_y6tbPnjkE3BVR5eAYk23dzeT1Vn3gzldBO8z19czP1SRxZECJp20BqpI70yMAY6UrQO_TckZ4W6Ws4Lpgql_YxJ-tQzzfhIFmoI6QWzuDbL9AXbyM7f-OpMANpofC7n12NdO_49s330PGsAFyG4nHCbcdBoxF7taOe8Db1J4toI0XYPSOrRWhhCzGijLDEUh0bcu3U9xEsatBDDURh_9l5q9HYaack0EBJ_29BNVmu901KJbSgAyqhfTpkWc9e0ITMubbZG6pKRtFXA7yn5uEPQrSugqqsNtPgy6pY1T0nao5sY1k7h4zGIjBj_eaVMQUQCwHKRapwi2YD_DQ7M38DNJHvm7Jlcs_FHZuYj3C4upzeRUPD5iuoGrYKbtoALL_doRQJdOSg0tnt114WoBq4UTuOiBDjXOYFF2QbUYdEc0B0P2A4wZdsetCEQS2JqFehLug4Z3QNvG5rhwolJElZHuf1yGVztcpIiTTs83dXr30W5ELE1PH7ceRXl5-j1tab9Rk3gtfsGzVvQyL5O1Mz6pzMmuROQHf2LNC9itBdMfHgIdU8lWuP7xFFch5WHg3kc6I6Aed34JQcJaECQPFFFgRN84GpHNydyBtYIsW2ph9Hx9RaGKbR4x1KYuLmDJYv5InlBYtPiT2KXt_LQ5Uy0gKjTc39vt19sUoACBfbmpsHpAwlz0-9NRXAvx4PzCl2nSo0Aad_bZbf3o2mF3xDyYuumCPoHMacM7DVllJfhg3K0dQGd_X1_WY27Q0xj1iOxLvyqOdAjO17zwonMoX9ldGsUUFwKvHwJcA91uV3JS1hq6eC8Py4saR21TgcJ9zqG8sRRYdwzpXhv2pfQaMCLE1n0NN9-cfVeJvRXOi0UYqXWovlS-Q-2P5BNgitH2ivIJ7pkELKdJOpEp8NgM1S85KEyuEKgocW6mdd4bWLxAXQL2k&sai=AMfl-YQFbixTKbHqKvw-wy7gFmFxEIboe0lL6rLUUviLdn3UQAT7OIBLgE5plrv7guLTSzaVyYQ3FBZkkINJoDv9h8BcLP-8SQNt92R1UtjoUYsvsyOpAYnsY_PdU3F726G3uYRoXUHu3tPnGMeLiFEhJCsKMn7LKH6cnRQPQHytdnaZ9eXiP5HgwZ-E8PCmf0qKuyPt2MAC3C6XXfthQIoT4_VWjetXF5iYIafUR9fhKdaBpdFYZMwnhFsuqe7uq08bO3LnWeHuppSO8cUCpJyl3oFtmqC0Rg&sig=Cg0ArKJSzEY6K8NoYSBXEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=283&cbvp=1&cstd=277&cisv=r20230531.99306&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Mon, 05 Jun 2023 22:45:15 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 74CB
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEIjxASikVYq9iDm12bdWqNM&google_cver=1&google_push=ATf1kGM1ZFX_Z_BPnRCsW9GHLTwi9seBKwMs0nl7GfFtcydgHEj8E9HuehuZPcLhrt0QznjmDWXxINC96etAanhYuQ-Fmt3u3SMHj...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEIjxASikVYq9iDm12bdWqNM&google_cver=1&google_push=ATf1kGM1ZFX_Z_BPnRCsW9GHLTwi9seBKwMs0nl7GfFtcydgHEj8E9HuehuZPcLhrt0QznjmDWXxINC96etAanhYuQ-Fmt3u3SM...

43 B
414 B

218ms
208ms

Image
image/gif

2606:4700::6812:19ad

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEIjxASikVYq9iDm12bdWqNM&google_cver=1&google_push=ATf1kGM1ZFX_Z_BPnRCsW9GHLTwi9seBKwMs0nl7GfFtcydgHEj8E9HuehuZPcLhrt0QznjmDWXxINC96etAanhYuQ-Fmt3u3SMHjA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGM1ZFX_Z_BPnRCsW9GHLTwi9seBKwMs0nl7GfFtcydgHEj8E9HuehuZPcLhrt0QznjmDWXxINC96etAanhYuQ-Fmt3u3SMHjA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Server: 2606:4700::6812:19ad -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7d2bf1e30b401957-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 660
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEIjxASikVYq9iDm12bdWqNM&google_cver=1&google_push=ATf1kGM1ZFX_Z_BPnRCsW9GHLTwi9seBKwMs0nl7GfFtcydgHEj8E9HuehuZPcLhrt0QznjmDWXxINC96etAanhYuQ-Fmt3u3SMHjA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGM1ZFX_Z_BPnRCsW9GHLTwi9seBKwMs0nl7GfFtcydgHEj8E9HuehuZPcLhrt0QznjmDWXxINC96etAanhYuQ-Fmt3u3SMHjA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7d2bf1e16a0e1957-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 74CB 70 B
265 B 171ms
54ms Image
image/gif 3.33.220.150

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEF1wuZNerIH5OykAJOOlFwI&google_cver=1&google_push=ATf1kGO41d4TqiR-FHhj5lOc-RDaKpQSjcduGnQXgGRL9sQrgbcVCJAMtD7skwUPRLDs_ZGPU7R_oYiRZ9ci8MmX9z3235A3OeZMJw
Requested by: Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 74CB
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEG4ZlllGHGSugYXZUv6i790&google_cver=1&google_push=ATf1kGP1EKYo0C0NRJqb_XqQDSR752q7Ah9FOBzhDv0vaCkn0JaK010_rUtkw-O5MBrE32WOQaYJG1P_0GuHv6aWUOKd32F...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGP1EKYo0C0NRJqb_XqQDSR752q7Ah9FOBzhDv0vaCkn0JaK010_rUtkw-O5MBrE32WOQaYJG1P_0GuHv6aWUOKd32F7AGVt&google_hm=eS1XZTRvVWI5RTJwRndRVE...

170 B
188 B

50ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGP1EKYo0C0NRJqb_XqQDSR752q7Ah9FOBzhDv0vaCkn0JaK010_rUtkw-O5MBrE32WOQaYJG1P_0GuHv6aWUOKd32F7AGVt&google_hm=eS1XZTRvVWI5RTJwRndRVEdnQ1BMQWlwM1VHYmlDMGZlVX5B

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 05 Jun 2023 22:45:15 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGP1EKYo0C0NRJqb_XqQDSR752q7Ah9FOBzhDv0vaCkn0JaK010_rUtkw-O5MBrE32WOQaYJG1P_0GuHv6aWUOKd32F7AGVt&google_hm=eS1XZTRvVWI5RTJwRndRVEdnQ1BMQWlwM1VHYmlDMGZlVX5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 74CB
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEO6BaQhm36w3rv1kS3Z4Rm4&google_cver=1&google_push=ATf1kGMc-PJfmWqG-qjt0XnvkAwrjT_t_-GZEUAgy9LdDkjXAnS-balIfG8NM6KihWQh2mJXbPwh8DMbQRTehlLFGKtz_X3...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEO6BaQhm36w3rv1kS3Z4Rm4&google_cver=1&google_push=ATf1kGMc-PJfmWqG-qjt0XnvkAwrjT_t_-GZEUAgy9LdDkjXAnS-balIfG8NM6KihWQh2mJXbPwh8DMbQRTehlLFGKtz_...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGMc-PJfmWqG-qjt0XnvkAwrjT_t_-GZEUAgy9LdDkjXAnS-balIfG8NM6KihWQh2mJXbPwh8DMbQRTehlLFGKtz_X3hw3nWsA

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGMc-PJfmWqG-qjt0XnvkAwrjT_t_-GZEUAgy9LdDkjXAnS-balIfG8NM6KihWQh2mJXbPwh8DMbQRTehlLFGKtz_X3hw3nWsA

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGMc-PJfmWqG-qjt0XnvkAwrjT_t_-GZEUAgy9LdDkjXAnS-balIfG8NM6KihWQh2mJXbPwh8DMbQRTehlLFGKtz_X3hw3nWsA
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 74CB
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESELaSeJDNfPfTZrrTy-rosQ4&google_cver=1&google_push=ATf1kGOs7OvOXF-PqKkq7s3WWdYtJGvM_Esfc4xChc4slfA8EwN7eJN9ztCbrVEoyAHUni0fVpCQC_c_pvpaUvvK...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGOs7OvOXF-PqKkq7s3WWdYtJGvM_Esfc4xChc4slfA8EwN7eJN9ztCbrVEoyAHUni0fVpCQC_c_pvpaUvvKPmX3MA0xmHdooQ

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGOs7OvOXF-PqKkq7s3WWdYtJGvM_Esfc4xChc4slfA8EwN7eJN9ztCbrVEoyAHUni0fVpCQC_c_pvpaUvvKPmX3MA0xmHdooQ

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 05 Jun 2023 22:45:15 GMT
via: 1.1 a7322dae74179db004d6fbdc1e7dc03e.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: MUC50-C1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGOs7OvOXF-PqKkq7s3WWdYtJGvM_Esfc4xChc4slfA8EwN7eJN9ztCbrVEoyAHUni0fVpCQC_c_pvpaUvvKPmX3MA0xmHdooQ
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: OD0MsZMnlyAk1iqFbFEHrL4FKHWLQ6Dtq2WRMJkZJ85SNUL9rB5PlA==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 74CB
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEFhm_HRkv0u2nK_GP_qaQ1c&google_cver=1&google_push=ATf1kGOgW09kWxhD8jJXq7iYIGcWeE8Do-bEwTRrpNbQkle3EMKJz3_bg87IE24K7cgXSqLdgQpRd2LLLO3SLVehp8ZyPFf8ST...
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=ATf1kGOgW09kWxhD8jJXq7iYIGcWeE8Do-bEwTRrpNbQkle3EMKJz3_bg87IE24K7cgXSqLdgQpRd2LLLO3SLVehp8ZyPFf8STj...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDY0NTk5OTM4NTA0MDY5NzgzODgwOQ%3D%3D&google_push=ATf1kGOgW09kWxhD8jJXq7iYIGcWeE8Do-bEwTRrpNbQkle3EMKJz3_b...

170 B
188 B

50ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDY0NTk5OTM4NTA0MDY5NzgzODgwOQ%3D%3D&google_push=ATf1kGOgW09kWxhD8jJXq7iYIGcWeE8Do-bEwTRrpNbQkle3EMKJz3_bg87IE24K7cgXSqLdgQpRd2LLLO3SLVehp8ZyPFf8STj6oQ

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDY0NTk5OTM4NTA0MDY5NzgzODgwOQ%3D%3D&google_push=ATf1kGOgW09kWxhD8jJXq7iYIGcWeE8Do-bEwTRrpNbQkle3EMKJz3_bg87IE24K7cgXSqLdgQpRd2LLLO3SLVehp8ZyPFf8STj6oQ
date: Mon, 05 Jun 2023 22:45:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 74CB
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEN8C1oZ8V7pCnpoi3aqUkNw&google_cver=1&google_push=ATf1kGN2TZCTaa3Y4...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MTk0MTA0NzQzODA0Mjc5Nzk5MQ%3D%3D&google_gid=CAESEN8C1oZ8V7pCnpoi3aqUkNw&google_cver=1&google_push=ATf1kGN2TZCTaa3Y4K9ptS1zHzRxLHBeX3...

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MTk0MTA0NzQzODA0Mjc5Nzk5MQ%3D%3D&google_gid=CAESEN8C1oZ8V7pCnpoi3aqUkNw&google_cver=1&google_push=ATf1kGN2TZCTaa3Y4K9ptS1zHzRxLHBeX3yqlrTRpqj-eV0RtxFUh_SE6lxHzaVZwNpjYLnUSqcig-G7pRHePUruRSeGcxzze8ZAqg

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 05 Jun 2023 22:45:15 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 80.255.7.100; 80.255.7.100; 1001.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 3e68836c-5e8e-49a5-bdb0-d03c58f864ca
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MTk0MTA0NzQzODA0Mjc5Nzk5MQ%3D%3D&google_gid=CAESEN8C1oZ8V7pCnpoi3aqUkNw&google_cver=1&google_push=ATf1kGN2TZCTaa3Y4K9ptS1zHzRxLHBeX3yqlrTRpqj-eV0RtxFUh_SE6lxHzaVZwNpjYLnUSqcig-G7pRHePUruRSeGcxzze8ZAqg
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 74CB 0
12 B 49ms
47ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JISDvfLWfVwK5n1EyOycbYMRhHxot5bz2pDeKUY_yQcw6qyNyoIhfTB77eIqPtIyXbykXBKw

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame A236 236 KB
63 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 05 Jun 2023 22:45:15 GMT

GET
H3 200 roller-kwxx-160x600.js Show response
s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/ Frame A236 20 KB
4 KB 40ms
40ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/roller-kwxx-160x600.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82d23f5b5214b672baef7ec1017a650d679fadbefc694b4033199d7e63a733eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 05:58:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60395
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4001
x-xss-protection: 0
last-modified: Mon, 09 Jan 2023 08:05:13 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jun 2024 05:58:40 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 29C5 236 KB
63 KB 52ms
52ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 05 Jun 2023 22:45:15 GMT

GET
H3 200 roller-kwxx-160x600.js Show response
s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/ Frame 29C5 20 KB
4 KB 39ms
39ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/roller-kwxx-160x600.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82d23f5b5214b672baef7ec1017a650d679fadbefc694b4033199d7e63a733eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 05:58:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60395
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4001
x-xss-protection: 0
last-modified: Mon, 09 Jan 2023 08:05:13 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jun 2024 05:58:40 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 2A6B
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESELfHEctNpCJ2uHRc_-9MuhQ&google_cver=1&google_push=ATf1kGMInQ87hhCzJRBBNV4TIXYH8K0AdKsLX3dAT8nBjwU75yKeI2UYMFGYg8ZOkLDKCQi5qN3QghzZ7wfWNKo-Jgp8b6HHB3s
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzA4MTgwOTM4MzM1MjI4Mzk4MA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELfHEctNpCJ2uHRc_-9MuhQ&google_cver=1

43 B
398 B

79ms
43ms

Image
image/gif

46.228.164.11

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELfHEctNpCJ2uHRc_-9MuhQ&google_cver=1
Requested by: Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html
Protocol: H2
Server: 46.228.164.11 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 05 Jun 2023 22:45:14 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELfHEctNpCJ2uHRc_-9MuhQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2A6B
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEN6PGeS_jL80EnX2a_W5T7M&google_cver=1&google_push=ATf1kGMULrGXXB53zIquiujy5zW24BOzGeuGm7mFbfym_Iuo0EIXktTQCPUX9pBBko_Jo_FwIb6yGYpvvSnYgaAJ...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=SCCwRLP7TJi2rTtvUlOBHQ2&google_push=ATf1kGMULrGXXB53zIquiujy5zW24BOzGeuGm7mFbfym_Iuo0EIXktTQCPUX9pBBko_Jo_FwIb6yGYpvvSnYgaAJsLpUSFfdwLg

170 B
188 B

50ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=SCCwRLP7TJi2rTtvUlOBHQ2&google_push=ATf1kGMULrGXXB53zIquiujy5zW24BOzGeuGm7mFbfym_Iuo0EIXktTQCPUX9pBBko_Jo_FwIb6yGYpvvSnYgaAJsLpUSFfdwLg

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 05 Jun 2023 22:45:15 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=SCCwRLP7TJi2rTtvUlOBHQ2&google_push=ATf1kGMULrGXXB53zIquiujy5zW24BOzGeuGm7mFbfym_Iuo0EIXktTQCPUX9pBBko_Jo_FwIb6yGYpvvSnYgaAJsLpUSFfdwLg
x-host: tde-deliveryengine-production-75d6fd846b-dw4mm
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2A6B
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEAvonagnIdeP8P3I3Dkj-OI&google_cver=1&google_push=ATf1kGNI9uPtxQQ3Xur24WhpnVfmiMN-NBAXolUVi_e4rgXdsX-VmgndsytwJqoo6AMuqmOb6WwBbo5Jh7wqhFEGW...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEAvonagnIdeP8P3I3Dkj-OI&google_cver=1&google_push=ATf1kGNI9uPtxQQ3Xur24WhpnVfmiMN-NBAXolUVi_e4rgXdsX-VmgndsytwJqoo6AMuqmOb6WwBbo5Jh7wqhFEGW...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=ATf1kGNI9uPtxQQ3Xur24WhpnVfmiMN-NBAXolUVi_e4rgXdsX-VmgndsytwJqoo6AMuqmOb6WwBbo5Jh7wqhFEGWOmMI03tNuk&google_hm=GxG1sGZHYht36tFcSqulrYaE

170 B
188 B

49ms
48ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=ATf1kGNI9uPtxQQ3Xur24WhpnVfmiMN-NBAXolUVi_e4rgXdsX-VmgndsytwJqoo6AMuqmOb6WwBbo5Jh7wqhFEGWOmMI03tNuk&google_hm=GxG1sGZHYht36tFcSqulrYaE

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 05 Jun 2023 22:45:15 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=ATf1kGNI9uPtxQQ3Xur24WhpnVfmiMN-NBAXolUVi_e4rgXdsX-VmgndsytwJqoo6AMuqmOb6WwBbo5Jh7wqhFEGWOmMI03tNuk&google_hm=GxG1sGZHYht36tFcSqulrYaE
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap4ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2A6B
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESELaSeJDNfPfTZrrTy-rosQ4&google_cver=1&google_push=ATf1kGMGxNzhLBtVIQenNG1L7OsXEsosIwxcsBearjhIyVLzmM2RToElXdIk2HFoigMMtGMcJrvVblMhHx-uWLDP...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGMGxNzhLBtVIQenNG1L7OsXEsosIwxcsBearjhIyVLzmM2RToElXdIk2HFoigMMtGMcJrvVblMhHx-uWLDPkzj22SoLtJE

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGMGxNzhLBtVIQenNG1L7OsXEsosIwxcsBearjhIyVLzmM2RToElXdIk2HFoigMMtGMcJrvVblMhHx-uWLDPkzj22SoLtJE

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 05 Jun 2023 22:45:15 GMT
via: 1.1 a7322dae74179db004d6fbdc1e7dc03e.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: MUC50-C1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGMGxNzhLBtVIQenNG1L7OsXEsosIwxcsBearjhIyVLzmM2RToElXdIk2HFoigMMtGMcJrvVblMhHx-uWLDPkzj22SoLtJE
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: rFDNLH966kFmIZHPq7WvL76qbQPhuuSZOBuBBtZ57Wxhhtxh2S2bhw==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2A6B
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEFhm_HRkv0u2nK_GP_qaQ1c&google_cver=1&google_push=ATf1kGNg-5vJgnNcY1vM7dZEET0K9WBxPwpTy4IHV4m5P8vyJlfeKChIonwsTKZgzrH9eRLEg1yD5q86HICLIihqwOG9eU0KBaM
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=ATf1kGNg-5vJgnNcY1vM7dZEET0K9WBxPwpTy4IHV4m5P8vyJlfeKChIonwsTKZgzrH9eRLEg1yD5q86HICLIihqwOG9eU0KBaM...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDY0NTk5OTM4NTA0MDY5NzgzODgwOQ%3D%3D&google_push=ATf1kGNg-5vJgnNcY1vM7dZEET0K9WBxPwpTy4IHV4m5P8vyJlfeKChI...

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDY0NTk5OTM4NTA0MDY5NzgzODgwOQ%3D%3D&google_push=ATf1kGNg-5vJgnNcY1vM7dZEET0K9WBxPwpTy4IHV4m5P8vyJlfeKChIonwsTKZgzrH9eRLEg1yD5q86HICLIihqwOG9eU0KBaM

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDY0NTk5OTM4NTA0MDY5NzgzODgwOQ%3D%3D&google_push=ATf1kGNg-5vJgnNcY1vM7dZEET0K9WBxPwpTy4IHV4m5P8vyJlfeKChIonwsTKZgzrH9eRLEg1yD5q86HICLIihqwOG9eU0KBaM
date: Mon, 05 Jun 2023 22:45:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 sync
ssbsync.smartadserver.com/api/ Frame 2A6B 0
44 B 52ms
50ms Image
text/plain 185.86.139.102
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEKFjmSFShGQlVhGndOFA5bI&google_cver=1&google_push=ATf1kGMNvWzf8bTpqeREoEF9ewKIcBCKIs_TrBtTbVSXZkU-PoIgdQPPWMp-lCO951OWe25ZFXJDSUlmQK6BfyI3GlbeBaZ2ags
Requested by: Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.102 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 2A6B
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEJICSZmExLuzMatMmeEu1ug&google_cver=1&google_push=ATf1kGOsecOHTouMMIkstOeQcwzJobS_DU1ZDK0shQFNbWmnFtMipntbCyyDkrGVnH7Ch-csd53M2CMTSaT...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGOsecOHTouMMIkstOeQcwzJobS_DU1ZDK0shQFNbWmnFtMipntbCyyDkrGVnH7Ch-csd53M2CMTSaTLW3r2hgHpc3hAuy1Q
https://onetag-sys.com/match/?int_id=19&google_error=5

0
151 B

40ms
40ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip253.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2A6B 0
12 B 48ms
47ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K-9UxV7rv4oGLM50KQUJMCBgyn3f6l1AmOr5chKnXFL6BM5Xz6qK2U077cPbKH8QnVmtAlfQ

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9152 22 KB
8 KB 41ms
41ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 237152
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Jun 2023 04:52:43 GMT
expires: Sun, 02 Jun 2024 04:52:43 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame DE28 22 KB
8 KB 42ms
41ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 237152
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Jun 2023 04:52:43 GMT
expires: Sun, 02 Jun 2024 04:52:43 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js Show response
pagead2.googlesyndication.com/bg/ Frame 2AE9 37 KB
14 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8afd59a03bcb312667b449341fdd15f86861886ef702e46479e76805353e1d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:24:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19249
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14644
x-xss-protection: 0
last-modified: Tue, 30 May 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Jun 2024 17:24:26 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FC17 42 B
174 B 79ms
78ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv6VSU_O5t0UOZdcz5ObAXRQZ_pjg-sCrwCsVtwIlfoBz02caBaawogxTTyKOj53uvwn0IiHd81RlSPOF3Bxpt42cDko8m7NQnZjRXXkmc35IxCc9HowtFC80G4s5v5BMdrcB8UCJSLsmzH&sai=AMfl-YRuJ4OholmKcwBv8_UNTReMRayOqYfvENIWJu6aqxp6J_kv3JQ9k8m_ltBD2bltPJS1OUsssqlVwy_Ow5eHnnzzQP-UMYUEuX3kQYQubVS7iLs_6vKBSJHPAUSgBJ-NwD-i8T50xx_WE8D53rGw7AqCyagLAKZN_6BztmBix1voYivYzOLnjH0GsUa4ig&sig=Cg0ArKJSzBXuGgO1CohiEAE&cid=CAQSbQBygQiDVkCgtXorjLO6H7HaJStGqWgbZAdRQ6f6zKI4_sGxTbF6164e6DV6h8JHoYXR7djKA3zQIsAml_3IfOa7vvIaUzgNDGvAkRonm2zYqMFNCaQLeF_u0h-ndo4wul6i3g6W4lBAQZxJ2SgYAQ&id=lidar2&mcvt=1015&p=1,1,213.953125,301&mtos=1015,1015,1015,1015,1015&tos=1015,0,0,0,0&v=20230531&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=9&adk=1400304711&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1686005113638&rpt=379&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 styles.css
s0.2mdn.net/sadbundle/18023719642905169595/ Frame 5B86 829 B
437 B 41ms
41ms Stylesheet
text/css 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18023719642905169595/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18023719642905169595/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c3294ef598667c6169398d34721280ddbc9dffcba5bc3ac190357374f841347

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18023719642905169595/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Fri, 02 Jun 2023 19:22:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 271384
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 402
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 01 Jun 2024 19:22:11 GMT

GET
H3 200 tweenmax_1.19.0_643d6911392a3398cb1607993edabfa7_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 5B86 109 KB
37 KB 49ms
49ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_1.19.0_643d6911392a3398cb1607993edabfa7_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18023719642905169595/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36c0ec05d79bd9d3164effc3eca0f1962cd6f82bb1f41cb212e080910be24153

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18023719642905169595/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37530
x-xss-protection: 0
last-modified: Tue, 06 Sep 2016 20:51:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 05 Jun 2023 22:45:15 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/sadbundle/18023719642905169595/ Frame 5B86 4 KB
1 KB 41ms
41ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18023719642905169595/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18023719642905169595/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f66701275896763806723b24a98618b5ae17e48da67fea9132b98f31aaab60ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18023719642905169595/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 15:45:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 197978
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1399
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 15:45:37 GMT

GET
H3 200 FordAntennaCondMedium.subline.woff
s0.2mdn.net/sadbundle/9170381621892120779/fonts/ Frame 3B77 13 KB
13 KB 41ms
40ms Font
font/woff 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/fonts/FordAntennaCondMedium.subline.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e83314d333416d003a14ff991793feefefe12184980a4f081c0465cda5dc8da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 20:23:08 GMT
x-content-type-options: nosniff
age: 526927
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13336
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 May 2024 20:23:08 GMT

GET
H3 200 FordAntennaBlack.headline.woff
s0.2mdn.net/sadbundle/9170381621892120779/fonts/ Frame 3B77 12 KB
12 KB 41ms
40ms Font
font/woff 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/fonts/FordAntennaBlack.headline.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d97d2f204c48ceadcc2f5b86ba6bf25987c6f7c43c8dd7fee7a2847e6a71f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 10:58:48 GMT
x-content-type-options: nosniff
age: 215187
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11876
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 10:58:48 GMT

GET
H3 200 FordAntennaRegular.legal.woff
s0.2mdn.net/sadbundle/9170381621892120779/fonts/ Frame 3B77 14 KB
14 KB 41ms
40ms Font
font/woff 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/fonts/FordAntennaRegular.legal.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1ea82759f4df729f7ee24dac62805f05a2fc79c7ca4cb518a072a11835e884

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 08:27:52 GMT
x-content-type-options: nosniff
age: 397043
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14468
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 31 May 2024 08:27:52 GMT

GET
H3 200 uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js Show response
pagead2.googlesyndication.com/bg/ Frame 7AD0 37 KB
14 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8afd59a03bcb312667b449341fdd15f86861886ef702e46479e76805353e1d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:24:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19249
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14644
x-xss-protection: 0
last-modified: Tue, 30 May 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Jun 2024 17:24:26 GMT

GET
H3 200 styles.css
s0.2mdn.net/sadbundle/9170381621892120779/css/ Frame F816 6 KB
1 KB 40ms
40ms Stylesheet
text/css 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=IHYajvLzwn&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

101470fcde40e5ad29c691a0cc4276b7e311972a8e02a684f19db29fd4698645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=IHYajvLzwn&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 10:58:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215183
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1483
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 10:58:52 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame F816 118 KB
40 KB 41ms
39ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=IHYajvLzwn&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=IHYajvLzwn&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 07:18:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 55589
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 06 Jun 2023 07:18:46 GMT

GET
H3 200 overlay.png
s0.2mdn.net/sadbundle/9170381621892120779/img/ Frame F816 95 B
125 B 39ms
39ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/img/overlay.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=IHYajvLzwn&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=IHYajvLzwn&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 08:27:51 GMT
x-content-type-options: nosniff
age: 397044
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 31 May 2024 08:27:51 GMT

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/9170381621892120779/img/ Frame F816 6 KB
3 KB 40ms
40ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/img/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=IHYajvLzwn&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b1bfbac0178604f4dce665117d962743d2916a2a37968438f3d49d7e9c04445

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=IHYajvLzwn&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 08:27:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 397044
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2563
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 31 May 2024 08:27:51 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame F816 60 KB
24 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=IHYajvLzwn&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=IHYajvLzwn&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 05 Jun 2023 22:45:15 GMT

GET
H3 200 uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js Show response
pagead2.googlesyndication.com/bg/ Frame 77BF 37 KB
14 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8afd59a03bcb312667b449341fdd15f86861886ef702e46479e76805353e1d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:24:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19249
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14644
x-xss-protection: 0
last-modified: Tue, 30 May 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Jun 2024 17:24:26 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ Frame AE4D 94 KB
30 KB 200ms
97ms XHR
text/javascript 2a02:2638:d::2

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.135.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::2 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

bc82310d2b82f3aa74a269e8f679359bda827c649adb41486fd1af268a026ac1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 31 May 2023 13:09:50 GMT
server: nginx
etag: W/"6477471e-176eb"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 06 Jun 2023 22:45:15 GMT

GET
H3 200 uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js Show response
pagead2.googlesyndication.com/bg/ Frame 9152 37 KB
14 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8afd59a03bcb312667b449341fdd15f86861886ef702e46479e76805353e1d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:24:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19249
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14644
x-xss-protection: 0
last-modified: Tue, 30 May 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Jun 2024 17:24:26 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 083D 0
0 76ms
76ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstCHww8PwaY3VSBDPHktbP5ZUkvsclzWGPmuLk43XwHTy3F4IoH3hmyaOMQK97UAK92fJhtBnsor41qrcCGjKrkaz-DY8QCOJJaTo6Ghcic1x_rEYAtL8ZVfdd-AAW0h0hXVG7tuJoCOOf0hfWMBnJndVwk59qErn_tHOY3zGbbBTDthPwj4ig7ZtAEWBRZO8JJRMKpTCjixbJpYaIQT_wybPMJ7Z_K2dVnYS8Kr3UNJH7hlWRn5tYeDlUOhVt3sIlRvjq2eIMOz7HJq3xWpAwgueIau454TMMiDp-m_cFkxTPdaknWWvuPSmkUHSUJDdzOlgpaegBVh9pvRQjW6Yk5SDRvrVdnGR03LOhJd4uzOz-kXcx1DWCKTlk4ujJdxrlfcuJWBP-qhRvQCjy-ExrN82qANCn7hBKZLIN9o4gUj04LyXOgn5oqWC2Kfy6rD3V4MjTIxVCKeeul-PNgPFxhi0GxNGZUlxM-9GaaGvf6Qf-LEclWqRTMb7RO6K1IMeuzY7jm8dJxK1bTlioWkpSix5sgUso37niV7lpR70IYjYOG6kf01Wmc05S5AI7Bu1bzXd53k2ej0QHxgoHG8g_aAkqe0e31qNO3CWJGkLhb5P-Mk6DiyCB-UjbTDXU3bMJH5SI11k9MBVUHLAwPBkf3FNGaX1yvKQNffiTb9uWO7eXIm4NHWschmgSBYGZ6p3kWCLF-28Je5GyiHJvsczmD1sGgcxXoXoUUTIGw51DklMvCs848vTGrM8hwOOwIL45oR_ZO15AZR-cFUZMyPdOTF9vTNBsyjUYQ75tnSFb_KY2FmJ_gCrb0ITQe72-tg0ysLwSqyMGHb-8v2csGwE99t-r-ek4HbQjsRQ5HoWUCkGFmjF9Dz40gyyhaMZK--7ooQ2Tys19lY5O5p8lY-hYDvKV8EbjzYUT0Kxf5v-3P33OFSvDJjWIR_M5qRPfI1vjh9ABlizz4HW8856wjdQkG5XqeCuIs2qvnjTaEN8MHQ8P8GyGdQ8epFjzZaJy3FeHHJr6s4i8OIOnalGT3jGAClLqcM2QUUVG96N7Pxau5oEmBOs7Wvnc1UOo910qEaLGggphTHXnYSn-qjwc66bTjiC4wqE_ELhb2HW61L7DqYL243UWkHHHx3-XL09BaNXa9ikppCdRYIEadylsTyq8FAAUvWeYaf26voUyt9wEZgNO3l1fO6zCeIJYnUYbcccjFLeHl0LYxKn2FgMzdi8EvLI9uJPfpOHG-zaNI-Q3rXwcSrwZzi0jZDzjXieQij8an1nfallWXY8zC0nb0XkY&sai=AMfl-YSsSJG6-1eZoutMK6lJZ4R3b1VK1Xo_XMOtj0ANW4OfCAtgmAlr6Daqo0_0aHFjFrPJStNLL_wlS1kKgtOs9MmQ65eGFyPu61chvNEjvYPDkIZjQ5PShDha66wl3Qlp192A-Rm0-T4qZxksNjKpTpuXDv-493Plc2dUWawuD6Cd1NLbVvfKy-TtbD4YOQueTRZfz19pRIjn8jeO_qU0f6bFGjAxaQlp1SNiF1KIF2fcqxmBr4uVTeHJa9jE1wdLil6s17GttlhiKoy_2dRn5ZYmppsMbA&sig=Cg0ArKJSzD8gmTq5NOeXEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=668&vt=11&dtpt=444&dett=3&cstd=215&cisv=r20230531.97593&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 05 Jun 2023 22:45:15 GMT

GET
H3 200 bg160.png
s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/images/ Frame A236 53 KB
53 KB 40ms
40ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/images/bg160.png

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b015ae288c4c24b5501325713f784be0460b0d5a56635747b08e3539b6fb4242

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 09:28:30 GMT
x-content-type-options: nosniff
age: 220605
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54691
x-xss-protection: 0
last-modified: Mon, 09 Jan 2023 08:05:13 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 09:28:30 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6B89 0
0 77ms
77ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss4IY9uiK2069m8Eb1EQ8ctPr950EeCIE8FyH_3aukHMOSgFtzex-pDax16hDJeuO55tUNicg839LNgNZzYnv84XzCx8LafdHgli-JsQiQUfiDjb46MXqGxAMO2qZ0LUc8wfxvzuSVIggj9x2FZjO5alY2WyxKioBdrE5p8D0h9uMTxRyGXykYkoX1M6TW0YaIepjUO5pgSRBXlPwEmhDk7x5ipg7QBdUuXBTVh0SRrZkY8xNIFxCJv3z-IY52bLtbb4ON0OvFi9s3QEghB8LIK8qyIudE6DK9fI9IdKcxmmVT1vrPXJs2xBc6Hk9PPc1r5cubLNAgY2tmph8npuwUXcFWaE2r--EFVqcN82PsukY5wHkrMt_o7ebFJKzypRFHkiDP5px9UUAkcGLE91mf7DB5KhCMDuybT884E_JP-Q2sV75t_cQN8EeRMSra6XZF1HKriHQQgjb1ewI7NsNM-4iKmwUq3BBO4NyhY0yasXkkRgcUuJ81pHhRiICN-921h6ahALP6IjKEtW78gXQ08IbtfanamX7USX-pPWofbC0rhi9Wy3w5SClkTiqVdTGIwtsg3JlKffMtONh2nSk3cfbA6SMQ2Sqlgi2_OA2BPQK2iECIkW3PfhW0tr4pFYa48rIiEonRNL8gGDYZXHdUTQki_cIVX_fOFb39OsIRlc-1eEktVtWY6C3DEerPOdmcP47e86vQO0TvlGngWNXaxiq9DNs3KTv8R5a7mUs68QnyMvH3P3XGRTXEen05ducr-kM2KAyBBOB_VTQV2qVTnAMM9N6MMsyK_VGfm4BlXM05AzAv8vPqv-nxhcgKJeuZrc3b8MWvy4K5Hx_Xhe7wVgMVdQI7T_zit3TnU0MFwAM3E_6Zc5Fs_kVSUA0ktdAkPTvSJdH-hfsdIP6qAuJjP7hBexT7Wh_o4ypiBdI1d_UAEzTRAbQjL3s0wBwY1YFrtxP2atYu6qfAm4mh2B9-Xd8X-bnMxlhyxzIU8WSKk5Cp0mWRxhg3j0mKQsr7_iDX6NaLRs6JyK1DiO_MZfMcoJ3R9NrRJOFV2ZvBUUHBON_rPhh3k2J4XpL4g2ocTjvy7GNsuCvBh2-TwUPWmAwHz89xmzGphcQVpjrGLkprLbMCqNpnIlw4GY5FAFR1TXF-dnsHvlE3bJ6OpmLlC2v08lgMth3QFU3pznfNL6nTI7ZK3p4QXEHcir3QUVC02eNuagnibPZxOwpq6EVoIT5Dr68gJfHAlJMpSk0FqETjVuyg&sai=AMfl-YRyG_jurTnk2llNWfKMG_1EohjpKhPl4ZP_-_kinxF1FcbMFoEuyXyY4Nk2RROhZ5WgrG0iIWkY37PxUBJpovaGyACRQ6KVvDH4Zp0MZRhPX-XmrA1Xqxf4A_aqbyWVB5HYzjXZMsyMqJxMdQNNmBDytrdbNC9lOnPfKfTN3-23Mt4Ogz0xILO5kQhug-3oRUgOUy1ULA0AZwSS03QictrzvG6DKGtA1avP5zT6Y6Kzv6tGy2rSf1mQBQGEdFc6yNYM&sig=Cg0ArKJSzAadjR55XvFoEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=629&vt=11&dtpt=309&dett=3&cstd=319&cisv=r20230531.93783&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 05 Jun 2023 22:45:15 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 3B77 7 KB
6 KB 52ms
52ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4c85aa2307e955e88a7b4ee9eccfeb18c9dd132c39e07cc708b44557f363b16c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5797
x-xss-protection: 0

GET
H3 200 uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js Show response
pagead2.googlesyndication.com/bg/ Frame DE28 37 KB
14 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8afd59a03bcb312667b449341fdd15f86861886ef702e46479e76805353e1d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:24:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19249
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14644
x-xss-protection: 0
last-modified: Tue, 30 May 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Jun 2024 17:24:26 GMT

GET
H3 200 bg160.png
s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/images/ Frame 29C5 53 KB
53 KB 40ms
40ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/images/bg160.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b015ae288c4c24b5501325713f784be0460b0d5a56635747b08e3539b6fb4242

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 09:28:30 GMT
x-content-type-options: nosniff
age: 220605
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54691
x-xss-protection: 0
last-modified: Mon, 09 Jan 2023 08:05:13 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 09:28:30 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7E03 0
0 78ms
77ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstZD1_a2IF4KQGUiT0qVUak7iNG3rHrLoMeu4GaEdqwKxx-amzDHuAPuIKUo_g6iUoeuz_U5AjXz3wL9oUi4TtEi7xS269LB6hnVvrjRR4G0xBLfeiSD2njRSfCh1uYKekZvmIL9CInKaM8VIWGrxaoYZo34Oq1v85p6LNubYhm-vFkXY8B5z06Z74o9gnomAI-n4HQJyLxoeiPkhxw1pdZERODU5BRBgkv6LOJ6S8f0y6Z3gAcIh3VQ94LgO3pGRnQswHO8P1moGoE8lqxexes-tOWHIKG9RclQzGYcfVOd8bRmrmcXpF4BwwaTY5pTFZvoG3M4yLVRlhDvmYHOpQeUOXsbF1FPCS2Y2xOWdKoJBcxYsTggUeovTLgUGVdIVvwHmxSFFwspjVUs6Uwoit4HjQtBo0MfrK97dsOiQy8ZMAN-xQgbaXg2136UABcaEsFNQOPuIy2GSQmgVGqQwGT1nxGVZoh-rcCl85aJsSAjfP01gPgH_o2WqRewvQH2OFeJjWXIl0aA7h9Q3zWsA1_QpRRQRN3cRpViai7GmEZ8DIPloXVKKvUwE4YVfL56aKUQcOEjO_sN77X4PC_tAkLqM6VwV9mtnZSoMweibALtFrVHWNC-_xtbviSGhqkxWTG3Vw8HlorzAYKlKhQ0-XGymZsgzphgqOeWoAatlOEjYdHipwEqrgD8BM1-FqDuu7ZFKWqI6BJSKQiagA_Fa5JnokxaUZ8Rna1kBkFaFm0xjYey6ltiWpx0D_f7jpqX_BQhdcwPfjFicLWnAKHSCNKg-xR-pd781BomuWESYhxsm-UP-lxuIw5pc9UeiN57OBV712247-SnXq-XC5h5gfo4kq3IFkO168cRgznqPOK6U3Vj2egK6j6K3OE04AmA1BDAweb9_KiRRbaXaftJxuUEH4-w7qF5ev6cYgQLNxEt_E_LZba5xqYvdUdN7WrrpDxLWPr0qYT7qrYpVC1XurLPAROTv09zFlAkg6MMPWx9Wd_9WERSzh-GE3ewXox3MxPNYCWseCJp61EagRq4mHox7kVYiixbECq3alYICgI7iRzS_n0hlDqgBjk146HMlxzO2sfPtiwl_gbiyxsgZd-85oBLSGgSt8cJoT7GVrHgJg9zS6tW3bH2RjVbeak1b4yV4TwebGG0KjkhBPhIgZ9uSr16eruHD30J9bL-d4g4yen0lsBIAgm7Hryajldw3uSCkEIH45cNMV8mRhf_McUNYAlRXEjOw6zHMESglaYhmE&sai=AMfl-YR7qlCTJWi91fyGs-X_pTjLStPnrcTjhZ_6h4WcKAzPXKh82VM_izEr7JFsT7Rp6k3anwkh7w_ddukaRoeNZYoJQS1j5enDrLZbn99Gg5fm18rkEpqayqHXwEV_9kqYMGUB0yl_eODM0CFKO-O-iQMEaPZRD1yn73y3CorJb7gcKRG9pakgkEtnwX4VM-XNwfdxVel1EaPG2nT8_Peh8IkbJJAD43ndsfMQpxueOmHjYMFy3y9GDm3g4QXAwIPXoaDY&sig=Cg0ArKJSzNZkwkzYvQhHEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=637&vt=11&dtpt=312&dett=3&cstd=323&cisv=r20230531.03625&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 05 Jun 2023 22:45:15 GMT

GET
H3 200 bg.jpg
s0.2mdn.net/sadbundle/18023719642905169595/ Frame 5B86 32 KB
32 KB 43ms
42ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18023719642905169595/bg.jpg

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b8c267b6b6f05577adb4fa34d9fc6fdbb2abdb55a9bd0e1e33838cc3747f9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18023719642905169595/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 19:03:16 GMT
x-content-type-options: nosniff
age: 186119
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32562
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:57 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 19:03:16 GMT

GET
H3 200 band.png
s0.2mdn.net/sadbundle/18023719642905169595/ Frame 5B86 3 KB
3 KB 42ms
41ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18023719642905169595/band.png

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

147154470a9824945cb7ec7b51309b8d52066bc8c27bacafeb2d0a49a65d26e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18023719642905169595/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 17:53:38 GMT
x-content-type-options: nosniff
age: 190297
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3410
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:57 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 17:53:38 GMT

GET
H3 200 text2.png
s0.2mdn.net/sadbundle/18023719642905169595/ Frame 5B86 6 KB
6 KB 44ms
43ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18023719642905169595/text2.png

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e97639114954ac5d65f5065c56d92d777ed1592dd283b3009959fa5473218cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18023719642905169595/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 09:30:11 GMT
x-content-type-options: nosniff
age: 220504
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6323
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:57 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 09:30:11 GMT

GET
H3 200 text3.png
s0.2mdn.net/sadbundle/18023719642905169595/ Frame 5B86 5 KB
5 KB 43ms
42ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18023719642905169595/text3.png

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

209756ca5d587e33595747af61be5d7a42c1e20a78dc02d9526186c46bbbe0c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18023719642905169595/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 01:03:51 GMT
x-content-type-options: nosniff
age: 250884
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4639
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:57 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 01:03:51 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/18023719642905169595/ Frame 5B86 2 KB
2 KB 44ms
43ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18023719642905169595/cta.png

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d6c6699a632aac7b20247601a044bcb1151bcf638d9b435ef4c29aac1d911b3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18023719642905169595/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Fri, 02 Jun 2023 21:18:36 GMT
x-content-type-options: nosniff
age: 264399
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2416
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:57 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 01 Jun 2024 21:18:36 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/18023719642905169595/ Frame 5B86 3 KB
3 KB 43ms
42ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18023719642905169595/logo.png

Requested by

Host: 4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com
URL: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca5186c45c8b98fd128a56f0778172c5088be7086f94ab4d9c0fc0657081f29e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18023719642905169595/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 19:05:35 GMT
x-content-type-options: nosniff
age: 185980
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2635
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:57 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 19:05:35 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 097C 0
0 78ms
78ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsudUnGr5Rin27yN9PGmz13-29shI-OnmgTaOP-p1SQDynTgKpCLWouo9phz0bCOZAEeSHaeCQECM9pbNfSNH9BXkbiOHJPeWlRhEEKkCyO7Td18M4kC-uk696cwBKeUzxf9DHd6RwNVoLvcAYYl_1NORuZ8RALapq28zt_9HnHOUsyj7J9CRObFmw2a8jqbMY5YgUt7aHwQcKrqx5z7BQeGdqa9SYwCHfWOwhIS_ITyShP6llyRhWvltNrKPXVq_0Msf_cyx9gfOnXhzbzzmFK5Owm02B5uIE1vCtLlOGfLH11L6i0gJ1Aiy3CHqIb96mLmB6o1nZ2F9t7eEGGgyaSwKfPTUTA3yMD_3RxOWXCmAq6k9gmAGbmGa4VEVSUhXSqqfaO30P7qSpQR4qOOJK-uZ4_hBB3SuoZbfqXfjVP_s9MxPu5MgNab2n-P31ySX2sOoS86LmSDYHLY_izdPN9QjAbZKlP27ORB_oE2qxz1x9--gdPalHt-GyYD5u_r0_3mWewMScgNu9McxlKVfC4ChbcUAK5AjcmhAUl9kOiBiQ_Imo6R3L9JMJ9G8nio6cQK1ZlccOqeoLduK6-HXsCUOaGnqvtETgxX3eKd1Q96OES0PMI5ukUHPt7FNfxd8vKoT0VBJDTid_RrymHVWkVfSDQDQQ48KpCH1UzRn4LnUcamX02ZIABkzDYyem8u2rl22jHf0rdIpgGbZVOHaTWRYlkvWuqvDgl7UMDmF7ID0qLOS8oiP7LLcqVSVbL-JzgU681BenJU9NNNqcQTun8wIpiaX3wA1_osvxbkmb2D8hpIZ8JaxRZryEIIsGpXvxSQRsGnjIyxee3Dw7EIThScHCw63OMIJj8TKAXzWmCHHqSGjIf6-ZmOiuMIOUM22FN73oRJcl-2SJyLjoCk4AG7ZWm7nlvj26JCwMTs73OKYC1VBqPbWgPdlwvofLfvlI2WJAmTn9pw-HMtRREkO2lznA2oSNcsco1tE8c0u2_Kp4UGQJ-C_uV7IwZEaIPNjcH4sXSHAKKm_qBKs3uU7ru3lD9aNa3SeDx9O_sLnoqi6kW8FCbNnYoLTMiqD3OINtR2grx6V_0eEALIumu0b-rXE2UR9T69ObZO2Nw09F3x_PvYhrQ2Y9Uzr08i7_CucEGfyrgRenK2KvKbyR-WlHzXqfbM2k4eWg8xj8_paWrqxi-4-QliPW_ecmT1qY7rGmaLqaECIi6J92Hl7xA8cBNaSiP9DhoiPcweQoT9ymslvYdbHecwkzsGY8sja_wxHINPghz70ZcUMHEVY0Gq5A&sai=AMfl-YQXcyKCvUvjhnY9VZt6z8tPkkzrELxFhthDwIiaFyQIb3SPOA0eRjIjwWtHHeDCGOzWllztpEomZPWjsYfM8rgYEcoVNKL67KkIsMha2hv1uMKpVRIcXAVyT6is6JksCD-0dMYaMDgNd0kRjwkxZul40fz4A4immNFXgg_XZop97zhYTyecTRtibD8LsFTdy-ug6-8w08KFQix6JCo5yyLssDBzWQDv6wTOdw1FIxu44VOzfM82oaK3Ntm4leeTVvFj&sig=Cg0ArKJSzEGHvjZ2mdQXEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=577&vt=11&dtpt=285&dett=3&cstd=290&cisv=r20230531.71848&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 05 Jun 2023 22:45:15 GMT

GET
H3 200 FordAntennaCondMedium.subline.woff
s0.2mdn.net/sadbundle/9170381621892120779/fonts/ Frame F816 13 KB
13 KB 40ms
40ms Font
font/woff 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/fonts/FordAntennaCondMedium.subline.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e83314d333416d003a14ff991793feefefe12184980a4f081c0465cda5dc8da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 20:23:08 GMT
x-content-type-options: nosniff
age: 526927
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13336
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 May 2024 20:23:08 GMT

GET
H3 200 FordAntennaBlack.headline.woff
s0.2mdn.net/sadbundle/9170381621892120779/fonts/ Frame F816 12 KB
12 KB 41ms
40ms Font
font/woff 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/fonts/FordAntennaBlack.headline.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d97d2f204c48ceadcc2f5b86ba6bf25987c6f7c43c8dd7fee7a2847e6a71f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 10:58:48 GMT
x-content-type-options: nosniff
age: 215187
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11876
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 10:58:48 GMT

GET
H3 200 FordAntennaRegular.legal.woff
s0.2mdn.net/sadbundle/9170381621892120779/fonts/ Frame F816 14 KB
14 KB 41ms
41ms Font
font/woff 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/fonts/FordAntennaRegular.legal.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1ea82759f4df729f7ee24dac62805f05a2fc79c7ca4cb518a072a11835e884

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/css/styles.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 08:27:52 GMT
x-content-type-options: nosniff
age: 397043
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14468
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 31 May 2024 08:27:52 GMT

GET
H3 200 visual.jpg
s0.2mdn.net/sadbundle/9170381621892120779/img/ Frame 3B77 92 KB
92 KB 40ms
40ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/img/visual.jpg

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fb578159169bb38173ca68b7f9ce061b18af4e4e6724bf3c9c3e745cc954f177

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=8eJlrjiDq1&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 19:30:54 GMT
x-content-type-options: nosniff
age: 11661
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 94238
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jun 2024 19:30:54 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 3B77 17 KB
6 KB 64ms
64ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 05 Jun 2023 22:45:15 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1D20 0
0 77ms
77ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstx7pf0Qo4DqM1FKHZxyu9inDgCDJOY96k5DI4rdMycQcZIZUFbob_r4xOEQuh8_8gY6HnTON_2gXlp0q2toVjLg5KrekbVfB-xkT559-_yHQ4IU7X2G9kTGeLb8qPRH64jE_7SZw-wGso_QBaMQ5yUo7KBzOtWQ0L4OZaugR1n7yeesGDRR8UaHBNeIhrVZIL7eS_gel_ojtqQGDStValD7H4-wKzqplot0yTvcbHvBJ1xlW0vQoVBi5WBks_nRAW_VoKwe3hpbXAmwewZYKVp5CqpkciKhOOy4Gk2qXPkttCp0Qo7S_VmyhLyqSzWtVHEBm55Ae3c1NHwudFTKIk_k969LLGPfcxDD_y6tbPnjkE3BVR5eAYk23dzeT1Vn3gzldBO8z19czP1SRxZECJp20BqpI70yMAY6UrQO_TckZ4W6Ws4Lpgql_YxJ-tQzzfhIFmoI6QWzuDbL9AXbyM7f-OpMANpofC7n12NdO_49s330PGsAFyG4nHCbcdBoxF7taOe8Db1J4toI0XYPSOrRWhhCzGijLDEUh0bcu3U9xEsatBDDURh_9l5q9HYaack0EBJ_29BNVmu901KJbSgAyqhfTpkWc9e0ITMubbZG6pKRtFXA7yn5uEPQrSugqqsNtPgy6pY1T0nao5sY1k7h4zGIjBj_eaVMQUQCwHKRapwi2YD_DQ7M38DNJHvm7Jlcs_FHZuYj3C4upzeRUPD5iuoGrYKbtoALL_doRQJdOSg0tnt114WoBq4UTuOiBDjXOYFF2QbUYdEc0B0P2A4wZdsetCEQS2JqFehLug4Z3QNvG5rhwolJElZHuf1yGVztcpIiTTs83dXr30W5ELE1PH7ceRXl5-j1tab9Rk3gtfsGzVvQyL5O1Mz6pzMmuROQHf2LNC9itBdMfHgIdU8lWuP7xFFch5WHg3kc6I6Aed34JQcJaECQPFFFgRN84GpHNydyBtYIsW2ph9Hx9RaGKbR4x1KYuLmDJYv5InlBYtPiT2KXt_LQ5Uy0gKjTc39vt19sUoACBfbmpsHpAwlz0-9NRXAvx4PzCl2nSo0Aad_bZbf3o2mF3xDyYuumCPoHMacM7DVllJfhg3K0dQGd_X1_WY27Q0xj1iOxLvyqOdAjO17zwonMoX9ldGsUUFwKvHwJcA91uV3JS1hq6eC8Py4saR21TgcJ9zqG8sRRYdwzpXhv2pfQaMCLE1n0NN9-cfVeJvRXOi0UYqXWovlS-Q-2P5BNgitH2ivIJ7pkELKdJOpEp8NgM1S85KEyuEKgocW6mdd4bWLxAXQL2k&sai=AMfl-YQFbixTKbHqKvw-wy7gFmFxEIboe0lL6rLUUviLdn3UQAT7OIBLgE5plrv7guLTSzaVyYQ3FBZkkINJoDv9h8BcLP-8SQNt92R1UtjoUYsvsyOpAYnsY_PdU3F726G3uYRoXUHu3tPnGMeLiFEhJCsKMn7LKH6cnRQPQHytdnaZ9eXiP5HgwZ-E8PCmf0qKuyPt2MAC3C6XXfthQIoT4_VWjetXF5iYIafUR9fhKdaBpdFYZMwnhFsuqe7uq08bO3LnWeHuppSO8cUCpJyl3oFtmqC0Rg&sig=Cg0ArKJSzEY6K8NoYSBXEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=651&vt=11&dtpt=368&dett=3&cstd=277&cisv=r20230531.99306&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 05 Jun 2023 22:45:15 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame AE4D 15 KB
11 KB 56ms
55ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202306010101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6b8c267cda432a1617ba3c2c3ad6d5a9ea6c46eca1795d41de700f83d5e7bdef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11243
x-xss-protection: 0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame C376 15 KB
6 KB 161ms
54ms Document
text/html 2a02:2638:d::d

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=pcloak.blob.core.windows.net

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.135.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::d -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

645709dcb09b2700fd5a5938dbdf783ac90a88334e5104041db53302441f33e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:14 GMT
server: Kestrel
server-processing-duration-in-ticks: 359551
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 logo2dwhite.png
s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/images/ Frame A236 5 KB
5 KB 40ms
40ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/images/logo2dwhite.png

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43897b4750dad91cd470f62f0396b7e6513c2ad005f231d0ac756f7483a0438b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 07:23:46 GMT
x-content-type-options: nosniff
age: 228089
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5587
x-xss-protection: 0
last-modified: Mon, 09 Jan 2023 08:05:13 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 07:23:46 GMT

GET
H3 200 logo2dwhite.png
s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/images/ Frame 29C5 5 KB
5 KB 40ms
40ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/images/logo2dwhite.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43897b4750dad91cd470f62f0396b7e6513c2ad005f231d0ac756f7483a0438b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 07:23:46 GMT
x-content-type-options: nosniff
age: 228089
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5587
x-xss-protection: 0
last-modified: Mon, 09 Jan 2023 08:05:13 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 07:23:46 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame F816 7 KB
6 KB 53ms
53ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4c0616ea0eb8889d831982bd3fb7d2da7ee08380b90d58de33e87be14a48366d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5741
x-xss-protection: 0

GET
H3 200 visual.jpg
s0.2mdn.net/sadbundle/9170381621892120779/img/ Frame F816 92 KB
92 KB 40ms
40ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9170381621892120779/img/visual.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=IHYajvLzwn&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fb578159169bb38173ca68b7f9ce061b18af4e4e6724bf3c9c3e745cc954f177

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9170381621892120779/index.html?e=69&leftOffset=0&topOffset=0&c=IHYajvLzwn&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 19:30:54 GMT
x-content-type-options: nosniff
age: 11661
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 94238
x-xss-protection: 0
last-modified: Thu, 30 Mar 2023 10:59:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Jun 2024 19:30:54 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7639 0
20 B 73ms
72ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8535504170718&version=m202301230201&ct=119&x=1&cor=15163451967167880000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js Show response
pagead2.googlesyndication.com/bg/ Frame DC54 37 KB
14 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8afd59a03bcb312667b449341fdd15f86861886ef702e46479e76805353e1d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:24:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19249
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14644
x-xss-protection: 0
last-modified: Tue, 30 May 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Jun 2024 17:24:26 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9AB6 0
20 B 77ms
77ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BxfAzemV-ZNfUG_e4x_APzaCn4A0AAAAAOAHgBAI&bg=!p6SlpPDNAAY9J7QfHSc7ADkAdvg8Wl5ByFYIydOxTwWCixvIiDchpWXKOyjDCDTb8fKDHpjmllUQb9sS1pBch99GiCsI64OCz8MCAAABjVIAAAACaAEHmQNV2rxl8aWrkkOsMVi2y38wiGg3W7I-naLE9bBhCvi4xEhhcm2WAHxKCigTq9JtUlcsZ21U928rx2qT4Y5H7Lhk_3p7taVTiXof_Nn_gwZpXUghzXpnqxQjLUpkJd71OaEg7i7bETuK_vF4LE_ZVp4ANVBmfHELwbtWN2Ani1xVmT3reNhmwGnnTmaEI48vNMlYZnJwI1pyepk9hOQMnSZRftoWRUQq_JyaFGRucrekcSRfDtMcl1Wi-g-9bN-cy703Ga3hToMinbx8NdAv6sobjJtSZfHjz_3pvsL-B2WF-ITTgU6nkAnlmlQZkBzdwItxrrBNm7_fehrPu4GjnnPioA20k_8Ot21XgQFgwA4xmpnVj3AZkjb-s4Klxd5-rqPTtSG3ABZUWKC2ru3LHXJqrcT3ufk-2oTA1vQg7bLDFfDzKl9BNHimZKAJMn2MwINALlToSujMe4wNNmnONY9VcE-D5hvJ0r1wG0YBcOGAo9tO_ue0yjEuAbUPPLAUfg8I5LxrtfOfAgXetX0UWWzv6WX4GlWkEYxSR8Y6HFrnvu3XuEpgAN4X43HGVw_S4o7Nu-f0agM-HMZFHl-8MDUX7DFwOtbIAeoOSaZwrfKBsdhYDBrWd4Nr_yJqPXI40swMTiQFoVNLoyUDingrwSIoDT8n4lme92PvZWyzIU10YV4Z7870g-vwmKmq_LN3QPypppM5IkzL2OOtS5u9qPzeIFkeJfqV7rjhrDMlwBKgPfKnxFGp5fZWhOnUNg6N_XcrMEOJcrM6lacUktcqfw2jmSedGupJ5Zey9ItRXSzzJEV3p5v1snV2PsZlF1lbL4-42GQwi6RFu1V41BrGkKWiLYXe66YVbbYOc50u6SgCXkXyq4rOW1tAomLgjMCNGBkyZleF4y03Jcq59rXwaLtD4tt61kNA4qa2zscyfKM8BbSpHQImkqrSukrobgnW5LjAauDp8Oh_cDxg9X-EJYuw1cqgXVnmdtF9H00LGCONmKn3XbETrhwRkq7IKqnwOUj2tDWMYeq4zy1RO5hILw9gHdS_pj-HjWv_WY7Pran7wW4ww1L9Au1xSbC222xqmdK77fugTPE4uovgublikZ4bo0xDd2XZxS6olLsd8wc7fk-_BlURVQ

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Cairo-Bold.woff2
s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/ Frame A236 35 KB
35 KB 40ms
40ms Font
font/woff2 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/Cairo-Bold.woff2

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3449973958008fa462efb86ad67ac29a4e2bc5f38ac081947fbe2f627ac42065

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 07:41:56 GMT
x-content-type-options: nosniff
age: 226999
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35836
x-xss-protection: 0
last-modified: Mon, 09 Jan 2023 08:05:13 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 07:41:56 GMT

GET
H3 200 Cairo-Bold.woff2
s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/ Frame 29C5 35 KB
35 KB 40ms
39ms Font
font/woff2 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/Cairo-Bold.woff2

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3449973958008fa462efb86ad67ac29a4e2bc5f38ac081947fbe2f627ac42065

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/5034200980950336636/roller-kwxx-160x600/index.html
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 07:41:56 GMT
x-content-type-options: nosniff
age: 226999
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35836
x-xss-protection: 0
last-modified: Mon, 09 Jan 2023 08:05:13 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 02 Jun 2024 07:41:56 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 083D 42 B
64 B 82ms
82ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstJqmgkID3UrFgk7enQRfdVdDagqeeXFL2KdFgPsodr1L1pwjI1nCm9OSXUiQ-KuTeFyjwT0_f12n64WjsQxcI74aYqRZGJNjVmr718u75XQ_Pv1CfNrqzKTF_aE_hYsWcJLgQXxMsMXAci&sai=AMfl-YQGqz-uLQpArkVEmxL9Aic86fdX-d_1pcDhZ67cqDlX8W67FexSuusjCT3a_bB9qNShwMMLrPCZghlJoJRI1jPRuhtLSy1r4Jie9A-VaswKGjGsWGQ6KuhrpUs&sig=Cg0ArKJSzJZgj7HX7dq3EAE&cid=CAQSOwBygQiDg0Jb9DWp-KhguwD6poWyFGq8KU9LPRxJTmi5FMk-2cSF7Ma4h_IGoYiv7jqit8GvKVbArnizGAE&id=lidar2&mcvt=1018&p=0,0,90,728&mtos=1018,1018,1018,1018,1018&tos=1018,0,0,0,0&v=20230531&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=456810305&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1686005114084&rpt=512&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame AE4D 17 KB
6 KB 87ms
86ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 05 Jun 2023 22:45:15 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame F816 17 KB
6 KB 98ms
98ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 05 Jun 2023 22:45:15 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7AD0 0
20 B 78ms
78ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B9uVmemV-ZLHfIJqux_AP_rOpkAoAAAAAOAHgBAI&bg=!Xl2lXQnNAAY9J7QfHSc7ADkAdvg8WlP56SuYoECU1xfZxi3KfWNgdDQkjXwKA9pNRF1nECQb5laEGt2Ohwxc08LMxubygLwrzRwCAAABXFIAAAAEaAEHmQNYnBgJdeEUHVe3Ebc1jaE-XqNa_50FP_BXSToX5L-pQQdz9i72cCxbyhf75LPZlHaJV03lCQuQyhbyzTsqmfvMLB71vY5e5iO1ZS9nmJt5Pn4r_l9H-XVjhne7tQ3NhmvdkEpCZ1b7CT5nhuxefnMNFHBB--HLj8MiA0uRxrQYUXVYUxatwryRv9hb_7zjAuDeeo9V_ncT53VQa1tqAWMi1L2LGs8vMiNztLMIndwiM-rslNp2QyuNyGv1779K9jjTBk3coOBJPwXx6whCeAaA7fAi6laGWompmwTsD3H4B2In78cr-uqNRw0tp2uOROgisqLYmK66gWKrumTaDRtYF9cJLnWDr5K_SW8QmQadJt-baicCz-Iii3Pcw1gmI6oaY7ST9snS7GNO6Ukue4iFGphyLzaZRMuuX_uyj1u1Nj18GVLVLaVydUbt41aHeP1BY5ox-zeQaT0jji4MnfQ8rjh5Kf0trsQco0y7E2GkUbENkjfgdAF08pdTuquCJQkz1xrFE2uWUNNq-bIqeqpLLEUOsw4iM60JAjNalWsI_tElty03gQtAVE6sT3ZScORRmW3XOZ8zn_UYr5CS645ghbYMU2IxySuYYCL0sGquNMgdiI0eupYDTTXyju7jOswvcoXvV-uTxUb5PiEIg_fDaGs_tglHb68j_LTyij-YGT4gyzxZfNFJ-IJ0ZJy9_NLMtp-uIJEnFnFpWfJBed3RNtB_VLFZCikE7Jri-BLz8EKmSTZSRhuTd0an6w-6NFSUIpVUqQyUtZAV50dAw-Z46SZIzOdvnP1IL3PXy_Ucvvos9uLLIYpZOnvxMN6YZx49Z97D6S6yuEeUj8KCr2DYpQO0QFm0mNOGrrbAoo52mFdlatoSR0S82fE65cReruwPJJVIBd9j55mtynFbr_sMRxdisFruYoKkPlNjHOyT9Espw7z5wEWTrG_ELOA4vdrARJZ95V0vX6bVSF533-eo15vMf5Sj7PAWHJnQjvVwlQhVhRja-lLi3AQF5jgLddtFe0BdeO5yGQCEecRqN4_FKt5zbpTOyMGEXToBUBjPfy57uGAU5sZF7O9Kk5cRXZc3iI32zC8BoQ7CKkL_-a1zQ9OYrJUOhkomfXIrUBhv8RvYO48vBt2YTw

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 670F 42 B
64 B 76ms
76ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuMD-J0G6-m6iUONLo9ZqJ3xIcx5XYemHpp27UhRUL4EzgKPu02uLlCIzOqE45XJKPjS63kHsjG6Yj6opp89njBClyq-kmziTpnczxyFUJRmM6J6HrsFMlqm9ZMK8DbK8U&sai=AMfl-YTVbbGGOqcx4462rJwU1OxOS0Z3h60-mNKjblYvv_DvZmswX64QMg9Kw6z5jb5xGHQFM03NLDQzKAXbGAnXitgPbebWJtI_BYOaOPHxr9QUflAFVfNvr7moQZQ4fuZijwXrmWs7gnw0xqWUavTnABNaTuNWmuq7NSQ3YOxo3yNTQsNToYiZsudrTtoosA&sig=Cg0ArKJSzMee505kT7IYEAE&cid=CAQSbQBygQiDXosOyxUu_15iJb7m5QnirBFomuSqSWWnCokeyU3byyD0Y6oWpN-5vk-HQl0tNAZxOgyHn58zQGCUJ01HLa9IsOb_kMY6kn3-AW3wCC9XVE8yEwrHvIy_EB0OwQs5Jxg6omFcr5THFqMYAQ&id=lidar2&mcvt=1026&p=0,0,250,300&mtos=1026,1026,1026,1026,1026&tos=1026,0,0,0,0&v=20230531&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2540336837&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1686005114045&rpt=561&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2AE9 0
20 B 77ms
77ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BaabqemV-ZMm6Hq2wx_AP35G8gAUAAAAAOAHgBAI&bg=!OTqlOm7NAAY9J7QfHSc7ADkAdvg8Wo7s6wZMet4B3wCIuBsGXVpkAs3BiCn3k4s19-Qn8G9iz8mbMR73fRgIPKMNf6aXMop7iGACAAABhlIAAAADaAEHmQNGnsPa-TnMXL0ye_q-IOa5M3tFOHx2kEwcZweAmi3Rs6w9oCXamidQNmsdqPP2dFarD1EV2PuVTmz6_gHcyfacyPPfy3qxPdkeS3G3eQNBj_oFLrxg2enmJmsdgtOgOLQBsSThNX4crh0rWOu0y2JLmDYYgF5IYuozT_sOu9Mn4t4wbb48wNlGmOEp0axUNQZDvNQsljnKzoHg91zfuUR3WHMCH4j2fKzxz4AHKLeNxXPR-HHL21cFBsCVFE0WLzC_tZrb8vbNkWCGBenE-S_2xjvrfvOt_D7jJP-B8CetCHXBC4UOcFzResufc0efDfd6VobZuGD23XNN7Gwi85JmaA7l7DkJyhd5VoNwniNCV5yfwifDFCAYcHi1BAB1jNl1WRnpCKhUr9cbclFgJ7jVvGQq4NdPD0GeHU9CnUH1IAPpMLL1jink0sr186vTAb4VFQvXr4ED6iVwrEl8E8taWzo5njCEEqIqcttRScQmQguOixHVCnuRPSJfpriYHFqbYfzvJpZVMP03iBnxWqlt7Tmki-WZiPzZOxnaR6pex3I0dONBJZXMOfVA9CdYaUqdB8hscupUqZu3Hp3Ofl0UarAmUTVb8LiiD7IRs89JrLMZDYC-Q_H-wpy_0-GJ0LNI3TbpXpmvzAuXru-SdhYuRYUCygSXj8LMceRTj0X8SxHJM-V2jClfLM-hY4pVFhp_mUVjbF1uCV_5Eu_zvDFxCzEHL3xGJCP6rc7gCaobRT02VWGKk7BGHYMniT73G2ilP4JxTIC8tGyVcEu03qhPLprMXlkyDP9QPlhabWjMsJuHkuvltQkKpNVSPyNtdNFaRKEf1M204Of3GwO3jqB9Ilu9V0nGaJkEViBY9-uyPzq4EHB7YX21_V2654QzRr1iQuPDPNlnk1BIaNFRO1gU0e1-Q_oKeCxhiCS3WLJV0wfeDqngGS7bYiHEhajHIWLeUDkK0JmOzqOqMVIJKB24xsxsHjGr_AeBOh8G_wm1tTiK7UeYS7zqxjmrM087hvh2CBLzfsDU7-zVUbUo22tLfM8OBJAkFi72311cfLb__hqj9tIStN4POUHLRpMznHDfpXhUe6V_opa1eJLod1cx95WEBUeXeQ

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 77BF 0
20 B 76ms
76ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BE0UremV-ZO_DIZHXgAfas4igAQAAAAA4AeAEAg&bg=!8POl86fNAAY9J7QfHSc7ADkAdvg8WuJRA9SBvrpY9OBeD8N-aznhB4nMx9cHZZQKyQCiUlYET1RGih5gZkZyUzZtFjKDJXY0QSICAAABWVIAAAADaAEHmQM4Gz65V5mc1JzdtZQT_WeQjaglPYrMVKxgHYonbhotIhdVvSVDH4396NjmRk2S930A0BaCXO6N8t7CIrwpMOR7Z1xxtTWpXqp1tLd0i7Uy5gPmRJr8ZMq4-iBTBAvcqsaWFaSYa1Wrq1TYLsN5l2yeU6tz1E8RTQzoFOchvA8fbCaZRnrk4bKDnE065FIx8naH5Itr7fAY-UyWg6auASui3jPWqcNYXYuXuHFvFCTzYNayzKfuCsRH7yYlDu2kU080lxPro_QVPx3uv06iqkG49I3fDm-jFvLDnj1nHIChjKSdavrUoOUTJi39LxiAAgAcKP6SJyZQgBMUg8fK7-57mMWnqQPEEdz6PXKCkhq9z4Iu54YKRT1UoUkzdpYpU8PDXsWKyTt6p05qvDqt7qJvXno_FneGeLlDF9C_gl53G6M9-DWb3t5jbf_FDyRpWqiJEzGnPcFjo8F9HmGKlcxcgQuq5RrQqu1dzprujCYYypbMsSCjKLGJAqEa6ayQEhgkwucoMwRmygIhcX4g3RTg7ScQ4Y05UWZLFGP7xIGWPdPQ1j17pRdkMjc7tOVhiEr_6KrPkhmdOsLSEq0RiRJjzLwxkjgsrfDYnqHxx_8tUWMAONIQVWUsnaNKmf0Fj0x3gfSshGwOh3_sLYOLFoCGjvGz9V8J6Jd8jkOx8XVNRJT91Y_wFL76orUstMICyVoAAG41DhV61cZmp1UycpJdWrum3wF9pOYEl4v_ISO7Zdl_PoDWnPgORmKI31RddsRMEAcp4wmGyYdg0BFD_Vh7TJhX8aqsCIJ1JROhudySzqPapJXdSFCjDDEwxllzKDDj1yqzPEBINTczK5sE4zMd0cfAcmbBW8EGnfEd__8iOyltTkXkuyirJTmtqFJCnYHAyGNZggo3gyi5i1KklgqOOm3vMFFMnkxx4Jty1szxzXV_aHcN4dvFDW7Ec9hMEYJU1Tm_Kmka2afsGNP3LUvITa1DS6W4SnFwndS4bfKP-1KiYr74zKb1jJm0AkGCi83vTOUx6LwlruZPF84D168L8iAxMQm-GvmIi5S8dmH5z88wh41gemlmaQe8VrXhIMSmKIujwCHHXOs

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9152 0
20 B 78ms
78ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bd8seemV-ZNf4IcbBx_AP9fqkqA8AAAAAOAHgBAI&bg=!jI-lj9vNAAY9J7QfHSc7ADkAdvg8WvihU-mCo3g02uQ453jzcXZI1eLP6Z7GqM1PoNMG31v3yLuhig5gCd0n7qH96vrXHutxxCACAAABF1IAAAADaAEHmQNXY4mVrPiCAcxEdxaIjtne34fWkbvkMb5LpPGUrC_a3uQ7oVHMk_NjFD00W-UcAC9Ozt1XRq3J5qahSDToJ5NRnDDJV53CBs1iU_Xfr4veBHIdxh1EV2zLZJs6OfYVjLUJgDtLln2hge0loZ9imeM1gNNAzvowvOaxKQrxrraFQUEj6eLLrn2-seD30zvXSGWEEtv0dHLxKNdrlWXt8iaMc0qR6uawsJRqxIu9aGN6caEBx-jXGttzVHy6UfjKmWQ2aaObQrQc01PAovK50aIXiK4eouBDH9H50p3pQ5KeFttnpHn21WMIsIaAEcN784KUCf3Anfd7FmuC6RXqNDT9ensy9UNNAYycONZ6vc-AzrNjiy-eO4s1qMeAAEqri3w9Wf6E_nqbflqrauZtAO5fW1nkOxgjI1DnMVtvQhaDSb_o-2-xkKJcAMJQ0x-itDy54dOsrs0Yp5b8s8CRAQIG8rYsUWT2xtK2r27r_N6DPxSmdERD323Vd1D6cPnrVeuZfKcYKmATuMfq-r5XpVQmKc2490TLmc4ICkG6ZmBj8tLNsEWaQGzJlHJl2KQ2gmt1ALyPgDXt57NGgEJ_M0TheNsaCdTfijszesiUdpqZm_YQQkYc9D2F0NZgcX-NtzaQriO35JXVbpgLhPjw0_tFHjZrMghe_ewMCB2SMBAtdr6jfjICuECDh5s9oIoumIXu4vL5pTYonB2ZfrbTX7rJuzEBJjRAOMAHY_4mYE3KDJ4rBQsfyFQyGzkbv053WKV8weUREK1p2twk3kt_lQHn7Yn91vaaopyvcMMxBkxcdSxsFknffy1su1CnhPKeITv4NTcw5wW0VXF89rWGMuo5ZLUU2TZEMF_xNLxnJX3phPO9C-WlJLTDKChwol7IQqenIhO-UojZzdoHhORJkcIDiW0BJGO1G3bYfIHXdJW6ccwVZ3KNpGJfia62vYTSMmImhbmg2A4SzTjbJwCJkAz7BLFHzRIqiraV7ROwIExW1n77NiSPyQGAJawn-w9yck4BS3s5yJ6m38x6lHdJBGWst-eaTin20TFWzhG-PbgeWJuOMh1K49aCjl9UhWr7rEmqD2aXV3KrJqEVpnr989LzoT7HdzRp4AIiwWo8LA7wTf9RmbybT2K1

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DE28 0
20 B 75ms
75ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BSSQBemV-ZLjnIpyigQfz44nYCwAAAAA4AeAEAg&bg=!X1ylXAjNAAY9J7QfHSc7ADkAdvg8Wr1vmQ__XXO8ZFcGrjCGQwd0i34TSSlWtPMEv3_n_Lk0QEYXIj81y4DaiiBZYDn4DuXZCX0CAAABD1IAAAACaAEHmQNPvx0j_bnP7w3mBjoUX9WdnTtp5UOJX0jJvaJqqP741-qPNh9g5AGsfe898wECD66otTbdZHQ7OiO_TRl7AFVKWuFkWza91WHAzMc9W1fKM9hCRWkMFs37ZIdQ7_cfR0rR9Jo4UHEj71Jn6U9cu2vQ1PWJFJXyBoI3CQTybPr6YoA5EZ19jLgS1PgLfLRRGoCJH2h1W5ll_TgHdVS_H57ZtlSWFaYRl2bTSdSFqcC9VXz0IrfMQ7czeYFV6MNGcX07YJ1R4S2eAXMf24ZSZMXmRAyX7Rp0Z72ig4EA-KOzUeMu_QOL6dcx8mH8E5ViNXSnSXZ47vSZtBich0Ulj8W0lYT83M_NPDlmRSBCnkOXkcgxDOuW1veDuNVi1L4FlIjyALW8-PE7UgQ3dAONItyo8ctcKR6_cCkD_9fnUKyxfpiHwEH6D81VDK_6tdYS_MLk4QdavWFY6R7nv2E6Ur1jOTx4rY_eU20xMCYQAdGJN8QgKsWxh58hutfLHlaGJjld76aoZ62LvefSMECCMmxB2gOaQPdyy4Ry3yibDKyladI-Vrwc4PX9Sse_-RxDDRMEeAFPHDbyu7BHEs1eVpQZgYDFSUTlpjbKLEjF-BZ50PUKcFJr8s6Yz4HLNeDO-H4F87L11bb-ZNAaU3HeNZ0owWJw17gAVbeO9kMx7nLsoGSYw9t1IqvufAk6Dcx_w8_tDOg4f-cie-dM3V3kpVZrFW4eTlsX2rEF3iYrPc6TQ1wAegyEMsFV6nxI1ilOZQi5JwlQUoohcIwIoNpXYGxMVNpnJ72Cfz53iYSAFKmquUm2gLsJKmN3QQ6wteLk_isPv7fytE8paCvSTNukp-SeoSfU9yKzlJzGcxrdnpah3c53mYPJDVD7JkZ6TlJDEtzpTIA7l1QL_ksXZS4WskosOFV2VMlGAyYvRn1fMWXzM4otdUnSiyYkR0P_laIEwLPGdfNjeGsU9Qd03dvknvDszplEMEAw_TBtwV_rO9-6W9fDf2u9eWYy0ZOHcG-HHHRhZzi_CIkz76_JR62K6xiZv1GSsRIgRslNm0a9NHSKjn2UY7Q5rK36zDriFaBr7W_aF4OPekNEid9PGApTkardX6P-0pIZ8fYsCKvXgR4yng

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 7B4B 13 KB
5 KB 40ms
39ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 19734
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 17:16:21 GMT
expires: Tue, 04 Jun 2024 17:16:21 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 635A 783 B
967 B 51ms
49ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

8173796ad71421e19b81d934c0de6f4e9e8330ac662555eeb3a6927a86cc8ea3

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-oOtIx5FiJYYEJUoRnvCtig' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 511
content-security-policy: script-src 'report-sample' 'nonce-oOtIx5FiJYYEJUoRnvCtig' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 05 Jun 2023 22:45:15 GMT
expires: Mon, 05 Jun 2023 22:45:15 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js Show response
pagead2.googlesyndication.com/bg/ Frame D10D 37 KB
14 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8afd59a03bcb312667b449341fdd15f86861886ef702e46479e76805353e1d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:24:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19249
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14644
x-xss-protection: 0
last-modified: Tue, 30 May 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Jun 2024 17:24:26 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame C376
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=ye-mek.net&sn=ChromeSyncframe&so=0&topUrl=pcloak.blob.core.windows.net&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=1sMD23wvbHlySUdieXpxbXI1aU9SbC9DN2p2MkQ3MnBZTjI1WjRKY1FtcEFvRGtScmdzaHUwa1BDM3FGb0M0Mmd2S001K045KzQ3TzU3T1MrOHJZRE1RZWNLeHlQangySVVXVllKbGdvWWI5RUJyL040RWQ1MkdoQktRWV...

446 B
678 B

148ms
43ms

Fetch
application/json

178.250.1.11

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=1sMD23wvbHlySUdieXpxbXI1aU9SbC9DN2p2MkQ3MnBZTjI1WjRKY1FtcEFvRGtScmdzaHUwa1BDM3FGb0M0Mmd2S001K045KzQ3TzU3T1MrOHJZRE1RZWNLeHlQangySVVXVllKbGdvWWI5RUJyL040RWQ1MkdoQktRWVBaOWFwUXhCMTRzclBBaTNvaEdXVGJyc1VsRTh0WktmSThrQitmSVBvdE5HSHFLSVh0cUJ2Vm5sRnI4YzM4NWFLeE1RcWFTa2UxR0dpaGhIa1BsakRFNlNyQVczRXFFNUI4WmhNTk5QYUJTZzQzSG8ySHJ3dXlDdDZtM3l1OXZTY1ZiUFVzVEpGWVpRTmk2VmkvTDI3ci9WSWJpUWJpbDBCOFFWdjBqbG9OVmkxRGZxekZsQT18&cppv=2

Protocol

Server

178.250.1.11 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

73d5b7eab23a0b0dc6f946d13d1217cae8cd5dea574f8db7f7e09edb2b9c6009

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1224376
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=1sMD23wvbHlySUdieXpxbXI1aU9SbC9DN2p2MkQ3MnBZTjI1WjRKY1FtcEFvRGtScmdzaHUwa1BDM3FGb0M0Mmd2S001K045KzQ3TzU3T1MrOHJZRE1RZWNLeHlQangySVVXVllKbGdvWWI5RUJyL040RWQ1MkdoQktRWVBaOWFwUXhCMTRzclBBaTNvaEdXVGJyc1VsRTh0WktmSThrQitmSVBvdE5HSHFLSVh0cUJ2Vm5sRnI4YzM4NWFLeE1RcWFTa2UxR0dpaGhIa1BsakRFNlNyQVczRXFFNUI4WmhNTk5QYUJTZzQzSG8ySHJ3dXlDdDZtM3l1OXZTY1ZiUFVzVEpGWVpRTmk2VmkvTDI3ci9WSWJpUWJpbDBCOFFWdjBqbG9OVmkxRGZxekZsQT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 307654
content-length: 0
expires: 0

GET
H2 200 5ed7702fe4b07a92411bc03e
ng2.virgul.com/tck/imp/ Frame AE4D 0
209 B 82ms
81ms Image
text/plain 185.7.176.221
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng2.virgul.com/tck/imp/5ed7702fe4b07a92411bc03e?g=1&t=gb&r=153378@site_geneli@yemek_net:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1%2Cgprec%3Dyemek%26rec_ing%3D&info=&mt=1686005112834&userId=vnet03f0366d-a599-434b-a4a4-0599471fc76b
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Mon, 05 Jun 2023 22:45:15 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 635A 0
0 74ms
74ms Image
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202306010101&jk=1708178952928387&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H3 200 uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js Show response
pagead2.googlesyndication.com/bg/ Frame 7B4B 37 KB
14 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/uK_VmgO8sxJme0STQf3RX4aGGIbvcC5GR552gFNT4dM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8afd59a03bcb312667b449341fdd15f86861886ef702e46479e76805353e1d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 17:24:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19249
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14644
x-xss-protection: 0
last-modified: Tue, 30 May 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Jun 2024 17:24:26 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 670F 0
20 B 73ms
73ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1481853268427&version=m202301230201&ct=76&x=1&cor=7516560276911854000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 7B4B 0
10 B 39ms
39ms Image
text/plain 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?i4zLxA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 22:45:15 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6B89 42 B
64 B 83ms
83ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvQL6lZkhhoGhdvcFS-mToI6Z3Yq7Yq67Ur12jSbnF6DxmK0f6XYPQo52At7dCs9z2W1F_Ctfwnq_bjskb42x8pTLcKDF1qqoW33SJswJniXY1wwQjWoun4o3zPBr8rd4ZuccqT0EQYXQyJ&sai=AMfl-YTAQ3fRHjSwiGw09VAfzfAQX4RMr7-9gy7jC_NqMRH3rku1W3vsno62bexS-YU3-LLlT2NT4OokbJBNNvuB3iRicNKOrV9gajp934Qdr0Icu0IaI4EoYeG94Yo&sig=Cg0ArKJSzBc8phZbSev1EAE&cid=CAQSOwBygQiDCJYEzYKDL_cRGpVX9Oe0xV06Bhs5NfbMmuSQByl74KDRoQoG0HaaL36zeaFmZOW6xyFwe6YpGAE&id=lidar2&mcvt=1002&p=0,119,40,160&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20230531&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3203893797&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1686005114162&rpt=488&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7E03 42 B
64 B 82ms
81ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvDIyhsdB4FVrIR8g_647Ohbwixn3kPo77Bzjg_T11DsssdHvtAaG8kdfTRZuBgSqC5k1GRMwz2o8IiEJnyjwHKyhct4XvwoxPs9XKE5Mrcua3BHLPtuVmM1Qrw9vSUmHFf5WOspKOj0w3V&sai=AMfl-YS3jXbFvzIqG0nhPeV6b3wgZvRs0swOSLrfAoyWBuq0qnor49mhn4tSwiTUepCsA7eLJNpsAerYzEGA3K9ZLDc0MP23rpIIVJkcxMOB_9IyfZC3zwjbCXi5xhI&sig=Cg0ArKJSzC7tyMlLDNFYEAE&cid=CAQSOwBygQiD_slBkSCd0D0cF9wTKSk0FD8ezTBKhdZ4tD7iukteP2rececEQpgtNZ2j6nme5E3l7-VQgItNGAE&id=lidar2&mcvt=1003&p=0,119,40,160&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20230531&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3299242717&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1686005114124&rpt=555&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 6363a944e4b0125bde9e6739
ng.virgul.com/tck/i_vb2/ Frame AE4D 0
209 B 82ms
81ms Image
text/plain 185.7.176.221
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng.virgul.com/tck/i_vb2/6363a944e4b0125bde9e6739?l=&r=153366@site_geneli@yemek_net:site_geneli&cs=1686005116119&userId=vnet03f0366d-a599-434b-a4a4-0599471fc76b
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Mon, 05 Jun 2023 22:45:16 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H2 200 5ed76f76e4b07a92411bc03a
ng.virgul.com/tck/i_vb2/ Frame AE4D 0
209 B 83ms
82ms Image
text/plain 185.7.176.221
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng.virgul.com/tck/i_vb2/5ed76f76e4b07a92411bc03a?l=&r=153377@site_geneli@yemek_net:site_geneli&cs=1686005116119&userId=vnet03f0366d-a599-434b-a4a4-0599471fc76b
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Mon, 05 Jun 2023 22:45:16 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H2 200 5ed771bae4b07a92411bc04c
ng.virgul.com/tck/i_vb2/ Frame AE4D 0
209 B 82ms
82ms Image
text/plain 185.7.176.221
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng.virgul.com/tck/i_vb2/5ed771bae4b07a92411bc04c?l=&r=153382@site_geneli@yemek_net:site_geneli&cs=1686005116120&userId=vnet03f0366d-a599-434b-a4a4-0599471fc76b
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Mon, 05 Jun 2023 22:45:16 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H2 200 5ed771e3e4b07a92411bc04e
ng.virgul.com/tck/i_vb2/ Frame AE4D 0
209 B 82ms
82ms Image
text/plain 185.7.176.221
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng.virgul.com/tck/i_vb2/5ed771e3e4b07a92411bc04e?l=&r=153383@site_geneli@yemek_net:site_geneli&cs=1686005116120&userId=vnet03f0366d-a599-434b-a4a4-0599471fc76b
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Mon, 05 Jun 2023 22:45:16 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 083D 0
20 B 73ms
73ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=7026243360477&version=m202301230201&ct=76&x=1&cor=18372249592536396000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6B89 0
20 B 73ms
73ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=7007617902818&version=m202301230201&ct=119&x=1&cor=4995774255353773000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7E03 0
20 B 73ms
73ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=7592124804927&version=m202301230201&ct=119&x=1&cor=10103871710852602000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 097C 0
20 B 73ms
73ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=84435401753&version=m202301230201&ct=76&x=1&cor=17832661756419645000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1D20 0
20 B 74ms
74ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8639348902591&version=m202301230201&ct=76&x=1&cor=16898412597196448000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4980618eb19055a5b85e05bcdbd692bb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Jun 2023 22:45:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame AE4D 0
0 76ms
76ms Image
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202306010101&jk=1708178952928387&bg=!m5ilmMzNAAY9J7QfHSc7ADkAdvg8Ws0dAYuBxG0ffTXKO7L1zx3cXxEhe4T58dPmTIItJMhxkQtq612t66v2jG52pw24NunhiXgCAAAAVFIAAAACaAEHmQMKpe6DFhBBcHeHXRGSoii_5aqVQ15WCRC7T2n6VtKzsclabdGxP-VA1DiQYRdkIRJdzR4kjDsV5-JmdE_lNOuiuDc9_uyMpqxTz8SjO_UDcx04qblUZXdOyEVvMQzkg65Zj45fE0LBw0SH7k-TZgmM14tVLL8ZWMKBaMHPDnKFIS9A1ZWwFrLUjIuGyF5DOm_hDU4TtnWiT0QYGsMmdn7bOSP776TPCzLK2RCqUXRfFjy9DMqKWwz4YTa0BnpJ4239lD0CHG9LsRRrQZWx-gLnW6I4WXyHpvWuOjA00Zox9a81vfJOdkdHscxxzrzgf3PJXXYAnO95lKpLDmqnjjQnID7rOY_P-A4rGDnfOr8XRaDGWwkgG0kNMUnbUG5pmzxTLElfAdq7se1kmIWK4Rs1zMhHeaHjx4aNACnL8KY1CgisCPSoHAhMOqXoLDTjP_s8GpYnrDu92h0agypVFbrcOQkU-6yybonvvC6pjaHSsdG3rto_mdfaHR_FbtTW7czBLz77qQZi4xdtq9x_0r0ZfNa24uqAsjHEofrF3xHdv3CkElgzzZ15u_PGgC3NyeXMz8aECE4tC_2d2z7ypFAkyzTp7sMijbIpDSkXxAqYUOcreZ74EtDc0Nm4fCv88XIQ2CyfoTfYKG5AIX-Ch7woY1mTfzURBjeMLX2CFTU4prP3kp5NMBzBrupt0i7MyYcPN7NyMguXwqRyAHEhh1mK9tZSxHhB0Dae6Se3W4flif94RTIK6DLB3thgo8V24rtz4UoBXgvrxnXXVNvNfgqe3AWorN0jPQtBwsGykeaXgA5yXglNz62vT-3aovFpTj1MLhBJ1pcCnPnHKs0LJUprg4TnzSDs0V_ud6z3k7KCtB8kyEjWeac084HIyfljsJYHEV2lYWJTquBwZUv6185HStinmfTBkxfH-DASD0EPrHvjh2HAF0rlvkxiZbRdB3eyyDtlvei5Ns_QSauQfCbT-gcR59bKn0J3oL6wHpAmblZvKaixqj-vd4IbX7p1990PRD24DdYx-buFWQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H2 200 rid Show response
match.adsrvr.org/track/ Frame AE4D 63 B
385 B 55ms
55ms XHR
application/json 3.33.220.150

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ad7d7a0b90b7137f954b7f562a4e154f3260cd6317805187b15c3f1fae1659a2

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 05 Jun 2023 22:45:16 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ye-mek.net
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 63
expires: Wed, 05 Jul 2023 22:45:16 GMT

GET
H2 200 5ed7706de4b07a92411bc042
ng2.virgul.com/tck/imp/ Frame AE4D 0
209 B 82ms
81ms Image
text/plain 185.7.176.221
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng2.virgul.com/tck/imp/5ed7706de4b07a92411bc042?g=1&t=gb&r=153379@site_geneli@yemek_net:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1%2Cgprec%3Dyemek%26rec_ing%3D&info=&mt=1686005112834&userId=vnet03f0366d-a599-434b-a4a4-0599471fc76b
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Mon, 05 Jun 2023 22:45:16 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 14A3 16 KB
6 KB 158ms
53ms Document
text/html 23.35.236.201

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=105808
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Mon, 05 Jun 2023 22:45:16 GMT
expires: Wed, 07 Jun 2023 04:08:44 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK check.html Show response
biddr.brealtime.com/ Frame 9CD4 977 B
1 KB 153ms
47ms Document
text/html 172.67.213.127

General

Check archive.org

Show headers Download Go to

Full URL: https://biddr.brealtime.com/check.html
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 172.67.213.127 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 80d5376e68f3824be9e97919bdc5ded99f0103ca92bc92717b46bb4f394d3402

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Age: 1459
CF-Cache-Status: HIT
CF-RAY: 7d2bf1ec480d6945-FRA
Cache-Control: max-age=60
Connection: keep-alive
Content-Encoding: br
Content-Type: text/html
Date: Mon, 05 Jun 2023 22:45:16 GMT
Last-Modified: Thu, 26 Jan 2023 15:01:29 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4RV6yMIfKgKpOxVDXQnU%2BaTgCmzQwpvE8KpmL%2Bc%2BbccTh9h3OmKsTWsMifHT6dG2876C3vapkzTCb%2F3ua%2BCFm0dTKSAyJY%2BiqSTaGdrOnS9sJw4vc4Im1PonrSPfHeOy8m5%2BTIIn"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
Via: 1.1 4d0ae7ca3bb5e2d6eaa1450e1906adb4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: hpexBkpI4mF_YWjJZg7tsdfmXIc0e8HL6VSZp4YLOFDYRRmb7pYKNw==
X-Amz-Cf-Pop: FRA56-P2
X-Cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame E96F 52 KB
17 KB 178ms
43ms Document
text/html 23.35.236.188

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 -, , ASN (),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Mon, 05 Jun 2023 22:45:16 GMT
ETag: "623de86a-cf34"
Expires: Tue, 06 Jun 2023 22:45:18 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 6577 281 B
554 B 157ms
40ms Document
text/html 23.56.202.187

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.202.187 -, , ASN (),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 05 Jun 2023 22:45:16 GMT
ETag: "40010-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 6577 34 KB
10 KB 40ms
40ms Script
text/html 23.56.202.187

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.202.187 -, , ASN (),
Reverse DNS
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 972755983c98afbfb107d5b6da02f1eaef49d9bef146531bf655142633effb76

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Mon, 05 Jun 2023 22:45:16 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Jun 2023 19:17:42 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=73972
Connection: keep-alive
Content-Length: 10113
Expires: Tue, 06 Jun 2023 19:18:08 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 14A3 3 KB
3 KB 45ms
45ms Script
text/html 185.64.189.115

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=41400919&p=159432&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.115 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04ddf4a2947a216c417ecba94f48dd50bd8f69e652297915871207988e864e21

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Mon, 05 Jun 2023 22:45:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame E96F 0
857 B 40ms
40ms Script
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS